You may experience brief interruptions
Last updated: October 9, 2026
This Data Processing Addendum ("DPA") is entered into between Big Bongo Bang Inc. ("BigBongo" or "Processor") and the Customer identified in the applicable Order Form ("Controller"), and forms part of the BigBongo Framework Agreement (the "Framework Agreement") between the parties.
This DPA applies where BigBongo processes Personal Data on behalf of the Controller in the course of providing the Platform and Services. In the event of any conflict between this DPA and the Terms on data protection matters, this DPA shall prevail.
1. DEFINITIONS
In this DPA:
"Applicable Data Protection Law" means all laws and regulations applicable to the processing of Personal Data under this DPA, including but not limited to: (a) the GDPR; (b) the UK GDPR and the Data Protection Act 2018; (c) the Swiss Federal Act on Data Protection (nFADP); (d) the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), as applicable; and (e) any other applicable national or state data protection laws.
"Controller" means the Customer (as defined in the Agreement) who determines the purposes and means of processing of Personal Data.
"Customer Data" has the meaning given in the Terms.
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
"Employee Interview Data" has the meaning given in the Terms.
"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
"Personal Data" means any information relating to an identified or identifiable natural person that is included in Customer Data and processed by BigBongo under the Framework Agreement.
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored, or otherwise processed.
"Processor" means BigBongo, who processes Personal Data on behalf of the Controller.
"Restricted Transfer" means a transfer of Personal Data from the EEA or UK to a third country that does not benefit from an adequacy decision.
"SCCs" means the Standard Contractual Clauses for the transfer of personal data to third countries adopted by the European Commission pursuant to Decision (EU) 2021/914, and the UK IDTA or UK Addendum as applicable.
"Services" has the meaning given in the Terms.
"Sub-Processor" means any processor engaged by BigBongo to carry out processing activities in respect of Personal Data on behalf of the Controller.
"UK GDPR" means the GDPR as retained in UK law by the European Union (Withdrawal) Act 2018.Terms not defined in this DPA have the meanings given in the Terms or in the GDPR.
2. SCOPE AND NATURE OF PROCESSING
2.1 Details of Processing
BigBongo processes Personal Data on behalf of the Controller as described in Schedule 1 to this DPA (Details of Processing). The parties acknowledge that the descriptions in Schedule 1 reflect the nature of the Services as understood at the date of this DPA and may be updated by mutual written agreement as the Services evolve.
2.2 Controller's Instructions
BigBongo shall process Personal Data only on documented instructions from the Controller, which are set out in: (a) the Terms; (b) this DPA; (c) the applicable Order Form; and (d) any subsequent written instructions provided by the Controller during the Subscription Term.
BigBongo shall immediately inform the Controller if, in its reasonable opinion, any instruction infringes Applicable Data Protection Law.
2.3 Purpose Limitation
BigBongo shall not process Personal Data for any purpose other than the performance of the Services and compliance with its obligations under this DPA and Applicable Data Protection Law, unless required to do so by applicable law, in which case BigBongo shall (to the extent permitted by law) inform the Controller before undertaking such processing.
3. BIGBONGO'S OBLIGATIONS AS PROCESSOR
3.1 Compliance
BigBongo shall, in relation to Personal Data processed under this DPA:
(a) process Personal Data in compliance with Applicable Data Protection Law;
(b) ensure that persons authorised to process Personal Data are subject to appropriate obligations of confidentiality;
(c) implement and maintain the technical and organisational security measures described in Schedule 2 (Security Measures);
(d) assist the Controller, taking into account the nature of the processing, in fulfilling the Controller's obligations to respond to Data Subject requests for the exercise of their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, and objection;
(e) assist the Controller in ensuring compliance with obligations relating to security, Personal Data Breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of processing and the information available to BigBongo;
(f) at the choice of the Controller, delete or return all Personal Data to the Controller after the end of the provision of the Services, and delete existing copies unless applicable law requires retention;
(g) make available to the Controller all information necessary to demonstrate compliance with the obligations in this DPA, and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to Section 10 of this DPA.
