Data Processing Addendum
This Data Processing Addendum (“Addendum”) is part of the Terms of Service between VELZI.AI Limited (“we”) and an organisation that uses a TokenToko team for its own people (“you” or the “Customer”). It applies automatically when a team owner accepts the Terms of Service for an organisation. You don’t need to sign anything. If your organisation needs a signed copy, write to privacy@tokentoko.ai.
1. Definitions
In short: the words used in this addendum.
“Data Protection Law” means the UK GDPR, the UK Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (EU) 2016/679 and the laws of EU member states that supplement it.
“Controller”, “processor”, “personal data”, “processing”, “data subject” and “personal data breach” have the meanings given in Data Protection Law.
“Customer Personal Data” means the personal data described in Annex 1 that we process for you as your processor.
“Sub-processor” means a service provider we engage to process Customer Personal Data.
2. Roles
In short: for your team’s data we act for you; for accounts, billing and security we decide ourselves.
For Customer Personal Data, you are the controller and we are your processor.
We are a separate controller for the personal data we need to run TokenToko for everyone, as our Privacy Policy describes: sign-in accounts, payments, security of the service, our own analytics and support. This Addendum doesn’t apply to that data.
3. Your instructions
In short: we use your team’s data only to run TokenToko for you.
We process Customer Personal Data only on your documented instructions. The Terms of Service, this Addendum and the way you configure and use your team are your instructions. If we believe an instruction breaks Data Protection Law, we will tell you. If the law requires us to process Customer Personal Data in another way, we will tell you first unless the law forbids it.
You are responsible for having a lawful basis for the processing and for telling your people what a team admin can see, as described in our Privacy Policy.
4. Confidentiality
In short: only people who need to, and who are bound to secrecy.
Only staff and contractors who need access to provide, secure or support TokenToko can access Customer Personal Data, and they are bound to keep it confidential.
5. Security
In short: the measures in Annex 2, kept up to date.
We apply the technical and organisational measures in Annex 2 to protect Customer Personal Data. We may update them as long as the overall level of protection doesn’t go down.
6. Sub-processors
In short: you allow the providers on our list, and we give you 30 days’ notice of new ones.
You give us general authorisation to use the sub-processors on our sub-processor list. We impose data protection terms on each one that protect Customer Personal Data at least as well as this Addendum, and we remain responsible for their work.
We email the owners of your team at least 30 days before a new sub-processor starts processing Customer Personal Data. You can object on reasonable data protection grounds within those 30 days. We will then try to address your objection. If we can’t, you may end the affected part of the service without penalty, and we refund any prepaid fees for the time left.
7. International transfers
In short: transfers outside the UK and the EU use the legal safeguards.
We store Customer Personal Data in the European Union. Where we or a sub-processor transfer it to a country without an adequacy decision, the transfer is covered by the EU standard contractual clauses (Commission Decision 2021/914) and, for data from the UK, the UK International Data Transfer Addendum, or by another mechanism Data Protection Law accepts, such as the recipient’s certification under the EU-US Data Privacy Framework and its UK Extension.
8. Helping you
In short: we help you answer requests, assess risks and meet your duties.
Taking into account the nature of the processing, we help you:
answer requests from your people who use their data protection rights. If we receive such a request directly, we pass it to you and don’t answer it ourselves unless you ask us to;
carry out data protection impact assessments and consult a supervisory authority, where the law requires it;
meet your security and breach notification duties.
9. Personal data breaches
In short: we tell you without undue delay and help you deal with it.
If we become aware of a personal data breach affecting Customer Personal Data, we notify the owners of your team without undue delay. We tell you what happened, what data and people are affected as far as we know, the likely consequences and what we are doing about it, and we add details as we learn them. We take reasonable steps to contain the breach and limit its effects.
10. Deletion and return
In short: at the end, we delete your team’s data within 30 days.
When your use of TokenToko ends, or when you delete your team, we stop processing Customer Personal Data. You can export your data before that by writing to privacy@tokentoko.ai. We delete Customer Personal Data within 30 days, apart from copies in backups, which are deleted as the backups expire on their rolling schedule, and data the law requires us to keep. Subscription tokens are deleted straight away.
11. Information and audits
In short: we give you what you need to check that we keep to this addendum.
We make available the information you reasonably need to show that we comply with this Addendum, including answers to reasonable security questionnaires. If that isn’t enough, you or an independent auditor bound to confidentiality may audit our compliance once a year, with at least 30 days’ notice, during business hours and at your cost. More audits are possible after a personal data breach or when a regulator requires one.
12. Liability, order of precedence and law
In short: the Terms’ liability rules apply, and this addendum wins on data protection.
Each party’s liability under this Addendum is subject to the limits in the Terms of Service, except where Data Protection Law doesn’t allow a limit. If this Addendum and the Terms of Service conflict on data protection, this Addendum applies. If standard contractual clauses apply and conflict with this Addendum, the clauses apply. This Addendum is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction, unless the standard contractual clauses require otherwise.
13. Annex 1: details of the processing
In short: what we process for you, about whom, and why.
Subject matter and duration: providing TokenToko to your team, for as long as you use it, plus the deletion period in section 10.
Nature and purpose: storing and leasing subscription tokens to your team’s computers, rotating between subscriptions, showing your team’s computers, usage and activity to its owners and admins, sending team emails and alerts, and supporting you.
Data subjects: your team’s owners, admins, finance users and members, and people you invite.
Personal data:
names, email addresses, roles and invitations;
subscription labels, sharing settings and usage limit events of the subscriptions your people connect;
details of the computers your people connect: computer ID, name, host name, operating system, hardware, local network addresses, container and Kubernetes details, software versions;
public IP addresses and approximate locations of those computers;
computer events, usage counts per hour and model, and logs collected on request;
the team’s activity log.
Special categories of data: none intended. Don’t put special category data in subscription labels, computer names or other free text.
Frequency: continuous while your team uses TokenToko.
14. Annex 2: security measures
In short: the measures we actually apply today.
Encryption: subscription tokens are encrypted with AES-256-GCM before they are stored. All traffic between your computers, the dashboard and our servers uses TLS.
Isolation: our database and backend are not reachable from the internet and are reached through an authenticated tunnel. Connecting a subscription happens in a disposable container that can reach only the provider’s sign-in and API addresses, and that is destroyed afterwards.
Computer identity: each computer has its own key pair. On Windows the private key is created as a non-exportable system key. Requests from computers are signed, and a computer can be revoked at any time.
Keys: API keys and join tokens are stored only as fingerprints and shown once.
Access control: team roles limit who can change subscriptions, computers, keys and billing. Members are read-only. Remote actions on a computer can be sent only by its owner.
Secrets in logs: tokens and keys are removed from events and logs on the computer and again on our servers. Analytics recordings hide secrets.
Monitoring: an activity log of team changes, alerts when a computer appears in a new country, and monitoring of our services.
Updates: our software checks the signature of each update before installing it.
Backups: daily database backups, stored with two providers, that expire on a rolling schedule. Subscription tokens stay encrypted inside them, and the copy in Cloudflare is encrypted as a whole.
People: access to production systems is limited to the staff who run TokenToko.
15. Annex 3: sub-processors
In short: see the list.
The sub-processors authorised under section 6 are those on our sub-processor list on the date you accept this Addendum, as updated under section 6.