JOINROOMS BUSINESS CHAT
JoinRooms Business Chat Data Processing Addendum
This Data Processing Addendum is the standard JoinRooms Business Chat form available for review and execution by authorized representatives. It supplements the Business Chat agreement when JoinRooms processes personal data on behalf of a Business customer.
1. Scope and roles
This Addendum applies to personal data submitted to Business Chat by or for the customer where the customer acts as controller or business and JoinRooms acts as processor or service provider. Each party remains responsible for obligations that apply to it. The applicable agreement, customer configuration, and documented instructions define the subject matter, duration, nature, purpose, data categories, and data subjects.
2. Documented instructions
JoinRooms will process covered personal data only to provide and secure Business Chat, follow the customer's documented lawful instructions, comply with the agreement, and satisfy applicable law. JoinRooms will inform the customer if an instruction appears unlawful unless prohibited from doing so. JoinRooms does not sell covered personal data or use it for targeted advertising.
3. Confidentiality and security
JoinRooms will ensure personnel authorized to process covered personal data are subject to confidentiality obligations and will maintain appropriate technical and organizational safeguards, including tenant-scoped access controls, role-based authority, encrypted transport, private object storage, production credential separation, backups, monitoring, and incident-response procedures proportionate to the service.
4. Subprocessors
The customer authorizes the subprocessors needed to provide Business Chat, including Railway for application and database infrastructure, Cloudflare R2 for private object storage, and Stripe for subscription billing when enabled. JoinRooms remains responsible for imposing appropriate data-protection obligations on subprocessors. JoinRooms will provide reasonable notice of a material subprocessor change and a reasonable opportunity to raise a documented data-protection objection.
5. Assistance
Taking into account the nature of processing and information available, JoinRooms will reasonably assist the customer with verified data-subject requests, security obligations, impact assessments, regulator consultations, and information reasonably needed to demonstrate compliance. Additional or unusual assistance may be subject to reasonable fees where permitted by the agreement.
6. Security incidents
JoinRooms will notify the customer without undue delay after confirming a security incident affecting covered personal data and will provide information reasonably available about the nature, likely consequences, affected data, containment, and remediation. Notification is not an admission of fault or liability.
7. Return and deletion
At the end of processing, JoinRooms will delete or return covered personal data as provided by the agreement and configured 30-, 60-, or 90-day retention lifecycle, unless law requires continued storage. Access-restricted backups expire under documented schedules, and lawful legal or safety holds remain separate restricted workflows.
8. Audits
JoinRooms will make available information reasonably necessary to demonstrate compliance with this Addendum and may satisfy routine requests through current documentation, security summaries, and independent reports if available. A customer-requested audit must be reasonable, protect other customers and systems, avoid unnecessary disruption, and comply with confidentiality and security requirements.
9. International transfers
The parties will use a legally valid transfer mechanism when applicable. No specific standard contractual clauses, certification, or data-residency commitment is incorporated unless the parties complete and execute the applicable annex or written order.
10. Order of precedence and execution
If this Addendum conflicts with the agreement on covered data processing, this Addendum controls for that subject. Jurisdiction-specific terms, transfer annexes, and customer details must be completed where applicable. This form becomes binding only when accepted or executed by authorized representatives through an approved JoinRooms process.