Data Processing
This Data Processing Addendum forms part of the agreement between BloomSocial Inc. and the Customer.
1. Roles
- Customer is the Data Controller
- BloomSocial is the Data Processor
2. Scope of Processing
BloomSocial processes personal data solely to provide and support the BloomSocial services, in accordance with documented customer instructions.
3. Confidentiality
BloomSocial ensures that personnel authorized to process personal data are bound by confidentiality obligations.
4. Security Measures
BloomSocial implements appropriate technical and organizational measures aligned with industry standards, including SOC 2 controls, to protect personal data.
5. Subprocessors
BloomSocial may engage subprocessors to support service delivery. BloomSocial remains responsible for subprocessors compliance with this DPA.
6. Data Subject Rights Assistance
BloomSocial will assist customers in responding to data subject requests, where applicable.
7. Incident Notification
BloomSocial will notify customers of a confirmed personal data breach without undue delay.
8. Data Return or Deletion
Upon termination of services, BloomSocial will delete or return customer data as instructed, unless retention is required by law.
9. Audit Rights
Upon reasonable notice, BloomSocial will provide relevant documentation or third party audit reports to demonstrate compliance.
10. Data Retention Policy
BloomSocial retains customer data only for as long as necessary to provide and support its services, fulfil documented customer instructions, maintain service security, and meet applicable legal obligations.
Data obtained through Slack APIs is accessed and processed only for the functionality authorized by the installing workspace and is limited to what is necessary for that purpose. BloomSocial does not retain Slack API data indefinitely or use it to train large language models.
Where temporary storage or caching is necessary for service delivery, data is retained only for the period required for that purpose and deleted when it is no longer needed, subject to applicable legal requirements.
11. Data Archival and Removal Policy
BloomSocial does not create persistent archives of Slack API data unless expressly permitted by the applicable Slack API terms and the relevant authorization.
When a customer terminates its use of BloomSocial, disconnects its Slack workspace, or requests removal of its data, BloomSocial takes appropriate steps to remove the associated data from its active systems. When a customer deletes the BloomSocial application or BloomSocial discontinues the application, associated data is deleted within 14 business days, in accordance with Slack’s Developer Policy.
Where residual copies remain in routine backups, they are handled through the applicable backup lifecycle and are not restored to active use except where necessary for disaster recovery. Any restored data remains subject to the applicable deletion requirements.
Data may be retained where required by law or where necessary to establish, exercise, or defend legal claims. Such retention is limited to the applicable requirement.
12. Data Storage Policy
BloomSocial’s services are hosted on Amazon Web Services (AWS). Customer data is stored and processed to support the services requested by the customer and in accordance with applicable contractual obligations and customer instructions.
Access to customer data is restricted to authorized personnel who require access to perform their responsibilities. Data is not sold, rented, or shared with third parties for their independent use.
Data obtained through Slack APIs is used only for the authorized functionality of the application. BloomSocial does not use Slack data to train large language models, create unrelated user profiles, target advertisements, or benefit other customers or third parties.
BloomSocial limits data collection, access, processing, and storage to what is necessary for the application’s functionality and applies appropriate technical and organizational safeguards to protect customer data.
13. Handling Requests for Data Deletion
Customers may request the deletion of their data by contacting BloomSocial through its designated support or privacy contact channels. Requests are reviewed to establish the requester’s authority and identify the data covered by the request.
Upon receiving a valid request, BloomSocial identifies the relevant customer data within its systems and takes appropriate steps to delete or anonymize it, where applicable. This may include data associated with connected integrations, subject to the permissions and technical capabilities of the relevant service.
When a customer disconnects a Slack workspace or removes the BloomSocial application, BloomSocial stops using the associated Slack connection and takes the necessary steps to revoke or remove related access credentials, where applicable. Associated Slack data is deleted within the period required by Slack’s Developer Policy, including the 14-business-day requirement following application deletion or discontinuation.
Where data must be retained to comply with applicable law or for legitimate security or legal purposes, only the data necessary for that purpose is retained for the required period. Any retained data remains subject to appropriate safeguards and is deleted when the applicable retention requirement ends.
BloomSocial will communicate with the requester regarding the handling of the request where appropriate.