Data-processing agreement

1. What we process, and why

We process personal data only to provide ZebraFlow to you: to let the members of your lab sign in, record their work, and see who changed what. The data and the people it concerns are listed in Annex 1. We process it for as long as your lab exists, and then as described in section 10.

2. Your instructions

We act only on your documented instructions. These terms, this agreement and the way you use the application are those instructions. We do not use the data for our own purposes, do not sell it and do not use it to train models. If we are required by law to process it otherwise, we tell you first unless the law forbids it. If we believe an instruction breaks data-protection law, we tell you.

3. Confidentiality

Everyone at Winkleap who can access the data is bound to keep it confidential, and has access only as far as operating the service needs it.

4. Security

We take the technical and organisational measures listed in Annex 2, and keep them appropriate to the risk as the service changes.

5. Sub-processors

You authorise us to use the sub-processors in Annex 3. Each is bound by a data-processing agreement with obligations at least as protective as these. We announce any new or replaced sub-processor at least 30 days in advance by email to your lab’s admins. You may object on reasonable data-protection grounds; if we cannot resolve the objection, you may end the service and we refund the unused part of a prepaid plan.

6. Transfers outside the European Economic Area

Your lab’s data is stored and processed in the European Union (Ireland). Our sub-processors are companies based in the United States, so their staff may access it from there, for example to provide support. Any such access is covered by the EU–US Data Privacy Framework where the company is certified, and otherwise by the European Commission’s standard contractual clauses.

7. Requests from the people concerned

If a member of your lab asks us directly to access, correct, export or delete their data, we pass the request to you. We help you answer such requests, and help with data-protection impact assessments or consultations with an authority where they concern ZebraFlow.

8. Personal data breaches

If we become aware of a breach affecting your lab’s personal data, we inform your lab’s admins without undue delay, so you can meet your own 72-hour deadline. We tell you what happened, which data and people are concerned, what we have done, and who to contact, and we send further details as we learn them.

9. Audits

We give you, on request, the information you need to show that this agreement is followed, including answers to your institution’s security questionnaire. If that is not enough, you or an auditor bound to confidentiality may audit us once a year, with 30 days’ notice, at your own cost.

10. When the service ends

Before or when your lab is closed, we give you an export of its data on request, in a machine-readable format. We then delete it within 30 days. Backups are overwritten within a further 30 days. We keep nothing longer unless the law requires it.

11. Liability, precedence and law

Liability under this agreement follows the terms of service. If this agreement and the terms differ on personal data, this agreement prevails. It is governed by Belgian law, and disputes go to the courts of Tournai, Belgium.

Annex 1. The data and the people

• People: the members you invite to your lab, such as staff, researchers and students.
• Identity: name and email address.
• Account: password hash, role in the lab, sign-in times.
• Activity: which member recorded which change to a batch, tank or breeding, and when.
• Technical: IP address and browser in server logs, kept at most 30 days.

No special categories of data (such as health data) are needed. Fish, racks, batches and breedings are not personal data. Please keep personal data out of free-text notes beyond what your work needs.

Annex 2. Security measures

• Data stored in the European Union, encrypted in transit (HTTPS) and at rest.
• Each lab’s data separated in the database itself: every query that serves a lab is limited to that lab, and an automated test checks that one lab cannot read another’s.
• Passwords stored only as hashes. Roles in each lab (admin, member, reader) decide who can see and change what.
• Every change to a batch is kept as an event with who and when, so changes can be traced.
• Daily backups, kept at most 30 days.
• Access to production limited to the people at Winkleap who operate the service.
• Changes to the application tested before they are deployed.

Annex 3. Sub-processors