Data Processing Agreement

This Data Processing Agreement ("DPA") is part of our Terms of Service. It applies whenever Omne processes personal data for you, the customer, under the EU or UK General Data Protection Regulation, Swiss data protection law or the California Consumer Privacy Act. There is nothing to sign: when you agree to the Terms, you agree to this DPA. If your organisation needs a signed copy for its records, email support@omne.so.

If this DPA and the Terms disagree about personal data, this DPA wins. If the Standard Contractual Clauses and this DPA disagree, the Clauses win.

Omne is operated by NM Media LLC ("we", "us"), 1309 Coffeen Avenue STE 1200, Sheridan, Wyoming 82801, United States.

1. Definitions

• Customer personal data is the personal data in your workspaces that Omne processes for you: your content, and the contacts, subscribers and buyers you keep in Omne.
• Data protection law is the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection and the CCPA, as far as each applies.
• Subprocessor is a company Omne uses that processes customer personal data, as listed on our Subprocessors page.
• Words such as controller, processor, data subject and personal data breach mean what data protection law says they mean.

2. Roles

You decide how the content of your workspaces is used: for customer personal data, you are the controller (or a processor acting for your own client) and Omne is your processor (or subprocessor). For your own account details, such as your name, email address, sign-in and billing, Omne is the controller, as our Privacy Policy explains.

3. Scope and instructions

We process customer personal data only to provide Omne to you, as the Terms, this DPA and your use of Omne direct, and as Annex 1 describes. Your settings, and what you ask Omne and its agents to do, are your instructions.

If we believe an instruction breaks data protection law, we tell you. If a law requires us to process customer personal data in another way, we tell you first, unless that law forbids it.

4. Confidentiality

Everyone who can reach customer personal data for Omne is bound to keep it confidential, and has access only as far as their work needs it.

5. Security

We protect customer personal data with the technical and organisational measures in Annex 2. We may improve them over time, but never so that the overall protection falls.

6. Subprocessors and your right to object

You authorise us to use the subprocessors in Annex 3, which our Subprocessors page keeps up to date. Each one is bound by a written agreement whose data protection duties are no less protective than this DPA, and we stay responsible to you for what each one does.

We add a new subprocessor to that page at least 30 days before it starts processing customer personal data, and email everyone who has asked to hear about changes. If you object on reasonable data protection grounds within those 30 days, we will work with you to resolve it. If we cannot, you may stop using the feature that depends on it or close your account.

7. Requests from data subjects

If a person asks us directly to exercise their rights over customer personal data, we pass the request on to you and do not answer it ourselves, unless you ask us to. Omne lets you view, export, change and delete the data in your workspaces, and we help you answer a request where you cannot do it yourself.

8. Breach notice

If we become aware of a personal data breach affecting customer personal data, we tell you without undue delay, and within 72 hours. We tell you what we know as we learn it: what happened, which data and people are affected, the likely effects, and what we are doing about it.

9. Impact assessments

We give you the information you reasonably need to carry out a data protection impact assessment about Omne, or to consult a supervisory authority about one.

10. Deletion or return at the end

You can export your content from Omne at any time. At the end, when you delete content, a workspace or your account, we delete the customer personal data in it, as our Privacy Policy describes, unless a law requires us to keep it.

11. Audits and information

We make available the information you need to show that we meet this DPA, starting with this DPA, our Security page and our Subprocessors page. If that is not enough, you may audit our compliance with this DPA, with reasonable notice, at most once a year, unless a supervisory authority requires more or after a personal data breach.

12. International transfers

Omne's servers and database are in Germany. NM Media LLC is based in the United States. As far as our processing of customer personal data is a transfer out of the EU, EEA, UK or Switzerland to a country without an adequacy decision, the European Commission's Standard Contractual Clauses apply between you and us (Module 2 where you are a controller, Module 3 where you are a processor), with the UK Addendum for UK data and the changes Swiss law requires for Swiss data. They are part of this DPA.

13. California: service-provider terms

Where the CCPA applies, Omne is your service provider. We do not sell or share customer personal data, and we do not keep, use or disclose it for any purpose other than providing Omne to you. We do not combine it with personal data we receive from anyone else, except as the CCPA allows, and we tell you if we can no longer meet these duties.

14. Liability

Each party's liability under this DPA is subject to the limits in our Terms of Service, as far as data protection law allows.

Annex 1: Details of processing

• Subject matter and duration: providing Omne to you, for as long as you use Omne, until the data is deleted as described above.
• Nature and purpose: storing, organising, showing, sending and deleting data so that Omne's features work as you direct, such as saving and creating content, planning and publishing posts, running your store and email lists, and the AI features and agents you use.
• Data subjects: you and the members of your workspaces; your contacts, subscribers and buyers and the other people whose data you keep in Omne; and the people whose public posts and profiles you save.
• Personal data: names, email addresses and profile pictures; content and messages; contact, order and payment details; the public social accounts named in contacts' public profiles; and, once Finance is live, the bank accounts, balances and transactions you connect.
• Special categories: Omne is not designed for special categories of personal data. Keep them out of Omne unless you have a lawful basis and a need.
• Frequency: continuous, while you use Omne.

Annex 2: Technical and organisational measures

The measures in place today. What is planned is on our Security page.

• Encryption in transit (partly in place). HTTPS on every Omne address and HSTS on the app; TLS 1.2 as the minimum and HSTS on omne.so are next.
• Encryption at rest (partly in place). Connection keys are sealed and sign-in codes stored only as hashes; encrypting the database server's disk is planned.
• Sealed connection keys (in place). Each key to a connected account is sealed with AES-256-GCM under a key kept only in the server's settings.
• Workspace isolation (in place). Every request about a workspace checks that you are signed in and a member of it.
• Roles (in place). Each workspace has owners, admins and members, each allowed only what their role permits.
• Sign-in without passwords (in place). No passwords: a 6-digit code to your email, valid for 10 minutes, or Google, GitHub, LinkedIn, Facebook, Discord or Twitch.
• Agent approvals (in place). Agents may read on their own, but every change waits for your yes, and their tools work only during a turn you started.
• Audit log (partly in place). Admin changes, connection events and Finance changes are recorded; retention rules and alerts are planned.
• Data location (in place). Servers and database in Germany, at Hetzner; files stored with Cloudflare in Western Europe.
• Monitoring (partly in place). Each part of Omne is checked every 10 minutes, with the results on the status page; alerts are planned.
• Content security policy (in place). A content security policy on the app and omne.so, so a page runs only the scripts Omne serves.

Annex 3: Subprocessors

The subprocessors in use today, as on our Subprocessors page:

Coming with features that are not live yet: