iGreet for Teams — Data Processing Agreement
Draft for review · 1 November 2026
Proposed Article 28 GDPR terms for processing workspace personal data on a customer organisation’s behalf.
1. Parties and roles
The customer organisation acts as controller for workspace data processed on its instructions. The iGreet contracting entity acts as processor for that processing. iGreet may separately act as controller for its own billing, account security and legal compliance. The final agreement must identify both legal parties.
2. Processing description
Subject matter: hosting and operating the customer workspace. Purpose: team membership, celebrations, reminders, collaborative cards, delivery, support and customer-enabled integrations. Operations include collection, storage, organisation, retrieval, disclosure on instruction and deletion. Duration: the agreed service period and the agreed return/deletion period.
3. People and data
Data subjects may include employees, contractors, invited contributors, contacts and recipients. Data may include names, work email addresses, profile photographs, job titles, teams, country preferences, birthdays, employment start dates, reminders, card messages/media, gift attachments, access records and integration identifiers. Special-category data is not required for the service and should not be uploaded without a separate assessment and agreement.
4. Documented instructions and confidentiality
The proposed processor obligations are to process only on documented customer instructions, including for transfers, unless legally required otherwise; to inform the customer of such a requirement where permitted; to ensure authorised personnel are bound by confidentiality; and to inform the customer if an instruction appears to infringe applicable data-protection law.
5. Security and incidents
The final security annex must record the verified technical and organisational measures appropriate to risk, including access control, tenant isolation, protected file access, transport/storage protection, operational logging, backup and recovery, and incident response. On becoming aware of a personal-data breach affecting customer data, the processor must notify the controller without undue delay and provide information reasonably available for the controller’s response. This draft does not certify that every listed measure has been audited.
6. Subprocessors and transfers
Before signature, attach the actual subprocessors, their service, processing locations and the applicable international-transfer safeguards. The agreement must establish the customer’s authorisation process, advance notice of changes and opportunity to object, flow-down data-protection obligations and the processor’s responsibility for subprocessors. Customer-selected independent integrations must be distinguished from iGreet subprocessors.
7. Assistance and requests
Taking account of the nature of processing and available information, the processor must assist with data-subject requests, security obligations, breach response, impact assessments and consultation with supervisory authorities. Requests received directly about customer-controlled workspace data should be referred to the controller unless otherwise instructed or legally required.
8. Return, deletion and audit
At the controller’s choice, customer data must be returned or deleted after services end, including copies unless retention is legally required. The final schedule must specify export format, deletion timing and backup expiry. The processor must make compliance information available and allow/contribute to appropriate audits, including inspections, under agreed arrangements that do not prevent statutory rights.
9. Required schedules before acceptance
The following remain to be completed and verified: supplier legal name/address; customer details; security measures; subprocessor list and locations; transfer mechanisms where needed; deletion/backup periods; and the method of contractual acceptance. This draft is not represented as an executed Article 28 agreement.
10. Contact
Send data-protection and DPA requests to ask@igreet.com. This document should be reviewed together with the Business Terms, Privacy Policy and the customer’s order.