Data Processing Agreement

🌐 This page has been translated for your convenience. If the translation and the English version differ, the English version governs.

This Data Processing Agreement ("DPA") forms part of the Agreement between PollSlide Technologies LLC ("PollSlide", "Processor") and the customer identified in the Agreement ("Customer", "Controller") and governs PollSlide's processing of Personal Data on the Customer's behalf. It reflects the requirements of Article 28 of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and, where applicable, the UK GDPR. To put it into effect, download it, complete the signature block, and email a signed copy to help@pollslide.com; we will counter-sign. Where this DPA conflicts with the Agreement on data protection, this DPA controls.

1. Definitions

"Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Supervisory Authority" have the meanings given in the GDPR. "Subprocessor" means any third party engaged by PollSlide to process Personal Data. "Standard Contractual Clauses (SCCs)" means the clauses approved by EU Commission Decision 2021/914 for transfers to third countries. "Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, including the GDPR, UK GDPR, and applicable US state privacy laws (e.g. CCPA/CPRA).

2. Roles and scope

As between the parties, the Customer is the Controller and PollSlide is the Processor of the Personal Data described in Annex A. PollSlide processes Personal Data only to provide and support the Service. Where the Customer is itself a processor for a third-party controller (for example, a school acting for a district), PollSlide acts as a sub-processor and these terms apply accordingly.

3. Processing on documented instructions

PollSlide will process Personal Data only on the Customer's documented instructions — including as set out in the Agreement, this DPA, and the Customer's configuration and use of the Service — unless required to act by applicable law, in which case PollSlide will (where legally permitted) inform the Customer first. PollSlide will inform the Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Confidentiality

PollSlide ensures that persons authorised to process Personal Data are bound by confidentiality obligations and process Personal Data only as necessary to provide the Service.

5. Security of processing

PollSlide implements appropriate technical and organisational measures ("TOMs") to ensure a level of security appropriate to the risk, as described in Annex B, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing.

6. Subprocessors

The Customer grants PollSlide general authorisation to engage the Subprocessors listed at pollslide.com/subprocessors. PollSlide imposes data-protection obligations on each Subprocessor no less protective than those in this DPA and remains liable for their performance. PollSlide will give at least 30 days' notice of any intended addition or replacement of a Subprocessor (via the notification list described on that page), during which the Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, the Customer may terminate the affected Service.

7. Data subject rights

Taking into account the nature of the processing, PollSlide will assist the Customer by appropriate technical and organisational measures, insofar as possible, to respond to requests from Data Subjects exercising their rights (access, rectification, erasure, restriction, portability, and objection). If PollSlide receives such a request directly, it will promptly forward it to the Customer and not respond except on the Customer's instruction. Self-service tools for many of these requests are available in the product and via Admin support.

8. Assistance with obligations

PollSlide will assist the Customer, taking into account the nature of processing and information available to PollSlide, in ensuring compliance with its obligations under Articles 32–36 GDPR, including security of processing, breach notification, data protection impact assessments, and prior consultation.

9. Personal data breach notification

PollSlide will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data. The notice will describe, to the extent known: the nature of the breach and categories/approximate number of Data Subjects and records affected; the likely consequences; the measures taken or proposed to address it and mitigate harm; and a contact point for more information. PollSlide will cooperate with the Customer and take reasonable steps to mitigate and remediate.

10. Return and deletion

On termination of the Service, and at the Customer's choice, PollSlide will delete or return all Personal Data and delete existing copies, unless retention is required by law. Routine deletion timelines are described in our Privacy Policy. Backups are purged on our standard rotation.

11. Audits

PollSlide will make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates. To minimise disruption, PollSlide may satisfy audit requests by providing its security documentation and responding to a reasonable number of written questions; on-site audits are by prior written agreement, during business hours, and subject to confidentiality.

12. International transfers

Where PollSlide processes Personal Data originating from the EEA, UK or Switzerland in a country without an adequacy decision, such transfers are governed by the Standard Contractual Clauses, which are incorporated into this DPA by reference (Module Two: Controller-to-Processor, or Module Three where PollSlide acts as sub-processor), with PollSlide as "data importer". The UK Addendum and Swiss amendments apply where relevant. Annex details in this DPA populate the corresponding SCC annexes.

13. Term, liability and law

This DPA takes effect on the Effective Date and continues while PollSlide processes Personal Data for the Customer. Each party's liability under this DPA is subject to the limitations of liability in the Agreement. This DPA is governed by the law stated in the Agreement; where the Agreement is silent and the Customer is in the EEA/UK, the SCCs' governing-law and forum provisions apply to transfer matters.

Annex A — Details of processing

Annex B — Technical and organisational measures

• Encryption: data encrypted in transit (TLS) and at rest by our infrastructure providers.
• Access control: role-based access, least-privilege administration, authenticated access to production systems, and audited admin actions.
• Tenant isolation: session and account data scoped to the owning account.
• Resilience: managed, redundant cloud infrastructure with provider backups and the ability to restore service.
• Payment security: card data handled by Stripe (PCI-DSS Level 1); PollSlide does not store full card numbers.
• Content safeguards: automated profanity, link/spam and AI image-safety filtering, plus presenter moderation controls, on a reasonable-efforts basis.
• Vendor management: subprocessors engaged under Article 28 terms with transfer safeguards; a public subprocessor list is maintained.
• Monitoring & response: system-health monitoring and a documented breach-notification process (72-hour target).
• Data minimisation: anonymous audience participation is supported; we do not sell personal data or use audience responses to train AI models.

Signature

By signing the Agreement or a copy of this DPA, the parties agree to these terms. To execute, download this page as a PDF, complete the block below, and return it to help@pollslide.com.