The data you bring into Tamaat may include information about people: customer addresses, the names of field staff, the owners of parcels. This addendum sets out how Tamaat Inc. handles that information for you. It is part of the Terms of Service, and applies whenever Your Content contains personal information. You do not need to sign it.
It does not cover the information we hold about you as an account holder, such as your name, email address and billing details. The Privacy Policy covers that.
1. Who decides and who acts
You decide what personal information goes into your organization, why, and who may see it. Privacy law calls you the organization in control of that information, or the controller.
We handle that information for you, to provide the Service. Privacy law calls us your service provider, or processor. We do not decide what it is used for, and we do not use it for purposes of our own.
2. Your instructions
We handle personal information in Your Content only on your instructions. Your instructions are the Terms of Service, this addendum, and what you and your members do in the Service: uploading a dataset, sharing a map, publishing a dashboard, running a flow, asking the assistant a question.
If we believe an instruction breaks privacy law, we will tell you, and we may hold off acting on it until you confirm. If the law requires us to handle the information in another way, we will tell you first unless the law forbids it.
3. What is handled
- What we do with it
- DetailsStore it, process it, display it and deliver it to the people you choose, as needed to provide the Service.
- For how long
- DetailsFor as long as you keep it in the Service, and afterwards for the periods in Section 13.
- Kinds of information
- DetailsWhatever you bring in. Typically names, contact details, street addresses, locations, and attributes attached to places or to people.
- People concerned
- DetailsWhoever your data is about. Typically your customers, employees, contractors, and members of the public.
4. What you are responsible for
You are responsible for having the right to collect the personal information you bring in and to use it in the Service: giving people the notices the law requires, and obtaining their consent where the law requires it.
The Service is not designed for health records, government identity numbers, financial account numbers, or information about children. Do not bring that kind of information in unless we have agreed to it in writing.
You control who can see your data. Review who you have invited and what you have published, and treat anything published to anyone with the link as public.
5. Our people
Our staff can reach customer data only when a task requires it, such as a support request you have made or an incident we must investigate. Everyone with access is bound to keep the information confidential.
6. Security
We protect Your Content with safeguards suited to its sensitivity, including:
- encryption of data in transit and at rest;
- separation of each customer's data by organization;
- protection of passwords, and optional multi-factor authentication;
- sessions that end after a period without use;
- monitoring of our systems;
- encrypted backups that expire after 14 days.
We may change these measures as technology changes, and will not reduce the overall level of protection.
7. Service providers we use
You agree that we may use the service providers listed in Section 7 of the Privacy Policy to host and run the Service. Each is bound by a written agreement to protect the information and to use it only to provide its service to us. We remain responsible to you for what they do with it.
If we add or replace a provider that handles Your Content, we will update that list at least 30 days before the change takes effect. If you have a reasonable privacy objection, tell us within that time. If we cannot resolve it, you may cancel and we will refund the unused part of your term.
The companies that run the AI models receive data only when someone in your organization uses the assistant. A provider you connect with your own key is your provider, not ours.
8. Where the information is kept
Your Content is stored in Canada, in data centres in Montreal and Toronto. Maps and dashboards you publish are delivered to their viewers through a global network of edge locations.
Your Content leaves Canada only when you cause it to: when you use the assistant, which sends what a question needs to a model provider in the United States, and when you share or publish it to people elsewhere.
9. Requests from the people your data is about
If someone asks us to see, correct or delete personal information that is in Your Content, we will not act on the request ourselves. We will tell the person to contact you, and tell you about the request without delay.
The Service lets you find, correct, export and delete your data yourself. Where you need more than that to answer a request, we will give you reasonable help.
10. Security incidents
If we become aware that personal information in Your Content has been lost, or accessed or disclosed without authorization, we will tell the owners of your organization without undue delay. We will say what happened, what information was involved as far as we know, what we have done about it, and what we suggest you do.
We will keep you informed as we learn more, and give you the information you need to meet your own duties to notify regulators and the people affected. We keep a record of every such incident.
11. Helping you meet your obligations
On request, we will give you reasonable information about how we handle Your Content, so that you can carry out a privacy impact assessment or answer a regulator.
12. Checking that we do what we say
Once in any 12 months, on written request, we will give a business customer a written description of the safeguards we apply to Your Content and answer reasonable questions about it.
If the law that applies to you gives you a right to audit us, we will agree with you a way to do so that does not put other customers' data at risk. You give us at least 30 days' notice, keep what you learn confidential, and bear your own costs.
13. Return and deletion
While your account is active you can export Your Content at any time, in the formats the Service offers.
When Your Content is deleted, or your subscription or your account ends, we delete it on the schedule set out in Section 19 of the Terms of Service: 14 days in the trash, and 30 days after a subscription or an account ends. Deleted data may remain in encrypted backups for up to 14 further days, until those backups expire.
We keep information after that only where the law requires us to, and only for as long as it does.
14. Customers in Europe and the United Kingdom
If the General Data Protection Regulation, or its United Kingdom equivalent, applies to your use of the Service, this addendum is the contract between controller and processor that Article 28 requires.
Canada is recognized by the European Commission as giving adequate protection to personal information handled by commercial organizations. If a transfer needs a further safeguard, we will enter into the European Commission's standard contractual clauses with you on request.
15. How this addendum fits with the Terms of Service
Where this addendum and the Terms of Service differ about personal information in Your Content, this addendum applies. The limits on liability in the Terms of Service apply to this addendum, except where privacy law does not allow them to.
If we have signed a separate data processing agreement with you, that agreement applies in place of this one.
16. Contact
Questions about this addendum, and requests under it: privacy@tamaat.com. Privacy Officer, Tamaat Inc., 687 Arbour Lake Dr NW, Calgary, AB T3G 4T6, Canada.