The short version
- It applies automatically to every customer. There is nothing to sign.
- We process visitor data only to run the service for you, on your instructions.
- We tell you about a personal data breach without undue delay.
- You can object to a new subprocessor before it starts.
- Need a countersigned copy for your records? Write to us.
A summary to read first. The sections below are what counts.
1What this agreement is
This Data Processing Agreement (“DPA”) is part of the Terms of Service between you (“Customer”) and Dmytro Utkin, a sole proprietor (private entrepreneur) registered in Ukraine (“tinbo”). It applies whenever tinbo processes personal data on your behalf and data protection law, such as the EU or UK GDPR, applies to that processing.
It takes effect when you accept the Terms and lasts for as long as tinbo processes personal data for you. If it conflicts with the Terms on a matter of data protection, this DPA wins.
2Roles
For the data described below, you are the controller, or a processor acting for your own customer, and tinbo is your processor. You are responsible for having a legal basis for collecting it and for telling the people who follow your links what happens to their data.
tinbo is a controller in its own right for its customers' account and billing data, and for the use of click data to keep the service secure, to stop abuse and to count usage against a plan. The Privacy Policy covers that.
3What is processed
| Subject matter | Redirecting short links and reporting on their use. |
|---|---|
| Duration | For as long as the workspace exists. |
| Nature and purpose | Receiving a request for a short link, choosing its destination by the rules you set, recording the request, and storing and displaying the resulting analytics. |
| People concerned | People who follow your short links. Members of your workspace and people you invite to it. |
| Kinds of data | For visitors: IP address, user agent, browser, operating system, device type, referrer, language, approximate location, time of the request and parameters on the link. For members: name, email address, role and actions in the audit log. |
| Special categories | None are intended. Do not put sensitive personal data into link names, destinations or parameters. |
4What tinbo commits to
- Instructions. We process the data only on your documented instructions. The Terms, this DPA and what you configure in the dashboard are those instructions. If the law requires us to do something else, we tell you first unless the law forbids it. We also tell you if we think an instruction breaks data protection law.
- Confidentiality. Everyone who can access the data on our side is bound to keep it confidential.
- Security. We keep the measures described under “Security measures” in place and do not weaken them.
- Requests from individuals. If somebody asks us about data we hold for you, we pass the request to you and help you answer it. We do not answer in your place unless you ask us to.
- Breaches. If we learn of a personal data breach affecting your data, we tell you without undue delay, with what we know about its nature, its likely consequences and what we are doing about it.
- Help with your own duties. On request we give you the information we reasonably can for impact assessments and for consultations with a data protection authority.
5Subprocessors
You give general permission for tinbo to use the providers listed under Subprocessors. Each one is bound by data protection terms no weaker than these, and tinbo remains responsible for what they do with your data.
A new subprocessor is added to that page at least 14 days before it starts handling your data. If you object on reasonable data protection grounds within that time, we look for a way to meet the objection. If there is none, you may end the plan and receive a refund of what you paid in advance for the time after it ends.
6Transfers outside Europe
tinbo is operated from Ukraine, and its servers are in the United States. Where you transfer personal data to tinbo from the European Economic Area, the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) are part of this DPA:
- Module Two applies where you are a controller, Module Three where you are a processor.
- You are the data exporter and tinbo is the data importer.
- Clause 9 uses option 2, general written authorisation, with the notice period given above.
- The clauses are governed by the law of Ireland, and disputes under them go to the courts of Ireland.
- Annex I is the “What is processed” section of this DPA, Annex II is “Security measures”, and Annex III is the list of subprocessors.
For transfers from the United Kingdom, the UK Addendum to those clauses, issued by the Information Commissioner's Office, applies with the same details. For transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection.
7Security measures
- Connections to every tinbo site and to short links are encrypted in transit.
- Account passwords and link passwords are stored as salted hashes, never in readable form.
- Each workspace's data is kept apart from every other workspace's, and every request is checked against the workspace it belongs to.
- Workspaces have member roles and an audit log, so that you control and can review who did what.
- Access to production systems and to customer data is limited to the people who operate the service, and used only to run and support it.
- Errors and unusual activity are monitored so that incidents get noticed.
- New links are scanned for abuse.
8Showing that we comply
On request, and not more than once a year unless there has been a breach, we give you the information reasonably needed to show that we meet this DPA, and answer written questions about it. If that is not enough for what the law requires of you, we will agree on an audit: with reasonable notice, at your cost, and without exposing other customers' data.
9When it ends
When you ask us to delete a workspace, we delete the personal data we processed for it within 30 days, unless the law requires us to keep some of it. Before that, on request, we give you an export of your links and their click records.
10Liability
The limits of liability in the Terms of Service apply to this DPA as well. They do not limit what either side owes to individuals or to authorities under data protection law.
11A signed copy
This DPA binds both sides without a signature. If your records need a countersigned copy, write to support@tinbo.co from the workspace owner's email address.