3.2 Confidentiality of Processing
BigBongo shall ensure that only those of its employees, contractors, and Sub-Processors who have a need to access the Personal Data in order to perform the Services are granted such access, and that all such persons are bound by appropriate confidentiality obligations.
3.3 No Sale or Sharing
BigBongo shall not sell, share, rent, or otherwise make Personal Data available to third parties for their own commercial purposes.
4. CONTROLLER'S OBLIGATIONS
The Controller represents and warrants that:
(a) it has a valid legal basis for processing the Personal Data and for instructing BigBongo to process it as described in this DPA;
(b) in relation to Employee Interview Data specifically, it has provided all required notices to and obtained all required consents from Data Subjects (including employees and contractors subject to AI-conducted interviews) under Applicable Data Protection Law, including any applicable works council or employee representative consultation requirements;
(c) all Personal Data provided to BigBongo is accurate, complete, and lawfully obtained;
(d) it will comply with all Applicable Data Protection Law in its capacity as Controller;
(e) it has reviewed BigBongo's Security Measures (Schedule 2) and determined that they are appropriate for the nature of the Personal Data being processed.
5. SUB-PROCESSORS
5.1 Authorisation
The Controller provides general written authorisation for BigBongo to engage Sub-Processors, subject to the conditions in this Section 5.
5.2 Current Sub-Processors
BigBongo's current list of approved Sub-Processors is set out in Schedule 3.
5.3 New Sub-Processors
BigBongo shall publish any changes to its Sub-Processor list (additions or replacements) by updating the Sub-Processor list, as set out in Schedule 3.
5.4 Sub-Processor Obligations
BigBongo shall impose data protection obligations on each Sub-Processor that are no less protective than those imposed on BigBongo under this DPA. BigBongo remains fully liable to the Controller for the performance of Sub-Processors' obligations.
6. SECURITY MEASURES
6.1 Technical and Organisational Measures
BigBongo shall implement and maintain appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, as set out in Schedule 2.
6.2 Updates to Security Measures
BigBongo may update the Security Measures from time to time, provided that any such update shall not result in a material reduction in the overall level of security afforded to Personal Data. BigBongo shall notify the Controller of any material changes to the Security Measures.
6.3 Access Controls
BigBongo shall ensure that access to Personal Data is limited to personnel who require such access in order to perform the Services, and shall maintain appropriate authentication and access control mechanisms.
7. PERSONAL DATA BREACH NOTIFICATION
7.1 Notification Obligation
BigBongo shall notify the Controller without undue delay, and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA. Such notification shall include, to the extent available:
(a) a description of the nature of the breach, including (where possible) the categories and approximate number of Data Subjects concerned, and the categories and approximate number of Personal Data records concerned;
(b) the name and contact details of BigBongo's data protection contact;
(c) a description of the likely consequences of the breach;
(d) a description of the measures taken or proposed to address the breach, including measures to mitigate its possible adverse effects.
7.2 Staged Notification
Where BigBongo cannot provide all the information required under Section 7.1 within the 72-hour window, it shall provide initial notification promptly and supplement it as further information becomes available.
7.3 Controller's Responsibility
The Controller is responsible for determining whether it is required to notify the relevant supervisory authority and/or affected Data Subjects of any Personal Data Breach, and for making such notifications as required by Applicable Data Protection Law.
7.4 No Acknowledgement of Fault
BigBongo's notification of a Personal Data Breach under this Section shall not be construed as an acknowledgement of fault or liability by BigBongo.
8. DATA SUBJECT RIGHTS
8.1 Assistance
BigBongo shall, taking into account the nature of the processing, assist the Controller in responding to requests from Data Subjects exercising their rights under Applicable Data Protection Law. Such assistance shall include providing the Controller with access to relevant Personal Data held by BigBongo, where technically feasible.
8.2 Direct Requests
If BigBongo receives any request directly from a Data Subject relating to Personal Data processed under this DPA, BigBongo shall:
(a) not respond to the request directly (unless directed to do so by the Controller or required by applicable law); and
(b) promptly forward the request to the Controller for the Controller to handle.
