Data Processing Agreement

This Data Processing Agreement (the “DPA”) is our standard DPA. We sign it on request: write to support@radish.software with your company’s legal name and address, and we send you a copy to sign. Once both parties sign it, it forms part of the agreement under which your organization uses Mobster (the “Agreement”), which is either a signed order or master agreement with us, or our Terms of Service at mobster.dev/terms.

The parties are the customer named in the signature block (“you”, the controller) and Radish Retail, LLC, a Delaware limited liability company, 131 Continental Dr, Suite 305, Newark, DE 19713, USA (“we”, “us”, the processor).

1. Definitions

• Data Protection Laws means the laws that apply to the processing of Customer Personal Data under this DPA, including the EU General Data Protection Regulation 2016/679 (the “GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and the California Consumer Privacy Act as amended by the California Privacy Rights Act (the “CCPA”), each as amended.
• Customer Personal Data means personal data that we process on your behalf in providing the Services, as described in Annex I.
• Services means Mobster for Mac, your organization’s Mobster accounts, the account service at api.mobster.dev and Mobster Remote, as provided under the Agreement.
• Subprocessor means a third party we engage to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• SCCs means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914; the UK Addendum means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018.
• Controller, processor, data subject, personal data, processing and supervisory authority have the meanings the GDPR gives them.

2. What Mobster processes, and what it doesn’t

Mobster for Mac runs on your Macs. Your iPhone’s screens, your tasks and their results stay on your Macs, apart from what each step sends to the model provider you choose. That provider receives it from your Mac under your own account and terms: it is your provider, not our Subprocessor, and that data is not Customer Personal Data under this DPA. What we process is described in Annex I.

3. Roles and instructions

• You are the controller of Customer Personal Data, and we are your processor. Where you act as a processor for someone else, we are your subprocessor, and you pass on their instructions to us.
• We process Customer Personal Data only on your documented instructions. The Agreement, this DPA and your use and settings of the Services are your instructions. We tell you if we believe an instruction breaks Data Protection Laws.
• We are an independent controller of the personal data we need to run our business with you: billing and tax records, fraud and abuse prevention, and our correspondence with you. Our privacy policy at mobster.dev/privacy covers that data.
• You are responsible for having a lawful basis for the Customer Personal Data you give us, and for the accuracy of your instructions.

4. Our people

Everyone we authorize to process Customer Personal Data is bound by confidentiality, and has access only as far as their work needs it.

5. Security

We keep the technical and organizational measures in Annex II. We may change them over time, but never in a way that lowers the overall protection of Customer Personal Data.

6. Subprocessors

• You give us general authorization to engage Subprocessors. The Subprocessors we use are listed at mobster.dev/security#subprocessors, and that list on the date you sign is Annex III.
• Before we add or replace a Subprocessor, we update that list and email the notice contact you give us at least 30 days before the new Subprocessor processes Customer Personal Data.
• You may object on reasonable data protection grounds within those 30 days. We then work with you in good faith on a change that avoids the new Subprocessor. If we can’t make one, you may end the affected Services and we refund the fees you prepaid for the time after the end.
• Each Subprocessor is bound by a written agreement with data protection obligations no less protective than this DPA’s. We remain responsible to you for each Subprocessor’s performance of those obligations.

7. Helping you

• Data subjects’ requests. Taking into account the nature of the processing, we help you answer requests from data subjects to exercise their rights. If a data subject writes to us about Customer Personal Data, we pass it on to you and don’t answer it ourselves, unless the law requires us to.
• Assessments. We give you the information you reasonably need for a data protection impact assessment or a prior consultation with a supervisory authority about the Services.

8. Security Incidents

We tell you without undue delay, and no later than 72 hours after we become aware of a Security Incident. We give you what we know about its nature, the data and data subjects concerned, its likely consequences and the steps we are taking, and more as we learn it. We take reasonable steps to contain it and reduce its harm. Telling you is not an admission of fault.

9. Deletion and return

When the Agreement ends, we delete Customer Personal Data within 30 days, except what the law requires us to keep, which we keep only for that purpose and protect under this DPA. Before it ends, you can export or delete your data as the Services allow, or ask us for a copy at support@radish.software.

10. Audits

• We make available the information you reasonably need to show that we meet this DPA. Once a year, we answer your written security questionnaire.
• If that isn’t enough to show compliance, or a supervisory authority asks, you may audit our compliance with this DPA, once a year, with 30 days’ written notice, during business hours, through an independent auditor bound by confidentiality, at your cost. Audits cover our own systems; for a Subprocessor, we give you the reports or certifications it makes available.

