Data Processing Addendum

1. About this addendum

This Data Processing Addendum (“DPA”) forms part of the agreement under which a company uses Rehearse for Teams — its order form or other signed agreement together with our Terms of Use (the “Agreement”).

2. Definitions

• Data Protection Law means the data protection laws that apply to the processing, which may include India’s Digital Personal Data Protection Act, 2023, the EU and UK GDPR, and US state privacy laws.
• Customer Personal Data means personal data about the Customer’s people that we process on the Customer’s behalf to provide Rehearse for Teams.
• Controller, processor, data subject, personal data breach and similar terms have the meanings given in Data Protection Law. Under India’s DPDP Act, “controller” means data fiduciary and “processor” means data processor.

3. Roles

The Customer is the controller of Customer Personal Data, and Mobil80 is its processor.

Mobil80 is an independent controller only for the limited data it needs to run its own business: account security and abuse prevention, billing and accounting records, meeting its legal obligations, and aggregate statistics that don’t identify anyone. Its Privacy Policy covers that data. [to confirm: whether Mobil80 also acts as controller for any other Teams data, e.g. an individual’s own transcripts]

4. Scope of processing

5. Our instructions

We process Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA and the Customer’s use of the portal’s settings are those instructions. If the law requires us to process data otherwise, we’ll tell the Customer first unless the law forbids it. We’ll tell the Customer if we believe an instruction breaks Data Protection Law.

We won’t use Customer Personal Data to train AI models, sell it, or use it for advertising.

6. The Customer’s responsibilities

• Having a lawful basis for the processing, and for using what it sees in the portal.
• Telling its people, before they’re invited, what the Customer can see about their practice — as listed in our Privacy Policy — and how it will use it.
• Deciding who gets admin or program lead access, and whether to turn on join by work-email domain.
• Keeping its admins’ access secure, and the instructions it gives us lawful.

What the Customer can see

Rehearse for Teams shows the Customer each person’s activity, scores, skill averages, program progress and real-conversation verdicts, plus team and company figures. It doesn’t show transcripts, audio, scenarios a person writes for themselves, or the feedback on any rehearsal the person hasn’t chosen to share. These limits are part of the service, and we won’t lift them on the Customer’s instruction, except where the law requires us to.

7. Confidentiality

Everyone at Mobil80 who can access Customer Personal Data is bound by confidentiality obligations, and gets access only as far as their role needs.

8. Security measures

We maintain appropriate technical and organizational measures to protect Customer Personal Data, described on our security page. They include:

• hosting on AWS in the United States, with encryption in transit (TLS) and at rest;
• one-time-code sign-in, with no passwords;
• server-side scoping of every Teams request to the caller’s own company, and role checks on every request;
• role-based staff access and audit logging of sensitive actions;
• no recording of session audio, and automatic deletion of transcripts after 30 days and session data after 90 days.

We may update these measures as long as the overall level of protection doesn’t go down.

9. Subprocessors

The Customer authorizes us to use the subprocessors listed on our subprocessors page. We’ll give the Customer at least [to confirm: notice period, e.g. 30 days] notice by email before adding or replacing one. If the Customer has a reasonable, data-protection-based objection, we’ll discuss it in good faith; if we can’t resolve it, the Customer may end the affected part of the Agreement. [to confirm: refund or other remedy on termination for objection]

We put data protection terms in place with each subprocessor that protect Customer Personal Data at least as well as this DPA, and we remain responsible for their performance.

10. Helping with data subject requests

If one of the Customer’s people asks us to access, correct, delete or export their data, or otherwise exercise their rights, we’ll pass the request to the Customer or tell the person to contact the Customer, unless the request is about data we hold as an independent controller. Taking into account the nature of the processing, we’ll help the Customer respond, including through the tools in the app and portal. People can always delete their own account from the app.

11. Personal data breaches

If we become aware of a personal data breach affecting Customer Personal Data, we’ll notify the Customer without undue delay and in any event within [to confirm: notification deadline in hours]. We’ll tell the Customer what happened, what data and people are likely affected, what we’re doing about it, and who to contact, and we’ll update the Customer as we learn more. Notifying the Customer isn’t an admission of fault.

12. Impact assessments and consultations

We’ll give the Customer reasonable information and help with data protection impact assessments and consultations with regulators, where they relate to our processing.

13. Deletion or return at the end

Before the Agreement ends, the Customer can ask us for an export of the company’s portal data. Within [to confirm: deletion period after the Agreement ends, e.g. 30 days] after it ends, we’ll delete Customer Personal Data from the live service, unless the law requires us to keep it. Backups expire within 35 days after that.

When a person leaves a seat, their Rehearse account becomes a personal account, which they control. Data in it from then on isn’t Customer Personal Data.

14. International transfers

Customer Personal Data is processed in the United States, where our main infrastructure and our AI provider are, and may be accessed from India, where Mobil80 is based. Some subprocessors may process it in other countries. We make these transfers as Data Protection Law permits. [to confirm: whether we offer the EU Standard Contractual Clauses / UK Addendum to EU and UK customers, and if so, which modules]

15. Audits

We’ll make available the information reasonably needed to show we’re meeting this DPA, including answering a reasonable security questionnaire once a year. We don’t have a SOC 2 report or other third-party certification yet.

If that information isn’t enough, or a regulator requires it, the Customer may carry out an audit, at its own cost, on reasonable notice, during business hours, with an auditor bound by confidentiality, and in a way that doesn’t compromise other customers’ data. [to confirm: notice period and frequency for audits]

16. Liability and precedence

• Each party’s liability under this DPA is subject to the limitations of liability in the Agreement.
• If this DPA conflicts with the Agreement on how personal data is processed, this DPA wins.
• This DPA is governed by the same law, and disputes go to the same courts, as the Agreement.

17. Contact and signatures

Questions about this DPA: akil@rehearsenow.app.