8.3 Cooperation
The Controller agrees to cooperate with BigBongo in good faith to enable BigBongo to fulfill its obligations under this Section, including by providing timely responses to BigBongo's requests for guidance or clarification.
9. DATA PROTECTION IMPACT ASSESSMENTS AND PRIOR CONSULTATION
BigBongo shall provide reasonable assistance to the Controller in carrying out any Data Protection Impact Assessment (DPIA) required under Article 35 GDPR (or equivalent provision under Applicable Data Protection Law) in relation to the processing of Personal Data under this DPA, taking into account the nature of processing and the information available to BigBongo. BigBongo shall similarly assist with any prior consultation with a supervisory authority required as a result of a DPIA.
10. AUDITS AND INSPECTIONS
10.1 Audit Rights
Upon the Controller's written request, BigBongo shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. The Controller may also conduct an audit (or appoint a reputable third-party auditor) of BigBongo's data processing facilities and practices relevant to this DPA, provided that:
(a) the Controller gives BigBongo at least 30 days prior written notice;
(b) audits are conducted during normal business hours and in a manner that does not unreasonably disrupt BigBongo's operations;
(c) the audit is limited to matters directly relevant to this DPA;
(d) audits are conducted no more than once per calendar year (unless a Personal Data Breach has occurred or a supervisory authority requires otherwise);
(e) the Controller (and any appointed auditor) enters into appropriate confidentiality obligations before accessing BigBongo's systems or records.
10.2 Certification as Audit Substitute
BigBongo may, in lieu of an on-site audit, provide the Controller with up-to-date third-party audit certifications or reports that demonstrate compliance with the Security Measures. The Controller shall accept such certifications as sufficient audit evidence where they adequately address the scope of the Controller's inquiry.
10.3 Costs
The Controller shall bear the reasonable costs of any audit conducted under this Section 10.
11. INTERNATIONAL DATA TRANSFERS
11.1 EEA and UK Transfers
Where the processing of Personal Data involves a Restricted Transfer, such transfer shall be subject to appropriate safeguards as set out in this Section 11.
11.2 Standard Contractual Clauses
To the extent that BigBongo (or a Sub-Processor) processes Personal Data originating from the EEA in a third country, the EU SCCs (Module 2: Controller to Processor) are hereby incorporated into this DPA by reference and shall apply, with the parties taking the roles specified in those clauses. The Annexes to the SCCs are populated by reference to Schedules 1, 2, and 3 of this DPA.
For transfers from the UK, the UK IDTA (or UK Addendum to the EU SCCs, as applicable) shall apply.
11.3 Alternative Transfer Mechanisms
Where a transfer is covered by an adequacy decision, or where another valid transfer mechanism under Applicable Data Protection Law applies, that mechanism shall take precedence over the SCCs.
11.4 Sub-Processor Transfers
BigBongo shall ensure that any Restricted Transfer to a Sub-Processor is subject to an equivalent transfer mechanism.
12. EMPLOYEE INTERVIEW DATA — SPECIFIC PROVISIONS
Given the particular sensitivity of Employee Interview Data processed via the Platform, the parties agree to the following additional safeguards:
(a) Purpose limitation: Employee Interview Data shall be processed solely to provide the Platform's AI interview and synthesis functionalities to the Controller. BigBongo shall not use Employee Interview Data to train AI models in a manner that allows identifiable outputs to be reproduced for any other customer.
(b) Aggregation and anonymisation: BigBongo may use Employee Interview Data in aggregate, anonymised form for Platform improvement purposes only where such data cannot reasonably be used to identify the relevant organisation, department, or individual.
(c) Retention: BigBongo shall delete or return Employee Interview Data in accordance with Section 13 of this DPA.
(d) Special category data: The parties acknowledge that Employee Interview Data may incidentally include special category personal data (as defined in Article 9 GDPR), for example where an employee discloses health information. The Controller is responsible for establishing a valid legal basis under Article 9 GDPR for any such processing, and for instructing BigBongo accordingly.
