opinvera legal terms
Partner Data Processing Agreement
Effective Invalid Date · Version 0.1-draft · Draft — under legal review
Status: DRAFT — under legal review (LR-02). Version: 0.1-draft
Draft — under legal review. This text has not been cleared by counsel. It is published so that it can be read and tested before launch; it is accepted together with the Partner Terms and takes effect only when a cleared version is published.
This Data Processing Agreement ("DPA") forms part of the Partner Terms between ECOMO.WORLD LLC ("OpinVera") and the Partner. It describes the personal data that passes between the two of us in the course of the partner relationship, who is responsible for it, and on what terms. Terms defined in the Partner Terms keep their meaning here. "Data protection law" means the GDPR, the UK GDPR, the CCPA/CPRA and any other law that applies to the processing described below.
1. The three flows, and who is responsible for each
| Flow | Personal data | OpinVera's role | Partner's role |
|---|---|---|---|
| A. The report and the distribution list (§2) | The email addresses you name to receive reports; the names and addresses of Seat holders. | Independent controller: we send our report to addresses you gave us, under our own obligations. | Controller for your decision to name them. |
| B. The Voter Bridge (§3) | A pseudonymous subscriber identifier you mint, a signed attestation, and the click reference where a subscription link is in use. No name, no email. | Independent controller of the ballot and the vote weight that results. | Controller of your subscriber's account and of the decision to attest. |
| C. Sponsored verification (§4) | Our record that a verification was sponsored by you; the count you are told. | Controller of the verification and the member's data. | Recipient of a count only. |
We are not your processor and you are not ours. Nothing in the partner relationship involves either party processing personal data on the other's documented instructions. Where a Partner later commissions research (the commissioned ballots product) under a separate order, that order will say whether a processor relationship arises and will carry the Article 28 terms it then needs.
2. The report and the distribution list
2.1 What we send and to whom
We send the report to the addresses on the distribution list. An address whose domain is the claimed outlet's domain is sent to at once; any other address is sent one confirmation message and nothing else until its holder confirms. You will not add an address whose holder has not agreed to receive the report, and you will remove an address on request.
2.2 What the report contains
The report contains counts, aggregates and rollups. It never identifies an individual voter, never contains a voter's name, handle, address, identifier or the content of an individual ballot, and the rollups are suppressed below a minimum count so that a count of one cannot be read as a person. You will not attempt to re-identify a voter from a report, and you will not combine a report with other data in order to do so.
2.3 Seat holders
Seat holders are members of the Platform in their own right and their data is governed by the Privacy Policy. We tell you which Seats are on the account; we do not tell you what a Seat holder does on the Platform outside the partner account.
3. The Voter Bridge and the hand-off
3.1 What you send us
To attest a signed-in subscriber you send us a signed token that carries a pseudonymous identifier for that subscriber on your service, the time, and — where the subscriber arrived through a subscription link — the click reference. The token carries no name, no email address and no other identifier of the person. You warrant that the identifier cannot be reversed to the person by anyone but you.
3.2 What we do with it
We verify the signature against the key you registered, record that the ballot is attested, and weight the vote accordingly. We retain the attestation for as long as the ballot is retained. We do not send you the ballot, the vote, or any identifier of the member on our side.
3.3 The profile hand-off
Where a reader chooses to carry their OpinVera profile to your property, that transfer happens by a separate signed hand-off the reader initiates, never inside the attestation. The lawful basis is the performance of the reader's contract with us (Art. 6(1)(b) GDPR). The hand-off carries only what the reader chose to carry, and you will use it only for the purpose the reader was shown.
3.4 Subscription-link clicks and conversions
Where you provide a subscription link, we record each member's click under a pseudonym that is not the member's identifier, and we append a click reference to the address we redirect to. A conversion is reported to us either inside the first attestation for that subscriber or by a signed postback. We never place a pixel, script or cookie on your pages, and you never learn which member clicked. The reconciliation statement you receive carries hashed click references and conversion references only.
4. Sponsored verification
Where you sponsor verification, a reader who verifies at your expense is a member verifying with us under our Privacy Policy; their identity document, selfie and the outcome are between the reader, our verification provider and us. You learn a count, and nothing about any person: how many verifications your budget paid for in the period. A sponsored reader is told, before verifying, that the verification was sponsored and what the sponsor is told.
5. Security
Each party will protect the personal data it holds under this DPA with measures appropriate to the risk, including encryption in transit and at rest, access control and logging. You will protect the signing key you register with us, revoke it if you believe it compromised, and tell us without undue delay of any incident affecting it or affecting data you received from us.
6. Sub-processors and transfers
We use the providers named in our Privacy Policy §5 to run the Platform. Personal data under this DPA is processed in the United States, where the Platform is offered at launch (Privacy Policy §2A, Scope at launch); once the Platform is offered in the EEA or the United Kingdom, for data of EEA and UK readers the transfer mechanisms set out in Privacy Policy §10 apply. Where you are in the EEA or the UK and the standard contractual clauses are required between us as independent controllers, the module for controller-to-controller transfers applies and is incorporated by this reference, with the annexes populated from §§1–4 of this DPA.
7. Rights requests
Each party answers rights requests concerning the data it controls. If a request reaches one of us that concerns data the other controls, we will forward it within five (5) working days and help as reasonably needed. A member's request to us to withdraw an attestation, delete a ballot or delete an account is answered by us without reference to you.
8. Retention and the end of the relationship
Distribution-list addresses are deleted when removed, when the claim ends, or when the account closes. Attestations live with the ballots they attest. Click records are retained for the thirty-day conversion window and then for the period needed to invoice and reconcile, after which the pseudonym is dropped. Agreements recorded on the account are kept as a record of what was accepted. On termination each party deletes the data received from the other under this DPA save for what the law or an open dispute requires it to keep.
9. Precedence
Where this DPA and the Partner Terms conflict on a matter of personal data, this DPA governs. Where the law requires a term this DPA does not contain, that term applies.