Data Processing Agreement.
This Data Processing Agreement (“Agreement”) forms part of the main contract between:
Controller: Any customer of Infotopics | Apps for Tableau (“Controller”), and
Processor: Infotopics | Apps for Tableau (“Processor”).
1. Definitions
“Personal Data” means any information relating to an identified or identifiable natural person processed under this Agreement.
“Processing” means any operation performed on Personal Data, as defined in GDPR Article 4(2).
“Sub-processor” means any third party engaged by the Processor to assist with the processing of Personal Data as permitted under this Agreement.
2. Scope, Purpose, and Duration of Processing
Purpose: Processor provides Tableau Extensions and Solutions (“the Services”) to Controller. Processing is limited to operations necessary for the provision of the Services (e.g., delivery of extensions, license control, usage monitoring, metadata handling).
Duration: This Agreement remains in force for as long as Processor provides Services to Controller, plus any legally required retention period.
3. Nature of Processing & Types of Data
Extensions (e.g., ShowMeMore, SuperTables, PowerKPIs, etc.):
- Processed entirely within Tableau dashboards.
- No storage of customer data by Processor.
- Only pseudonymous access logs and anonymous user tokens for license validation.
Solutions (e.g., WriteBack Extreme, MailScheduler, DashboardUsage):
- Hosted in segregated Azure environments for each customer.
- May store metadata, mapping rules, repository databases (including email addresses), audit logs, and user actions, depending on use case.
- Data remains under the Controller’s responsibility.
Categories of Data Subjects: Users of Controller’s Tableau dashboards (Creators, Explorers, Viewers) and recipients of communications through MailScheduler.
See Annex A.
4. Processor Obligations
Processor acts only on documented instructions from Controller.
Processor ensures confidentiality of processing operations.
Processor maintains appropriate technical and organizational measures, including:
- Secure SaaS deployments in segregated Azure environments.
- ISO/IEC 27001 certified Information Security Management System (ISMS).
- Applications integrated with Tableau governance; additional role-based access in WriteBack Extreme and MailScheduler.
- Annual penetration tests by an independent third party.
- Continuous vulnerability monitoring (e.g., CVEs via Dependabot) and peer review addressing OWASP Top 10.
- Documentation, secure deployment guidelines, and support are available.
5. Sub-processors
Processor engages trusted sub-processors to deliver the Services. The current list of sub-processors is included in Annex B. Processor will inform Controller of any changes to this list.
6. Data Subject Rights
Processor shall, where technically feasible and within reasonable effort, assist Controller in responding to data subject requests (access, rectification, deletion, etc.).
In principle, such requests are self-service through the applications. Processor will provide additional support only upon explicit request from Controller.
7. Security Breach / Data Breach
Processor shall notify Controller without undue delay upon becoming aware of any data breach involving Personal Data processed under this Agreement.
8. Audit & Inspection
Processor demonstrates compliance through:
- ISO/IEC 27001 certification,
- Information Security Policy (B01),
- Summaries of penetration test reports.
Additional documents may be shared under NDA and subject to agreement.
No physical or remote audits by Controller are permitted.
9. Return or Deletion of Data
Upon termination of Services, Processor will delete the entire segregated environment associated with Controller, including all application data such as audit logs, mapping data, mailing lists, and user actions.
Only financial and contractual records required by law (e.g., invoicing, contracts) are retained, as documented in the Record of Processing Activities.
10. Miscellaneous
This Agreement is governed by the laws of the Netherlands. In case of conflicts with mandatory data protection laws applicable to Controller, such mandatory laws shall prevail.
Processor strives to align its practices with internationally recognized standards and regulations, even where no formal certification is held (e.g., HIPAA in the United States).
Annex A – Description of Processing per Product
| Product | Stores Data | Type of Data (if any) |
|---|---|---|
| SuperTables | No | – |
| PowerKPIs | No | – |
| ShowMeMore | No | – |
| DrillDownTree | No | – |
| EasyDesigns | No | – |
| HierarchyFilter | No | – |
| Marginal Histogram | No | – |
| PictureThis | No | – |
| ProcessMining | No | – |
| DashboardGuide | No | – |
| WriteBackExtreme | Yes | – |
| MailScheduler | Yes | Audit logs, mailing lists (incl. email addresses) |
| DashboardUsage | Yes | Fingerprints, user actions |
Annex B – Current Sub-processors
| Supplier | Data processing |
|---|---|
| Microsoft Azure | Hosting of segregated SaaS environments |
| TransIP | Infrastructure services |
| HubSpot | CRM and customer communications |
| Sentry |
Application monitoring and error tracking |
Other sub-processors may be used as required; updates will be communicated to Controller.