(e) Access controls: BigBongo shall implement configurable access controls enabling the Controller to restrict which of its personnel can access individual-level Employee Interview Data.
13. RETURN AND DELETION OF PERSONAL DATA
13.1 End of Services
Upon the expiry or termination of the Framework Agreement (or upon the Controller's written request at any time during the term), BigBongo shall, at the Controller's election:
(a) return a complete copy of all Personal Data to the Controller in a machine-readable format within 30 days; and/or
(b) securely delete all Personal Data, including all copies held by Sub-Processors, and provide the Controller with written certification of deletion within 30 days.
13.2 Residual Copies
Notwithstanding Section 13.1, BigBongo may retain Personal Data in backup copies for a maximum of 90 days following the deletion/return request, after which all such copies shall be permanently deleted. BigBongo shall not process such backup copies for any operational purpose during that period.
13.3 Legal Retention
BigBongo may retain Personal Data beyond the periods in this Section 13 to the extent required by Applicable Data Protection Law (e.g., for legal proceedings or regulatory investigations), provided it notifies the Controller of such retention obligation where legally permitted.
14. TERM AND TERMINATION
This DPA shall remain in force for the duration of the Agreement. The provisions of Sections 3 (BigBongo's Obligations), 6 (Security), 11 (International Transfers), and 13 (Return and Deletion) shall survive termination of the Agreement to the extent necessary to give effect to the obligations arising thereunder.
15. LIABILITY
The parties' respective liabilities under this DPA are subject to the limitations and exclusions set out in the Agreement, except that:
(a) neither party shall limit its liability for breaches of this DPA that result in harm to Data Subjects to the extent that such limitation is prohibited by Applicable Data Protection Law; and
(b) the limitation of liability in the Agreement shall apply to the aggregate liability of each party under both the Agreement and this DPA taken together.
SCHEDULE 1 — DETAILS OF PROCESSING
Subject matter - The processing of Personal Data in connection with BigBongo's provision of the Platform and Services to the Controller pursuant to the Agreement
Duration - For the duration of the Framework Agreement and for the periods specified in Section 13 of this DPA
Nature of processing - Collection\, storage\, organisation\, retrieval\, consultation\, use\, disclosure by transmission\, alignment\, and deletion of Personal Data
Purpose of processing - Providing the Platform's AI interview\, synthesis\, reporting\, and analytics functionalities; enabling access by the Controller's Authorized Users; sending interview invitations to Interview Participants; generating Organizational Intelligence on behalf of the Controller
Categories of Data Subjects:(1) The Controller's employees and contractors who are Authorized Users(2) The Controller's employees, contractors, and other workers who participate in AI-conducted interviews ("Interview Participants")(3) The Controller's leadership and management personnel who provide KPI/OKR and organizational context data
Categories of Personal Data:(1) Identity and contact data: names, email addresses, job titles, departments;(2) Professional and organizational data: roles, responsibilities, workflows, process descriptions, institutional knowledge;(3) AI interview data: voice recordings (if voice interviews used), text responses, behavioral metadata;(4) Derived data: process maps, AI readiness scores, knowledge risk scores, dependency maps;(5) Technical data: login records, IP addresses, device information, session logs
Special categories of Personal Data — Employee Interview Data may incidentally contain special category data (health, trade union membership, political opinions) where volunteered by Interview Participants. The Controller is responsible for establishing and documenting the relevant legal basis for such processing (including Article 9 GDPR for EU/EEA data subjects, and equivalent requirements under applicable US state privacy laws, including where relevant the California Consumer Privacy Act as amended by the CPRA).
Processing location — Customer Data shall be processed in a data region corresponding to the Customer's location: within the European Union for EU/EEA-based Customers, and within the United States for US-based Customers, unless otherwise agreed in writing between the parties.
SCHEDULE 2 — TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
BigBongo implements and maintains the following categories of technical and organisational security measures:
SCHEDULE 3 — APPROVED SUB-PROCESSORS
The following Sub-Processors are approved as at the date of this DPA.