Data Processing Agreement (DPA)
This agreement is part of the Terms of Service and applies to every organization ("controller") using Bima ("processor") to process personal data of its viewers and staff. It follows GDPR Art. 28 and Israel's Protection of Privacy Regulations (Data Security).
1. Subject and duration
Processing: storing and processing viewer lists, viewing codes, viewing sessions, recordings and the audit log to deliver the broadcast service. Duration: while the organization is active, per the retention schedule in the privacy policy.
2. Controller instructions
The processor processes data only on the organization's instructions as expressed through use of the console and this agreement, and not for its own purposes, except as required by law. If an instruction breaches the law, the processor will say so.
3. Confidentiality
Access is limited to those who need it to deliver the service and are bound by confidentiality. Bima support access to an organization is written to the organization's audit log before it happens.
4. Security (Art. 32)
The measures in section 10 of the privacy policy: encryption at rest and in transit, hashed secrets, per-request permissions, tenant isolation at the database layer, append-only audit log, short-lived tokens, rate limits.
5. Sub-processors
The controller approves the sub-processors listed on the site (currently: Google Cloud). Changes are announced on that page at least 14 days in advance; the controller may object on reasonable grounds.
6. Assistance with data subject rights
The processor assists the controller with access, rectification, erasure and portability requests, through console tools (deleting viewers and codes, export) and by handling requests that reach us directly, within 30 days.
7. Security incidents
The processor notifies the controller of a security incident affecting its data without undue delay, with the information needed to notify authorities and data subjects.
8. International transfers
Data is stored in Israel (EU adequacy decision) and also processed in Google Cloud regions in Europe, under Google Cloud's standard contractual clauses.
9. Audit
The controller may obtain reasonable information demonstrating compliance, including the organization's own audit log (in the console and as PDF export) and a description of technical measures.
10. Termination
At the end of the service, at the controller's choice, the processor deletes or returns the data - except the audit log, kept per the privacy policy as evidence, and what the law requires to keep.