Data Processing Agreement

This Data Processing Agreement (“DPA”) is between PILOTLAB LLC, a Wyoming limited liability company, doing business as InboxVet (“InboxVet”, “we”, “us”), 1309 Coffeen Ave Ste 1200, Sheridan, WY 82801, United States, as processor, and the customer that accepted our Terms of Service (“Customer”, “you”), as controller.

It applies automatically, without a signature, whenever you submit personal data to the Service as a controller, and it is incorporated into the Terms of Service. Words such as “personal data”, “processing”, “controller”, “processor”, “sub-processor” and “personal data breach” have the meanings given in the EU GDPR (and the UK GDPR where it applies).

If this DPA and the Terms of Service conflict on anything about data protection, this DPA wins.

• We process Customer personal data only on your documented instructions, which are this DPA, the Terms of Service, and the way you use the Service’s settings and API. The only exception is where the law requires otherwise, in which case we tell you first unless the law forbids it.
• We tell you if we believe an instruction breaks data protection law.
• We do not sell Customer personal data or use it for our own purposes.
• Everyone we authorise to process Customer personal data is bound by confidentiality, by contract or by law.
• You are responsible for having a lawful basis for the data you submit and for following our Acceptable Use Policy.

• You give us general authorisation to use sub-processors. The categories and locations are in Annex III.
• We give you the current list of sub-processors on written request to support@inboxvet.com. That list is our confidential information and you may not share it with third parties.
• If you ask to be notified, we email you at least 30 days before we add or replace a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot address your objection, you may stop using the affected part of the Service and close your account.
• We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible to you for their performance.

• Data subject requests. If we receive a request from a person about Customer personal data, we forward it to you and do not answer it ourselves unless you ask us to. We help you respond, taking into account the nature of the processing.
• Impact assessments and regulators. We give you reasonable help with data protection impact assessments (DPIAs) and prior consultations with supervisory authorities about the Service.

We notify you of a personal data breach affecting Customer personal data without undue delay and within 48 hours of becoming aware of it. We include what we know about the nature of the breach, the data and people affected, the likely consequences and the measures taken or proposed, and we send further information as it becomes available.

• While your account is open you can export your verification results from the dashboard at any time.
• We delete Customer personal data when you ask us to, including when you close your account, within one month of your request, unless the law requires us to keep it. Copies in our database backups expire within a further 30 days.
• We do not delete verification results automatically. Until you ask us to delete them, they stay under this DPA.

• We make available the information needed to show that we meet this DPA.
• You may audit our compliance, yourself or through an independent auditor bound by confidentiality, on reasonable written notice, at most once a year (more often if a supervisory authority requires it or after a breach), at your own cost, and without unreasonable disruption to our business or other customers’ data.

PILOTLAB LLC is based in the United States. InboxVet is hosted in the European Union. Some of the service providers we use are located in the United States and the United Kingdom. Our support and engineering staff, including team members in Pakistan, may access personal data remotely to run and support the service. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we use the European Commission’s Standard Contractual Clauses, with the UK Addendum and Swiss amendments where they apply. Where a US provider is certified under the EU-U.S. Data Privacy Framework, we may rely on that certification for transfers to that provider.

For transfers of Customer personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference: Module 2 (controller to processor) between you and us, and Module 3 (processor to sub-processor) between us and our sub-processors. For the clauses:

• Clause 7 (docking clause) applies;
• Clause 9: option 2 (general authorisation), with the 30-day notice period above;
• Clause 11: the optional language does not apply;
• Clauses 17 and 18: the clauses are governed by the law of Ireland, and disputes are resolved by the courts of Ireland;
• Annexes I to III of the clauses are completed by the annexes to this DPA.

For UK transfers, the UK International Data Transfer Addendum applies; for Swiss transfers, the clauses apply with the amendments required by Swiss law, with the Swiss Federal Data Protection and Information Commissioner as the competent authority.

Encryption

• All traffic to the website, dashboard and API is encrypted with HTTPS (TLS).
• Traffic between our own servers that run mailbox checks is encrypted with TLS, uses a pinned certificate, requires a secret token and is accepted only from our main server.
• Uploaded files and backups are kept with a cloud storage provider that encrypts all stored objects by default.
• Passwords are stored only as bcrypt hashes.

Access control

• The database runs on the same private server network as the app and is not reachable from the internet.
• Each customer’s data is separated by workspace, and the API only answers with a valid API key for that workspace.
• Access to servers and customer data is limited to authorised staff who need it.
• Card data is handled by our payment processor and never reaches our servers.

Logging and monitoring

• Sign-ups, sign-ins, password changes and similar security events are logged for 365 days.
• Staff actions on customer accounts are recorded in an audit log.
• Rate limits and account suspension protect the Service from abuse.

Backups

• The database is backed up every night. Backups are kept for 30 days.

Categories and locations of the sub-processors that may process Customer personal data. The named list is available to customers on request (see Sub-processors above).