Introduction
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Vp Technology Ltda, a company registered in Brazil under CNPJ 30.286.117/0001-44, with its address at Rua Maestro Elias Lobo, 994, Apt 21, Bloco C, Jardim Paulista, São Paulo, SP, 01433-000, Brazil ("Pipeback", "we", "us", or "our"), and the customer that uses Pipeback's Services ("Customer", "you", or "your").
This DPA applies when Pipeback processes personal data on your behalf while providing the hosted Services. If you run Pipeback on your own server, we do not process that data and this DPA does not apply. It reflects the parties' obligations under the Brazilian General Data Protection Law (Lei nº 13.709/2018, "LGPD"), the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and other data protection laws that apply to the processing.
By accepting the Terms of Service or using the Services, you accept this DPA. If you need a countersigned copy for your records, write to support@pipeback.com.
1. Definitions
1.1."Data Protection Laws": The LGPD, the GDPR, the UK GDPR and any other law on the processing of personal data that applies to the processing under this DPA.
1.2."Customer Personal Data": Personal data that Pipeback processes on the Customer's behalf while providing the Services.
1.3."Controller", "Processor", "Data Subject", "Personal Data Breach" and "Processing": Have the meanings given to them in the Data Protection Laws. Under the LGPD, "Controller" means "controlador" and "Processor" means "operador".
1.4."Subprocessor": A third party that Pipeback engages to process Customer Personal Data.
1.5."Services": The services described in the Terms of Service.
2. Roles of the parties
2.1.The Customer is the Controller of Customer Personal Data, and Pipeback is the Processor that processes it on the Customer's behalf.
2.2.Pipeback is the Controller of the personal data it processes to run its own business, such as account, billing and website analytics data. That processing is described in our Privacy Policy, not in this DPA.
2.3.The Customer is responsible for having a lawful basis for the Customer Personal Data it gives Pipeback to process, and for the instructions it gives.
3. Processing instructions
3.1.Pipeback processes Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise. In that case, Pipeback will tell the Customer before processing, unless the law forbids it.
3.2.The Terms of Service, this DPA and the Customer's use and configuration of the Services are the Customer's complete instructions.
3.3.Pipeback will tell the Customer if, in its opinion, an instruction breaks the Data Protection Laws.
4. Details of the processing
4.1.Subject matter: Providing the Services: building and publishing forms, collecting and storing the submissions respondents send through them, including uploaded files, measuring form visits, and delivering submissions to the integrations, webhooks and API clients the Customer sets up.
4.2.Duration: For as long as the Customer uses the Services, and afterwards until the data is deleted as described in Section 11.
4.3.Nature and purpose: Collecting, storing, organizing, scanning uploaded files for malware, exporting, transmitting to the integrations and webhooks the Customer connects, and deleting data, so that the Customer can use the Services.
4.4.Categories of Data Subjects:
- The Customer's users and the members it invites to its workspaces
- The respondents who answer the Customer's forms
- People who are mentioned in the Customer's forms or in the answers respondents give
4.5.Categories of personal data:
- Names, email addresses and profile pictures of the Customer's users
- The answers respondents submit, which depend on the questions the Customer asks, and the files they upload
- Respondent metadata kept with each submission: a keyed hash of the IP address, the country and a browser session id
- Form visit data counted without cookies, with a hash that changes every day
- Access tokens for the integrations the Customer connects
- Technical data such as IP addresses and device information
4.6.Pipeback does not ask for sensitive personal data. The Customer decides what its forms ask, and should not use the Services to collect sensitive personal data unless the Data Protection Laws allow it. As the Terms of Service say, the Customer must not use forms to collect passwords, payment card numbers, bank account numbers or government identification numbers.
5. Confidentiality
5.1.Pipeback gives access to Customer Personal Data only to the people who need it to provide the Services, and makes sure they are bound by a duty of confidentiality.
