Data processing agreement

This agreement applies when Supermode d.o.o. ("critlab", the processor) handles personal data for a customer ("you", the controller) through critlab's hosted service. It is part of the Terms of Service and applies automatically; we will sign a copy on request. It is written to meet Article 28 of the GDPR.

What this covers

• Subject matter and nature: hosting prototypes, the comments, replies, voice notes, screenshots, images and page snapshots left on them, and the links and documents a workspace attaches to its folders; and making all of it available to the people you choose.
• Purpose: providing critlab to you, as described in the Terms. We do not use the data for any other purpose of our own.
• Duration: as long as your workspace exists, plus the time needed to delete the data as described in the Privacy Policy.
• Types of personal data: names, email addresses, display names, the content of comments and voice notes, and whatever personal data appears in a prototype, a screenshot, an image attached to a comment, a page snapshot or a folder document, together with browser, device and usage details.
• Whose data: your workspace members and guests, your reviewers, and any other person who appears in your content.

What critlab does

1. Acts on your instructions. We handle the data only on your documented instructions, which are the Terms, this agreement, your use of critlab's features and your settings, including for transfers outside the EEA as described below. If EU law or the law of an EU member state requires us to handle the data in another way, we tell you before we do, unless that law forbids telling you. If we think an instruction breaks data-protection law, we tell you.
2. Keeps it confidential. Everyone at critlab who can reach the data is bound to confidentiality.
3. Secures it. We apply technical and organisational measures suited to the risk, as described under "Security measures" below.
4. Uses subprocessors only as agreed. You give general authorisation for the subprocessors on the subprocessors page. We bind each to the same obligations in writing, we stay responsible for them, and we give you 30 days' notice before adding or replacing one. You may object on reasonable data-protection grounds in that time.
5. Helps you with requests. We help you answer requests from people exercising their rights, and with your obligations on security, breach notification, impact assessments and consultation, as far as our role allows.
6. Tells you about a breach. We tell you without undue delay after we become aware of a personal data breach affecting your data. We tell you what happened, which kinds of data and roughly how many people and records are affected, the likely consequences, what we have done or will do about it, and who at critlab you can ask. If we do not know everything yet, we tell you what we know and send the rest as we learn it.
7. Deletes or returns it. When the agreement ends, we delete your data, or return it on request, unless the law requires us to keep it. Deletion in critlab is permanent, and backup copies disappear within 30 days.
8. Lets you check. We give you the information needed to show we meet this agreement and allow reasonable audits, by you or an auditor you choose, with notice and during working hours, without exposing other customers' data.

Our liability under this agreement is subject to the limits in the Terms' warranty and liability section, except where the law does not allow them. This does not limit what a person whose data it is can claim under the GDPR.

What you do

You are responsible for having a lawful basis for the data you put into critlab, for informing the people it concerns (including your reviewers), and for the choices you make in the product, such as who can open a prototype.

Transfers outside the EEA

Our subprocessors that are based outside the European Economic Area handle your data under the European Commission's standard contractual clauses, or another valid transfer mechanism such as the EU–US Data Privacy Framework.

Standard contractual clauses

To the extent personal data is transferred outside the EEA in a way that needs them, the standard contractual clauses in the European Commission's Implementing Decision (EU) 2021/914 are incorporated by reference, as follows:

• Modules: Module Two (controller to processor) between you and critlab; Module Three (processor to processor) where you act as a processor for someone else.
• Clause 7 (docking): not used.
• Clause 9(a) (subprocessors): Option 2, general written authorisation, with the 30 days' notice above.
• Clause 11(a) (redress): the optional independent dispute resolution body is not used.
• Clause 17 (governing law): the law of Croatia.
• Clause 18 (courts): the courts in Zagreb.
• Annex I (parties and transfer): the parties are you and critlab; the data, subjects, purposes and duration are listed under "What this covers"; the competent supervisory authority is the Croatian Personal Data Protection Agency (AZOP) unless you are established elsewhere in the EU.
• Annex II (security measures): see below.
• Annex III (subprocessors): the subprocessors page.

If these terms and the standard contractual clauses conflict, the clauses prevail.

Security measures

• Isolation of untrusted content. Every uploaded prototype is served from its own origin in a sandboxed frame with strict browser security rules, and never indexed.
• Access control. Sign-in by one-time code, Google, Microsoft or SAML; roles and folder grants checked on the server for every request; optional enforced single sign-on; scoped API keys.
• Protection of data. Encryption in transit; credentials for workspace storage encrypted at rest; signed, expiring links to prototypes.
• Limits on what servers reach. Outbound requests to addresses a user supplies go through a guard that refuses internal and unsafe destinations.
• Accountability. An audit log of membership, access and settings changes.
• Resilience and deletion. Regular backups that roll off within 30 days; permanent deletion on request.

The security overview describes these in more detail.

Contact

Questions about this agreement, or a signed copy: support@critlab.app.