Summary at a glance
Key takeaways in plain language before reading the binding terms below.
- Explicit Controller-Processor relationship establishing that Customer retains complete instructions authority.
- Comprehensive Technical and Organizational Measures (TOMs) covering encryption, physical security, and auditing.
- Strict subprocessor notification rules with a 30-day prior notice window for enterprise objections.
- Assistance with Data Subject Access Requests (DSARs) and regulatory audits at no additional burden.
- Prompt breach notification timeline (within 48 hours of confirmed security incident).
This Data Processing Agreement ('DPA') governs the processing of Personal Data by Jeeym on behalf of Customer in connection with the Jeeym Customer Terms of Service. This DPA satisfies the requirements of Article 28 of the General Data Protection Regulation (GDPR) and equivalent global data protection laws.
Roles, purpose and customer instructions
Customer acts as the Data Controller (or Business under CCPA/CPRA) and Jeeym acts as the Data Processor (or Service Provider).
Jeeym shall process Customer Personal Data solely on documented instructions from Customer, including with respect to international transfers, unless required to do so by applicable statutory law to which Jeeym is subject.
Technical and organizational measures (TOMs)
Jeeym implements and maintains robust technical and organisational security controls designed to ensure a level of security appropriate to the risk:
- Encryption of personal data in transit using TLS 1.3 and at rest using AES-256.
- Role-based access control (RBAC), multi-factor authentication, and just-in-time administrative access logging.
- Regular third-party vulnerability assessments, penetration testing, and annual SOC 2 Type II audit verifications.
- Continuous automated backups with geographical replication and tested disaster recovery failover protocols.
Subprocessor governance and prior notice
Customer provides general authorization for Jeeym to engage subprocessors to assist in providing the Service.
Jeeym maintains an up-to-date directory of subprocessors at /legal/subprocessors and provides enterprise customers with at least thirty (30) days' advance notice before onboarding new infrastructure subprocessors.
Security incident and breach notification
In the event of a confirmed Personal Data Breach affecting Customer Personal Data, Jeeym will notify Customer without undue delay and, in any event, within forty-eight (48) hours of becoming aware of the breach.
Jeeym will provide timely details regarding the nature of the breach, affected records, remediation actions taken, and recommended mitigations for Customer.
Return and deletion of personal data
Upon termination or expiration of the subscription, Customer may export all workspace personal data. Within ninety (90) days following termination, Jeeym shall permanently delete and overwrite all remaining copies of Customer Personal Data in production systems, except where retention is mandated by law.
Was this policy clear and helpful?
Your feedback helps our legal and governance teams improve clarity.
Previous revisions of this agreement can be requested by emailing [email protected].
View all legal documents →