How this DPA applies
This DPA is incorporated into the terms of service and applies automatically to every customer, with no signature needed. If your organisation needs a countersigned copy, email privacy@elastly.ai and we will return one.
This data processing agreement ("DPA") forms part of the agreement between OutheBox, LLC, a Delaware limited liability company (Delaware file number 4913912) doing business as Elastly, with its registered office at 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States ("Elastly") and the customer that accepts the terms of service or signs an order form ("Customer") for the Elastly service (the "Agreement").
1. Definitions
Terms such as controller, processor, personal data, processing, data subject and personal data breach have the meanings given in Regulation (EU) 2016/679 ("GDPR"). "Data Protection Laws" means the GDPR, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act and any other law that applies to the processing of Customer Personal Data under the Agreement. "Customer Data" means all data Customer or its users submit to or connect to the service, including data synced from Customer's systems. "Customer Personal Data" means the personal data within Customer Data.
2. Roles and scope
2.1 Customer is the controller, and Elastly is the processor, of Customer Personal Data. Where Customer is itself a processor for a third party, Elastly is its subprocessor.
2.2 The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.
2.3 Elastly acts as an independent controller, and not as Customer's processor, when it processes personal data about Customer's users for its own purposes: creating and administering user accounts, signing users in, billing, keeping the service secure, communicating with users about the service, and producing the aggregated statistics in section 4.4. Elastly's privacy policy describes that processing. All other processing of Customer Personal Data, including the workspace audit log that Customer's administrators review, is carried out by Elastly as processor under this DPA.
3. Customer instructions
3.1 Elastly processes Customer Data only on Customer's documented instructions. The Agreement, this DPA and Customer's configuration and use of the service are those instructions.
3.2 Elastly informs Customer without delay if it believes an instruction infringes Data Protection Laws.
3.3 Elastly does not process Customer Personal Data other than on Customer's instructions unless Union or Member State law to which Elastly is subject requires it. In that case Elastly informs Customer of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.
4. Use of Customer Data
4.1 Elastly uses Customer Data only to provide, secure and support the service for Customer.
4.2 Elastly does not sell Customer Data, does not share it with any third party other than the subprocessors in Annex III, and does not use it for advertising.
4.3 Models that learn from Customer Data are used only for Customer's own workspaces. Elastly does not use Customer Data to train models for other customers, and does not allow its AI provider to train on Customer Data.
4.4 Elastly may produce aggregated statistics about use of the service that identify neither Customer nor any individual.
4.5 Where Customer Personal Data is personal information under the California Consumer Privacy Act, Elastly acts as Customer's service provider and processes it only for the business purposes in Annex I. Elastly does not sell or share it, as those terms are defined in that Act; does not retain, use or disclose it for any other purpose or outside the direct business relationship with Customer; and does not combine it with personal information it receives from or on behalf of anyone else, or collects from its own interactions with the consumer, except as that Act permits. Elastly complies with the obligations that Act places on service providers, provides the level of privacy protection it requires, and notifies Customer if it can no longer meet those obligations. Customer may take reasonable and appropriate steps to ensure that Elastly uses that personal information consistently with Customer's obligations under that Act, and to stop and remediate any unauthorised use, including through section 12.
5. Confidentiality
Elastly ensures that every person authorised to process Customer Data is bound by an obligation of confidentiality and has access only as far as their role requires.
6. Security
6.1 Elastly implements and maintains the technical and organisational measures in Annex II.
6.2 Elastly may update those measures provided the overall level of protection is not reduced.
7. Subprocessors
7.1 Customer gives general authorisation for Elastly to engage subprocessors from the list that Elastly provides to Customer under this section. Elastly emails the current list, with each subprocessor's name, purpose, processing location and transfer safeguard, to Customer's account owner when Customer's account is created, and provides it again at any time on request to privacy@elastly.ai. That list, as updated under section 7.2, is the agreed list for Clause 9(a) option 2 of the Standard Contractual Clauses. The subprocessors page describes the categories of subprocessors.
7.2 Elastly notifies Customer at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the service and receive a refund of prepaid fees for the remaining term.
7.3 Elastly imposes on each subprocessor data protection obligations no less protective than this DPA and remains liable for its subprocessors.
8. International transfers
8.1 Customer Data in a workspace is stored in the region confirmed by Customer's administrator. Processing outside the European Economic Area occurs only through the subprocessors notified to Customer under section 7.
8.2 Where Customer Personal Data is transferred outside the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) and Module Three (processor to processor) as applicable, are incorporated into this DPA, together with the UK International Data Transfer Addendum and the Swiss amendments where those laws apply. Annexes I to III of this DPA complete the appendix of the Standard Contractual Clauses. Clause 7 (docking) applies, Clause 9 option 2 applies with the notice period in section 7.2, Clause 11 optional language does not apply, Clauses 17 and 18 select the law and courts of Ireland, and the competent supervisory authority under Clause 13 is the one determined under Clause 13(a) for Customer.
8.3 For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018 applies. Table 1 is completed with the details in Annex I, Table 2 with the modules and options selected in section 8.2, Table 3 with Annexes I to III, and in Table 4 neither party may end the Addendum under its Section 19.
8.4 For transfers subject to the Swiss Federal Act on Data Protection, the Standard Contractual Clauses apply with these adaptations: the Federal Data Protection and Information Commissioner is the competent supervisory authority; references to the GDPR are read as references to the Swiss Federal Act on Data Protection; and the term "member state" does not prevent data subjects in Switzerland from bringing claims in their place of habitual residence.
