Compliance & data processing¶
On the Cloud (SaaS) edition, you are the data controller and Drovio is the data processor: we process personal data on your behalf and on your documented instructions only. On the Enterprise (on-premises) edition, no data of yours reaches us at all. This page summarizes the commitments set out in our Data Processing Addendum (DPA).
The executed agreement prevails
This page summarizes Schedule 1 (Data Processing Addendum) of the Master SaaS Agreement and of the Master Software Agreement, both dated March 26, 2025. It is provided for information: the agreement you have signed is what binds us. Contact privacy@drovio.com for a copy.
Applicable regulation¶
The DPA is governed by the GDPR and by the French Data Protection Act n°78-17 of 6 January 1978, and covers personal data originating from the European Economic Area, the United Kingdom and Switzerland. It is subject to French law, with jurisdiction given to the Court of Appeal of Reims, France.
What we process on your behalf¶
Enterprise (on-premises): we process nothing
On the Enterprise edition, Drovio Server and its database run entirely on your infrastructure. No personal data is collected by or transmitted to Drovio, and in particular no personally identifiable information. That is the whole point of the edition. The rest of this section describes the Cloud (SaaS) edition.
| Cloud (SaaS) | |
|---|---|
| Purpose | Providing a collaborative screen sharing service to your end users, so they can work as a remote workforce |
| Nature | Collection, recording, storage, modifying, editing, using, organizing, analyzing, deleting, to provide the service, let users sign in and identify other users on the same team |
| Categories of personal data | Work data (email addresses); PII (username for end users, first and last name for team owners) |
| Data subjects | Employees |
| Duration | Duration of the DPA |
Persons authorized to process this data are bound by confidentiality and have received personal data protection training. See Data protection for the technical detail of what is stored and for how long.
Sub-processors¶
We may engage sub-processors with whom your personal data is shared in order to provide the service. Each of them is covered by data encryption and Standard Contractual Clauses.
| Sub-processor | Processing activities | Location of processing |
|---|---|---|
| Amazon Web Services Inc. | Cloud hosting | Oregon, United States |
| Stripe Payments Europe Ltd. | Subscriptions and payments | United States |
| Mailgun Technologies, Inc. (Mailjet) | Marketing and transactional emails | Belgium and Germany |
| Crisp IM SAS | Live chat for support purposes | Europe |
| GitLab Inc. | Support ticketing | United States |
| Google LLC | Email provider, web analytics (optional), calendar integration (optional) | Europe and United States |
| Slack Technologies Limited | Messaging (dedicated customer support for Drovio Online Business and Drovio Enterprise customers, optional) | United States |
This table is the reference list. It is maintained here and nowhere else, and the date it was last revised is shown at the bottom of this page.
Adding or replacing a sub-processor
We inform you in writing beforehand, stating the processing activities concerned and the name and contact details of the sub-processor. You then have fifteen (15) days to raise legitimate and justified objections. Without objection within that period, the sub-processor is deemed authorized. We remain fully liable to you for the acts and omissions of our sub-processors.
International transfers¶
Personal data may be transferred outside the European Union where appropriate safeguards are in place, as defined in Chapter V of the GDPR. In practice this means Standard Contractual Clauses with every sub-processor listed above, in addition to encryption in transit and at rest.
On the Enterprise (on-premises) edition there is nothing to transfer, and no sub-processor is involved.
Data subject rights¶
Informing data subjects at the time their personal data is collected is the controller's responsibility. We assist you in responding to requests for access, rectification, erasure, objection, restriction of processing, data portability, and the right not to be subject to an automated individual decision.
Requests sent directly to us are forwarded without undue delay to privacy@drovio.com, which is also the address to use for any privacy question.
Personal data breach¶
We notify you of any personal data breach without undue delay after becoming aware of it, together with the documentation you need to notify the competent supervisory authority where required.
We also assist you with data protection impact assessments and with prior consultation of the supervisory authority.
Demonstrating compliance¶
We provide the documentation needed to demonstrate that our obligations under the DPA are met, and we answer security and privacy questionnaires as part of the procurement process.
Where the agreement you have signed provides for an on-site audit, its terms are set out there: audits are limited in frequency, require prior notice, take place during normal working hours, and are scoped so as not to expose our security measures or the data of other customers. Contact contact@drovio.com to discuss what applies to your contract.
End of the relationship¶
At the end of the provision of services, we delete all personal data and provide written justification of the destruction. The DPA terminates with the agreement it is attached to.
Privacy contact¶
Write to privacy@drovio.com for anything concerning personal data: exercising your rights, questions on this page, or a request from one of your own users that reached us directly.
We have not designated a data protection officer under Article 37 of the GDPR, which does not apply to our processing activities. Where a customer agreement requires a named contact, it is provided in that agreement.
Security certifications¶
We don't hold any security certifications at the moment. See Operational security for the controls in place in the meantime, and for how to report a security issue.