Data Processing Agreement

Who this is for

This Data Processing Agreement (“DPA”) applies when you use TeamYou for a business or another organization, you save personal data about other people in it, and data protection law (such as the GDPR or the UK GDPR) requires a contract between you and us for that processing. In that case you are “Customer” and Team You, Inc is “Provider”.

It forms part of our Terms of Service. You accept it when you accept the Terms; you do not need to sign anything. If you need a signed copy, email privacy@teamyou.ai.

If you use TeamYou only for yourself, this DPA does not apply. Our Privacy Policy describes how we handle your information.

Using this DPA

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1/ (“DPA Standard Terms”), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be “none” or “not applicable” and the correlating clause, sentence, or section does not apply to this DPA. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

Key Terms

The key legal terms of the DPA are as follows:

Provider

Team You, Inc, a Nevada corporation.

Customer

The person or organization that accepted the Agreement and holds the TeamYou account.

Agreement

This DPA supplements the TeamYou Terms of Service posted at https://www.teamyou.com/terms, as accepted by Customer.

Approved Subprocessors

List of Subprocessors available at https://www.teamyou.com/subprocessors. Provider gives notice of a change to the list by updating that page and, for a Customer that has asked for it, by email.

Provider Security Contact

support@teamyou.ai

Security Policy

Provider will use commercially reasonable efforts to secure the Service from unauthorized access, alteration, or use and other unlawful tampering, and will maintain the measures described in Annex II.

Service Provider Relationship

To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligations under the CCPA.

Restricted Transfers: Governing Member State

EEA Transfers: Ireland.

UK Transfers: England and Wales.

Changes to the DPA Standard Terms

The DPA Standard Terms apply as written, with these two changes:

1. Section 5.2 (Security Reports) is replaced with: “Provider is not, as of the date of this Cover Page, audited against a security standard by an independent third party. Upon written request, and no more than once a year, Provider will give Customer, on a confidential basis, a written description of the technical and organizational measures it maintains under Annex II. If Provider later obtains a third-party audit report, it will give Customer a summary copy of its then-current Report on the same terms.”
2. Acceptance. References in the DPA Standard Terms to signing a Cover Page are met by Customer’s electronic acceptance of the Agreement, which incorporates this Cover Page.

Annex I(A): List of Parties

Annex I(B): Description of Transfer and Processing Activities

Service

TeamYou: a store for knowledge, tasks, projects and documents that Customer and the AI agents Customer connects can read, search and change through the TeamYou app, API and MCP server; and, on plans that include it, an AI agent hosted for Customer.

Categories of Data Subjects

• Customer’s users: the people Customer lets use its TeamYou account.
• The people Customer chooses to save information about, such as its clients, contacts and colleagues.

Categories of Personal Data

• Name
• Contact information such as email, phone number, or address
• User activity and analysis such as device information or IP address
• Any other personal data contained in the notes, tasks, documents and messages that Customer or its agents save. The Service is free-form: Customer decides what goes in it.

Special Category Data

Is special category data Processed? Not by design. Provider does not ask for it, and the Agreement says the Service is not intended for regulated data such as health records. Because the Service is free-form, Customer may still include special category data in what it saves. If it does, the safeguards in the Security Policy and Annex II apply to it.

Frequency of Transfer

Continuous.

Nature and Purpose of Processing

Provider will Process Customer Personal Data as instructed in Section 2.3 of the DPA Standard Terms. The nature of processing includes:

• Receiving data, including collection, accessing, retrieval, recording, and data entry
• Holding data, including storage, organization, and structuring
• Using data, including analysis and consultation: indexing it for search and writing summaries of it. Provider does not use it for automated decision making or profiling.
• Updating data, including correcting, adaptation, alteration, alignment, and combination
• Protecting data, including restricting, encrypting, and security testing
• Sharing data, including disclosure, dissemination, allowing access, or otherwise making available: to the agents, apps and people Customer authorizes, and to the Approved Subprocessors
• Returning data to the data exporter or data subject
• Erasing data, including destruction and deletion

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.

Annex I(C): Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II: Technical and Organizational Security Measures

• Protecting Customer Personal Data during transmission: all connections to the Service, from browsers and from agents, use HTTPS.
• Protecting Customer Personal Data during storage: the Service’s database is held with a provider that encrypts stored data at rest. Backups of hosted agents are encrypted before they leave the agent’s server. Credentials of accounts linked to a hosted agent are stored encrypted.
• User identification and authorization: people sign in through a dedicated authentication provider. Agents authenticate with a key or an OAuth authorization that Customer issues and can revoke. Keys are stored only as hashes and are shown once.
• Events logging: the Service records who or which agent created, changed or deleted each topic, detail, task and project.
• Internal access: access to production systems is limited to the Provider staff who need it.
• Testing and assessment: Provider monitors its software dependencies for known vulnerabilities and publishes how to report a security problem at https://www.teamyou.com/security.
• Allowing data portability and ensuring erasure: Customer can change and delete what it saves at any time, and Provider deletes or returns Customer Personal Data on request as the DPA Standard Terms require.

Acceptance

Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above. By accepting the Agreement, each party agrees to enter into this DPA as of the date Customer accepts the Agreement or, if later, the date Customer first gives Provider Customer Personal Data.