Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between the customer organization (“Customer”, the controller) and NineBox (“Processor”). It applies wherever NineBox processes personal data contained in Customer rooms on Customer’s behalf, and sets out the terms required by Article 28 GDPR.
On this page
1. Scope, roles and definitions
1.1 Roles. For personal data uploaded into or created within NineBox rooms, Customer is the controller and NineBox is the processor. Where required by law, each party may also act as controller for its own account data (see the Privacy Policy).
1.2 Definitions. “Personal data”, “controller”, “processor”, “data subject”, “processing”, “supervisory authority” and “personal data breach” have the meanings given in the GDPR (Regulation (EU) 2016/679). “Rooms” are the isolated NineBox workspaces, each holding one review round’s data. “Standard Contractual Clauses” or “SCCs” means the clauses adopted by Commission Implementing Decision (EU) 2021/914, as amended or replaced.
1.3 Effect. This DPA prevails over any conflicting processing terms in the Terms of Service. The EU Standard Contractual Clauses and, where relevant, the UK Addendum, are incorporated by reference and prevail over this DPA to the extent of any conflict.
2. Details of the processing (Art. 28(3))
| Item | Details |
|---|---|
| Subject matter | Provision of the NineBox collaborative 9-box talent review service to Customer. |
| Duration | For the term of Customer’s subscription, and in respect of each room, until the room is deleted by its organizer or erased on Customer instruction. |
| Nature of processing | Storage, transmission and display of rosters, ratings, votes, discussion notes and result placements; generation of exports. |
| Purpose | Enabling Customer’s talent review (9-box) discussions, aggregation of evaluator input, and export of results. |
| Categories of data subjects | Customer’s employees being reviewed; evaluators (managers, HR, invited reviewers); Customer’s organizers and administrators. |
| Categories of personal data | As listed in the Privacy Policy: employee names, employee numbers/IDs, department, job title, performance and potential ratings (including 9-box coordinates and conclusions), evaluator votes and comments, discussion notes, and account credentials stored as scrypt hashes. |
| Special categories (Art. 9) | None. Customer undertakes not to submit special category data or criminal offence data into rooms. |
3. Processor obligations
- Documented instructions only. NineBox processes personal data only on Customer’s documented instructions (this DPA, the Terms, and use of the Service), including with regard to transfers, unless required by EU or member state law, in which case NineBox will inform Customer before processing unless that law prohibits it.
- No other purposes. NineBox will not process room content for its own purposes, will not sell it, and will not use it for advertising, profiling or model training.
- Confidentiality. Personnel with access to personal data are bound by confidentiality obligations and are limited to those who need access.
- Compliance assistance. NineBox assists Customer, taking into account the nature of the processing, with Customer’s obligations under Articles 32–36 (security, breach notification, data protection impact assessments and prior consultation), via the measures in sections 4, 6 and 7 below.
- Lawful instructions. If NineBox believes an instruction infringes data protection law, it will inform Customer without undue delay.
4. Security measures (Art. 32)
Taking into account the state of the art, costs, and the nature, scope, context and purposes of processing, NineBox maintains at least the following technical and organizational measures:
- Encryption in transit: all traffic between users and the Service is encrypted with TLS.
- Credential hashing: account passwords are stored only as scrypt hashes; plain passwords are never stored or logged.
- Room-level destructive deletion: deleting a room permanently erases its roster, ratings, votes, notes and results from its Durable Object; deleted room data is not recoverable, including by NineBox.
- Isolated, per-room storage: each room’s data lives in its own Durable Object, so one review’s data is structurally separated from another’s.
- Access control: least-privilege, role-based access for NineBox personnel; session cookies are HttpOnly.
- No analytics or trackers: the application embeds no statistics or advertising scripts that could broaden exposure of personal data.
NineBox may update these measures from time to time, but will not materially reduce the overall level of protection.
5. Sub-processors
Customer grants NineBox general authorization to engage the sub-processors listed below (Art. 28(2)). NineBox remains fully responsible for their performance and binds them to no less protective terms than this DPA.
| Entity | Role | Processing | Safeguards |
|---|---|---|---|
| Cloudflare, Inc. | Sub-processor | Hosting and edge compute; Durable Object storage of all room data. | Cloudflare Customer DPA, incorporating SCCs. |
| Paddle.com Market Ltd | Independent controller (not a sub-processor of room data) | Payment processing, checkout, tax and refunds as Merchant of Record. | Paddle processes payment data in its own right: Paddle privacy policy. |
NineBox will give Customer at least 14 days’ notice (by email or in-product notice) before adding or replacing a sub-processor, during which Customer may object on reasonable data protection grounds by contacting legal@ninebox.app; the parties will then work in good faith on a resolution, failing which Customer may terminate the affected part of the Service.
6. Assistance with data subject rights
NineBox assists Customer in responding to data subject requests (access, rectification, erasure, restriction, portability, objection) that relate to room data. Where a data subject contacts NineBox directly, NineBox will ask them to route the request through Customer where appropriate, will not respond on Customer’s behalf without instruction, and will forward the request to Customer without undue delay.
For room data, most requests can be satisfied by Customer directly: organizers can correct rosters, update placements, export results, or delete the room — which effectuates erasure immediately and destructively.
7. Personal data breach notification
NineBox will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer data. The notification will, to the extent known, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. NineBox will cooperate with Customer’s investigation, take reasonable steps to contain and mitigate the breach, and document the facts for accountability purposes. Notification of a breach is not, of itself, an acknowledgement of fault or liability.
8. Deletion and return of data
- On room deletion: destruction is immediate and permanent, as described in section 4.
- On termination: Customer may export its room results while its account is open. At any time, and in any event following termination, Customer may instruct NineBox to delete all remaining Customer data; NineBox will complete a confirmed erasure instruction within 30 days.
- Where applicable law requires retention (for example, billing records held by Paddle as independent controller), those records are retained by the relevant provider under its own policy and are outside this DPA’s deletion scope.
9. Audit rights
NineBox makes available to Customer the information necessary to demonstrate compliance with this DPA, including up-to-date descriptions of the measures in section 4 and, where available, third-party certifications and audit reports obtained from Cloudflare. If Customer’s supervisory authority requires it, or Customer can reasonably demonstrate that the above is insufficient, NineBox will allow — subject to 30 days’ written notice, during business hours, and at Customer’s cost — a reasonable on-site or remote audit, provided the audit does not compromise the security or confidentiality of other customers’ data.
10. International data transfers
Room data is processed on Cloudflare’s global edge network, with primary processing in the United States and the European Union, and may be accessed from other regions for support and maintenance. Any transfer of personal data to a country outside the EEA or UK that lacks an adequacy decision is made under the Standard Contractual Clauses (Module Two: controller-to-processor, or Module Three: processor-to-processor as applicable) between Customer and NineBox, and between NineBox and Cloudflare under the Cloudflare DPA, together with the UK International Data Transfer Addendum where UK GDPR applies. NineBox will not transfer Customer data to any third country except as described in this DPA.
11. Final provisions
This DPA is incorporated into, and forms part of, the Terms of Service, and is terminated when the Terms terminate and all Customer data has been deleted or returned. Amendments must be in writing (email suffices). If any provision is held invalid, the remainder continues in force, and the parties will replace the invalid provision with a valid one that achieves its purpose. Contact for all matters under this DPA: legal@ninebox.app — our ninebox.app domain is launching shortly; mailboxes go live with it. See also the Privacy Policy and the Terms of Service.