8.5 If Elastly receives a legally binding request from a public authority for disclosure of Customer Personal Data, it notifies Customer promptly unless the law prohibits notification, assesses the legality of the request, challenges it where there are reasonable grounds to consider it unlawful, and discloses only the minimum information the request requires. Elastly records each request and its response and provides that record to Customer on request where the law allows. Elastly does not disclose Customer Personal Data to a public authority voluntarily.
8.6 Where a subprocessor outside the European Economic Area, the United Kingdom or Switzerland processes Customer Personal Data, Elastly puts in place the Standard Contractual Clauses (Module Three) with that subprocessor, or relies on the subprocessor's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions where the subprocessor is certified. If that certification or framework ceases to be valid, Elastly puts the Standard Contractual Clauses in place without undue delay.
9. Assistance
9.1 Elastly assists Customer, through the service's features or on request, in responding to requests from data subjects exercising their rights. Elastly forwards to Customer any such request it receives directly and does not respond except as Customer instructs.
9.2 Elastly provides reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing and the information available to Elastly.
10. Personal data breach
10.1 Elastly notifies Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data.
10.2 The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and the name and contact details of Elastly's contact point for the breach. Elastly provides further information as it becomes available and takes reasonable steps to contain and remedy the breach.
11. Return and deletion
11.1 Customer's administrators can export Customer Data at any time during the term and during the 30-day read-only period that follows expiry or cancellation.
11.2 When the Agreement ends, Elastly deletes Customer Data within 30 days after the end of the read-only period in section 11.1. When Customer's administrator requests deletion during the term, Elastly deletes Customer Data within 30 days of the request, and the request can be cancelled during its first 7 days. Copies in encrypted backups are overwritten within 7 days after deletion through the backup retention cycle. Elastly keeps only what applicable law requires it to retain, keeps it confidential and processes it for no other purpose. On request, Elastly confirms the deletion in writing.
12. Audits
12.1 Elastly makes available the information necessary to demonstrate compliance with this DPA, including its security documentation, questionnaire answers and, on request, the operator access log for Customer's workspaces.
12.2 Where that information is insufficient, where there are indications of non-compliance, or where a supervisory authority requires it, Customer, or an independent auditor Customer mandates that is bound by confidentiality and is not a competitor of Elastly, may audit Elastly once in any 12 months, on 30 days' written notice, during business hours and at Customer's cost. When Elastly holds a SOC 2 Type II report, Customer agrees to rely on it first.
13. Liability and precedence
13.1 Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses provide otherwise.
13.2 If this DPA conflicts with the Agreement, this DPA prevails on the processing of Customer Personal Data. If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses prevail.
13.3 This DPA remains in force for as long as Elastly processes Customer Personal Data.
Annex I: Details of processing
Data exporter: Customer, as identified in the Agreement. Role: controller.
Data importer: OutheBox, LLC, doing business as Elastly, 131 Continental Dr, Suite 305, Newark, Delaware 19713, United States. Contact: privacy@elastly.ai. Role: processor.
Competent supervisory authority: as determined under Clause 13 of the Standard Contractual Clauses and section 8.2.
Subject matter and purpose: providing the Elastly pricing service: syncing data from Customer's connected systems, recommending, governing and publishing prices, building and approving quotes, reporting, and the AI assistant.
Nature of processing: collection through connected systems and user input, storage, organisation, analysis, retrieval, transmission back to Customer's systems when Customer authorises a write target, and deletion.
Duration: the term of the Agreement plus the return and deletion period in section 11.
Frequency: continuous.
Categories of data subjects: Customer's users of the service; contacts at Customer's customers (for example buyers named on quotes and customer records); Customer's sales representatives.
Categories of personal data: names, business email addresses, business phone numbers, job titles, business addresses; sign-in and audit records (IP address, device and browser, timestamps, actions taken); commercial records linked to named contacts, such as quotes, orders, invoices and agreed prices.
Special categories of data: none intended. Customer shall not submit special categories of personal data.
Retention: as set out in section 11 and Annex II.
Annex II: Technical and organisational measures
- Tenant isolation: each workspace's data is separated at the database level, and access rules are enforced by the database itself and tested on every change.
- Access control: sign-in with multi-factor authentication; role-based permissions with optional limitation to a sales rep's own customers; immediate session revocation.
- Encryption in transit: TLS on all public endpoints and on every internal database connection.
- Encryption at rest: storage volumes and backups encrypted; connection credentials for Customer's systems encrypted individually with AES-256 under rotated keys held separately from the data.
- Staff access: no standing access to Customer Data; named personal accounts only; time-limited access with a recorded reason; every session logged to a record staff cannot alter.
- Audit logging: business actions, approvals, publications, pushes, connection and permission changes recorded with actor and time, retained for the life of the workspace.
- Backup and recovery: continuous, encrypted backups with 7-day point-in-time recovery, stored separately from the primary systems; restore drills every month.
- Data minimisation: read-only access to Customer's systems except for write targets Customer authorises; raw import data deleted after 90 days.
- Secure development: pinned and audited dependencies; automated checks, tests and independent code review with a security pass on every change.
- Network security: databases reachable only from Elastly's own services and approved operator addresses.
- Availability: automatic failover, zero-downtime deployments, and monitoring and alerting per region.
- Incident response: a documented incident response procedure with breach notification under section 10.
Annex III: Subprocessors
The subprocessors in the list emailed to Customer's account owner under section 7.1 when Customer's account is created, as updated by the notices given under section 7.2. That list forms Annex III of this DPA and of the Standard Contractual Clauses.