MP Board – Data Processing Agreement (Art. 28 GDPR)
DRAFT v0.3 – reviewed by Roberto Teng (MynaParrot SL); external legal review recommended before wide launch. Version 0.3, effective DRAFT – to confirm
This DPA forms part of the BBB Toolkit Terms of Use between the customer ("Controller") and MYNAPARROT SL, NIF B67681619, C/ Matilde Díez 11-A, 28002 Madrid, Spain ("Processor"). It is accepted electronically when the Controller connects a BigBlueButton or plugNmeet server. In case of conflict, this DPA prevails over the Terms on data protection.
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "personal data breach" and "supervisory authority" have the meanings in Art. 4 GDPR. "Customer Personal Data" means personal data obtained from the Controller's BigBlueButton or plugNmeet server(s) through the API.
2. Subject matter, duration, nature and purpose (Art. 28(3))
See Annex I. Duration: for as long as the Controller has a server connected, plus the deletion period in clause 11.
3. Controller's obligations
The Controller warrants it has a lawful basis for the processing, has informed data subjects (Arts. 13–14), is authorised by the server owner to provide the API credentials, and that its instructions comply with law.
4. Processing on documented instructions (Art. 28(3)(a))
The Processor processes Customer Personal Data only on the Controller's documented instructions: these Terms, this DPA and the Controller's use of the Service's functions. The Processor will inform the Controller if an instruction infringes the GDPR. It will not use Customer Personal Data for its own purposes (including no aggregated or benchmark use) DRAFT – to confirm, except where EU or Member State law requires, in which case it informs the Controller unless prohibited.
5. Confidentiality (Art. 28(3)(b))
Persons authorised to process Customer Personal Data are bound by confidentiality obligations and access it only as needed.
6. Security (Art. 28(3)(c), Art. 32)
The Processor implements the measures in Annex II and may update them provided the overall level of protection is not reduced.
7. Subprocessors (Art. 28(2) and (4))
7.1 The Controller grants general written authorisation for the subprocessors in Annex III.
7.2 The Processor will notify intended additions or replacements at least DRAFT – to confirm days in advance via DRAFT – to confirm. The Controller may object on reasonable data-protection grounds; if not resolved, the Controller may disconnect its servers and close its account as its sole remedy.
7.3 The Processor imposes on each subprocessor by contract the same data protection obligations and remains liable for its performance (Art. 28(4)).
8. Data subject rights (Art. 28(3)(e))
Taking into account the nature of processing, the Processor assists by appropriate technical measures (the Service lets the Controller view, export and delete meeting/recording data on its server) and forwards without undue delay any request received directly, without answering it except to redirect.
9. Assistance (Art. 28(3)(f))
The Processor assists the Controller with Arts. 32–36 (security, breach notification, DPIA and prior consultation), taking into account the information available to it. Assistance beyond the Service's standard features may be charged at reasonable cost.
10. Personal data breach (Art. 33(2))
The Processor notifies the Controller without undue delay and in any event within DRAFT – to confirm hours of becoming aware of a breach affecting Customer Personal Data, at the account email, with, as far as available: nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point. Information may be provided in phases. Where the shared secret may be compromised, the Processor will immediately revoke its stored copy and advise the Controller to rotate the secret on its server.
11. Deletion or return (Art. 28(3)(g))
11.1 When the Controller removes a server, the stored shared secret is deleted immediately and stored Customer Personal Data from that server is deleted within 30 days.
11.2 On account closure, all Customer Personal Data is deleted within DRAFT – to confirm days; before closing, the Controller may export reports. Backups are overwritten within DRAFT – to confirm days on the normal rotation cycle.
11.3 Data held on the Controller's own BigBlueButton or plugNmeet server is not affected. Retention is only beyond these periods if required by EU or Member State law.
11.3 Retention while connected. The Service stores Customer Personal Data (see Annex I) and deletes it automatically after: free plan – 30 days from the meeting date; paid plans – up to 12 months, or a shorter period set by the Controller.
12. Audits (Art. 28(3)(h))
The Processor makes available information necessary to demonstrate compliance, e.g. this DPA, security documentation and DRAFT – to confirm. On-site audits may take place once a year with DRAFT – to confirm days' notice, during business hours, at the Controller's cost, subject to confidentiality, or more often if required by a supervisory authority or after a breach.
13. International transfers (Chapter V)
Customer Personal Data is hosted in the EU/EEA. The Processor will not transfer it outside the EEA unless (a) to a country with an adequacy decision (Art. 45), or (b) with Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3 processor-to-processor) and a transfer impact assessment and supplementary measures where needed (Art. 46), or (c) another Art. 46 safeguard. Transfers currently in place are listed in Annex III. Production systems are accessed only by the Processor's own team from within the EEA; there is no remote access from outside the EEA.
14. Liability
Liability under this DPA is subject to the limitations in the Terms, without prejudice to Art. 82 GDPR as regards data subjects.
15. Law
Spanish law; courts per the Terms.
---
Annex I – Description of processing
Annex II – Technical and organisational measures (Art. 32)
1. Secret encryption at rest: BBB shared secrets encrypted with AES-256-GCM using a key held in the server environment, separate from the database; never shown again in the UI after entry, never logged, never sent by email.
2. Tenant isolation: each account's data is logically separated by tenant ID enforced at the application and query layer DRAFT – to confirm; automated tests check cross-tenant access.
3. Access logging: administrative and API access to Customer Personal Data is logged (who, what, when) and logs are kept DRAFT – to confirm months and protected from alteration.
4. EU hosting: production servers and backups in Hetzner Online GmbH, Germany DRAFT – to confirm.
5. Encryption in transit: TLS 1.2+ for the UI and for all calls to BBB servers (HTTPS-only server URLs DRAFT – to confirm).
6. Access control: least privilege, MFA for staff and production access, prompt revocation on departure.
7. Backups and resilience: encrypted backups, retention DRAFT – to confirm days, restore tested DRAFT – to confirm.
8. Vulnerability management: dependency updates, patching, DRAFT – to confirm.
9. Data minimisation: only the API calls needed for the enabled features.
10. Incident response: documented procedure, breach register (Art. 33(5)).
11. Staff: confidentiality undertakings and data protection training.
Annex III – Authorised subprocessors
| Subprocessor | Service | Location of data | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, backups | Germany | n/a (EEA) |
| Resend | Transactional email (account data only) | DRAFT – to confirm | DRAFT – to confirm |
| Cloudflare, Inc. | DNS, CDN/WAF DRAFT – to confirm | Global | EU-US DPF / SCCs |
| Stripe Payments Europe Ltd. | Payment processing (billing data; card data held by Stripe as independent controller) | Ireland (EEA); some processing in the US | EU-US DPF / SCCs |