6. Security
6.1.Pipeback implements appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These include:
- Encryption of data in transit
- Hashed passwords and encrypted integration access tokens
- Respondent uploads kept on private storage and scanned for malware with ClamAV before they are accepted ([OWNER: confirm] that hosted production enables the ClamAV scan)
- IP addresses of respondents kept only as keyed hashes, and form visits counted without cookies
- Access to production systems limited to the people who need it
- Monitoring of the application for errors and unusual activity
- Regular backups
6.2.Pipeback may update these measures over time, as long as the overall level of protection does not decrease.
7. Subprocessors
7.1.The Customer gives Pipeback a general authorization to engage Subprocessors. The current list is on the Subprocessors page.
7.2.Pipeback will update the Subprocessors page before a new Subprocessor starts processing Customer Personal Data. The Customer may object to a new Subprocessor on reasonable data protection grounds by writing to support@pipeback.com within 15 days of the update. If the parties cannot resolve the objection, the Customer may stop using the Services and close its account.
7.3.Pipeback imposes on each Subprocessor data protection obligations no less protective than those in this DPA, and remains responsible to the Customer for its Subprocessors' work.
7.4.The integrations the Customer connects (such as Google Sheets, Notion, Airtable, Slack or a webhook to an address of its choice), the API and MCP clients it authorizes, and the trackers it adds to its own forms are not Pipeback's Subprocessors. The Customer chooses to send its data to them, and they process it under their own terms.
8. Data subject requests
8.1.Taking into account the nature of the processing, Pipeback will help the Customer respond to requests from Data Subjects to exercise their rights under the Data Protection Laws.
8.2.If Pipeback receives such a request directly, it will pass it on to the Customer and will not answer it without the Customer's authorization, unless the law requires otherwise.
9. Personal data breaches
9.1.Pipeback will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
9.2.The notice will describe, as far as the information is available, the nature of the breach, the data and Data Subjects affected, the likely consequences and the measures taken or proposed.
9.3.Pipeback will take reasonable steps to contain the breach and limit its effects, and will help the Customer meet its own notification obligations.
10. International transfers
10.1.Pipeback and its Subprocessors may process Customer Personal Data outside the country where the Customer or the Data Subjects are located, including in Brazil and the United States, where the application and its database are hosted (Amazon Web Services, region [OWNER: confirm]).
10.2.Where the Data Protection Laws require it, those transfers rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the mechanisms of Article 33 of the LGPD, including the standard contractual clauses approved by Brazil's National Data Protection Authority (ANPD).
11. Return and deletion
11.1.The Customer can export its submissions from the Services at any time before deleting its workspace.
11.2.Deleted forms, folders and answers stay in the trash for 90 days, then they are erased. When the Customer deletes a workspace, its forms, folders, answers, files and settings are erased right away. Backups are kept for up to 90 days, unless the law requires Pipeback to keep data longer.
12. Audits
12.1.Pipeback will make available to the Customer, on request, the information reasonably needed to show compliance with this DPA.
12.2.If that information is not enough to meet a requirement of the Data Protection Laws, the Customer may carry out an audit, at its own cost, no more than once a year, with at least 30 days' written notice, during business hours and without disrupting the Services. The auditor must be bound by confidentiality.
13. Liability
13.1.Each party's liability under this DPA is subject to the limitations of liability in the Terms of Service, except where the Data Protection Laws do not allow them.
14. Term and precedence
14.1.This DPA stays in force for as long as Pipeback processes Customer Personal Data.
14.2.If this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA prevails.
15. Governing law and jurisdiction
15.1.This DPA is governed by the laws of Brazil.
15.2.The courts of São Paulo, State of São Paulo, Brazil, have exclusive jurisdiction over any dispute arising from this DPA, except where the Data Protection Laws or the Standard Contractual Clauses require otherwise.
16. Contact
For questions about this DPA or to request a countersigned copy:
Company: Vp Technology Ltda (CNPJ 30.286.117/0001-44)
Address: Rua Maestro Elias Lobo, 994, Apt 21, Bloco C, Jardim Paulista, São Paulo, SP, 01433-000, Brazil
Email: support@pipeback.com