Data Processing Agreement

This Data Processing Agreement (“DPA”) is between the customer that holds a Panoptik workspace (“you”, the controller) and Skarnlabs, a sole proprietorship registered in Denmark under CVR no. 35098178, at Bådehavnsgade 55 H, 2450 København SV, Denmark (“we”, the processor). It forms part of the Terms of Service and takes effect when you accept them. If you need a countersigned copy for your records, ask through the contact form and we will send one with the same wording.

It applies to personal data we process on your behalf when you use Panoptik for an organisation (“Customer Personal Data”). Someone using Panoptik only for their own household is outside the GDPR's scope for that use (Article 2(2)(c)), and this DPA then simply has nothing to apply to.

We are the controller, not the processor, for the data we need to run your account and our business: account and sign-in details, billing, our own usage statistics, support conversations and security logs. The Privacy Policy describes that processing. Where this DPA and the Terms disagree about Customer Personal Data, this DPA wins.

• Subject matter and purpose: providing Panoptik to you: storing your workspace, rendering your dashboards on your displays and shared links, fetching the data your widgets show, sending the email the service sends, keeping backups, and giving support when you ask for it.
• Nature: storage, retrieval, transmission to your displays and members, backup, and deletion. We do not analyse, profile or sell Customer Personal Data, and we do not use it to train any model.
• Duration: for as long as your workspace exists, and after that until the backups written before its deletion have aged out (see section 9).
• Data subjects: the members of your workspace, and the people your content is about: for example people named in calendar events, meeting room bookings, chores, notes and boards, and people in photos you show.
• Types of personal data: names and email addresses of members; whatever your dashboards hold or fetch, such as calendar event times, titles, organisers and locations, room bookings, names on chore lists and notes, messages sent to a display from the phone remote, and photos; display names and the name of the network a display is on; and credentials you give a widget to reach your own systems.
• Special categories: Panoptik is not meant for them, and you should not put health data or other Article 9 data on a display. If you do, you are responsible for having a basis for it.

We process Customer Personal Data only on your documented instructions. Those instructions are the Terms, this DPA, and what you and your members configure in Panoptik. We will tell you if we believe an instruction breaks the GDPR or other EU or member state data protection law. If EU or Danish law requires us to process the data in another way, we will tell you first unless that law forbids it.

Everyone at Skarnlabs who can reach Customer Personal Data is bound to keep it confidential. Access to production is limited to named people who need it to run the service.

We apply the technical and organisational measures in Annex 1, which we keep appropriate to the risk as required by Article 32. We may change them, but not in a way that lowers the overall level of protection.

You give us general authorisation to use the sub-processors listed in Annex 2. Before we add or replace one, we email the owners of every workspace at least 30 days ahead and update the list on this page. If you have a reasonable data protection objection, tell us within that period. If we cannot resolve it, you may end your subscription before the change takes effect, and we will refund, through Paddle, the fees you prepaid for the period after it ends.

Each sub-processor is bound by a written agreement with data protection obligations no less protective than this DPA, and we remain responsible to you for its performance.

• Requests from data subjects: most can be handled by you directly in Panoptik: editing or deleting content, removing a member, exporting your data, or closing the workspace. Where they cannot, we help through the contact form. If a request reaches us directly about Customer Personal Data, we pass it on to you rather than answer it ourselves.
• Security, impact assessments and prior consultation: we give you the information about Panoptik you reasonably need for Articles 32 to 36, taking into account what we know as a processor.

If we become aware of a breach affecting Customer Personal Data, we notify the owners of the affected workspace by email without undue delay, and within 48 hours. We tell you what we know about its nature, the data and people likely affected, its likely consequences and what we are doing about it, and send what we learn later as we learn it.

You can export your workspace at any time. When an owner closes a workspace, or its last member deletes their account, its Customer Personal Data is removed from our live systems at once. A subscription that ends does not close the workspace by itself, so close it when you are done. Copies in backup archives are deleted as those archives age out, within 30 days. Nothing is kept longer unless EU or Danish law requires it.

We give you the information you reasonably need to show that this DPA is met. If that is not enough, you may have an audit carried out by you or an independent auditor bound by confidentiality, with 30 days' notice, at most once a year unless a breach or a supervisory authority requires it, at your cost and without access to other customers' data. We start by answering written questions, which settles most audits.

Customer Personal Data is stored and processed in the European Union. The one sub-processor outside the EEA is Cloudflare, in the United States, which relays our error reports; that transfer relies on the safeguards in Cloudflare's own data processing addendum. We do not move Customer Personal Data elsewhere without the safeguards Chapter V of the GDPR requires.

This DPA lasts as long as we process Customer Personal Data for you. Liability under it is governed by the liability section of the Terms. It is governed by Danish law, and disputes go to the courts of Copenhagen. We may update it as the service changes, and will give the same notice of material changes as for the Terms.

• Isolation between customers:every workspace's data is scoped to that workspace in every query, and automated checks run before each release to fail on a query that is not.
• Access inside a workspace: owner, editor and viewer roles, checked by the server on every change.
• Sign-in: passwords hashed with argon2id, passkeys, signed and encrypted session cookies, and changing a password ends every other session.
• In transit: TLS on every connection to the service, and backups are transferred over an encrypted connection.
• Credentials you give a widget: never sent to a display or a shared link for the widgets that fetch through our server.
• Backups: nightly, copied to a second provider in another EU country and checked on arrival.
• Our own access: production reachable by named people only; the staff console signs in with an allowlist and passkeys, and every change it makes to a customer account is recorded with who made it and why.
• Support on your displays:only when an owner allows it, for one display and at most 60 minutes, announced by email to the workspace's owners and on the screen, and what our staff type is kept for 90 days.
• Abuse limits: rate limits on sign-in, pairing and every device endpoint, and a guard that stops a widget being pointed at internal network addresses.

The disk volumes themselves are not separately encrypted at rest, and backup archives are not encrypted at rest at the backup provider. We say so here rather than leave it to be assumed.

Questions about this agreement, or a request for a signed copy? Contact us.