11. Transfers outside the EEA, the UK and Switzerland

• Customer Personal Data is processed in the United States and the other countries our Subprocessors use. Where a transfer of Customer Personal Data from the European Economic Area to us needs a transfer mechanism under the GDPR, the SCCs are incorporated into this DPA by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor.
• For the SCCs: Clause 7 (the docking clause) applies; in Clause 9, Option 2 (general written authorization) applies, with the notice period in section 6; the optional wording in Clause 11 does not apply; in Clause 17, Option 1 applies, and the governing law is Ireland’s; in Clause 18, the courts are Ireland’s; Annexes I, II and III of this DPA are the SCCs’ Annexes I, II and III.
• For transfers from the United Kingdom, the UK Addendum applies, completed with the information in this DPA, and either party may end it as its section 19 allows.
• For transfers from Switzerland, the SCCs apply with these changes: references to the GDPR mean the Swiss Federal Act on Data Protection, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and “Member State” includes Switzerland, so that data subjects in Switzerland can enforce their rights there.
• If the SCCs or the UK Addendum conflict with this DPA, they prevail.

12. US state privacy laws

Where the CCPA or a similar US state law applies, we are your service provider or processor. We don’t sell or share Customer Personal Data, as the CCPA uses those words. We don’t keep, use or disclose it for any purpose other than providing the Services under the Agreement, or outside our direct business relationship with you. We don’t combine it with personal data we get from others, except as the CCPA allows. We tell you if we can no longer meet these obligations.

13. Liability, term and precedence

• Each party’s liability under this DPA is subject to the limits and exclusions in the Agreement, except where Data Protection Laws or the SCCs don’t allow them.
• This DPA lasts as long as we process Customer Personal Data under the Agreement.
• If this DPA conflicts with the Agreement about the processing of Customer Personal Data, this DPA prevails.
• This DPA is governed by the law that governs the Agreement, except where the SCCs or the UK Addendum say otherwise.

Annex I: The parties and the processing

A. The parties

• Data exporter: the customer named in the signature block, the controller (or, where it acts for another controller, a processor). Its contact is the person named in the signature block. Its activities are those for which it uses Mobster.
• Data importer: Radish Retail, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA, the processor. Contact: support@radish.software. Its activities are providing Mobster.

B. The processing

C. The competent supervisory authority

The supervisory authority that Clause 13 of the SCCs points to: where you are established in the EEA, the one of your Member State; otherwise, the one of the Member State where your representative is established, or where the data subjects whose data is transferred are.

Annex II: Technical and organizational measures

• Data kept on your Macs. The Services are built so that your iPhone’s screens, tasks and results stay on your Macs and never reach our servers, apart from feedback and shared links a person chooses to send.
• Encryption in transit. Every connection the Services make to the internet uses HTTPS with TLS 1.2 or later. Mobster for Mac pins our servers to the certificate authority keys it ships with, and doesn’t connect when the check fails.
• Secrets on the Mac. Keys, sign-ins and connector secrets live in the macOS login Keychain, readable without a prompt only by Mobster’s own programs. Mobster’s data folder is readable only by its macOS user.
• Hashing and minimization. A Mac’s hardware id and serial number and an iPhone’s UDID leave the Mac only as one-way hashes made there, and the free trial’s marks are hashed again with a key only our account service holds. Mobster Remote stores only hashes of tokens and keys, and keeps no task text or answers. Our logs carry no content of a task or answer, no email address and no token.
• Access control. Account records are readable only by our servers and, for a person’s own records, by that person when signed in. Server secrets live in our hosts’ encrypted environment settings, and our payment service runs on a restricted key with only the permissions it needs.
• Masking. Feedback is masked for passwords, codes, card numbers and keys on the Mac and again on our server.
• Deletion. Feedback screenshots and diagnostics are deleted after 90 days; shared links stop at the expiry their maker chose; removing a Mac deletes Mobster Remote’s records for it.
• Approvals. Actions that send, buy, post or delete wait for a person’s approval in Mobster on the Mac by default, and nothing that arrives through Mobster Remote can approve one.
• Vulnerabilities. We take reports at support@radish.software and publish a security.txt.
• People. Everyone with access to Customer Personal Data is bound by confidentiality.

Annex III: Subprocessors

The Subprocessors listed at mobster.dev/security#subprocessors on the date this DPA is signed, for the processing listed there.

Signatures

Signed by each party’s authorized representative: the customer (its legal name, address, signatory, title, date and the email for Subprocessor notices) and Radish Retail, LLC (signatory, title and date).