This agreement is between Meeting Room 365, LLC ("we", "us") and the customer that accepted our Terms of Service at meetingroom365.com/tos ("you"). It is part of the Terms. It takes effect when you accept the Terms, or on the date above if you already had. You do not need to sign it; if you want a countersigned copy, sign the last page and send it to support@meetingroom365.com.
It applies whenever we process personal data on your behalf to provide our services (room displays, room finder and analytics, desk booking, visitor management and maps). If it conflicts with the Terms, this agreement wins on personal data. If it conflicts with the Standard Contractual Clauses in section 9, the Clauses win.
Words like "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" mean what they mean in the EU General Data Protection Regulation 2016/679 (GDPR).
You are the controller of the personal data, or a processor acting for your own client. We are your processor, or your subprocessor. Annex I lists the data, the people it is about and why we process it.
We process personal data only on your documented instructions. The Terms, this agreement, the way you configure the service and your requests to support are those instructions. We will tell you if we believe an instruction breaks the GDPR or other EU or member state data protection law. If EU or member state law requires us to process the data in another way, we will tell you first unless that law forbids it.
You are responsible for having a lawful basis for the processing and for giving your staff and visitors the notices the law requires.
Everyone we allow to process the data is bound by a duty of confidentiality, by contract or by law.
We maintain the technical and organizational measures in Annex II. We may change them, but never in a way that lowers the overall protection of the data.
You give us general authorization to use the subprocessors listed in Annex III. We bind each one to data protection terms that protect the data at least as well as this agreement, and we remain liable to you for their work.
We will email you at least 30 days before we add or replace a subprocessor. You may object on reasonable data protection grounds within those 30 days. If we cannot address the objection, you may cancel the affected services before the change takes effect.
We make available the information needed to show that we meet this agreement: this agreement, our security page at meetingroom365.com/security, and written answers to a reasonable security questionnaire, once a year. If that is not enough, or a supervisory authority requires it, you may audit us, or have an independent auditor bound by confidentiality do so, with 30 days' notice, during business hours, at your cost.
We are in the United States. Where your use of the service transfers personal data from the European Economic Area to us, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 apply, Module 2 (controller to processor). They are incorporated into this agreement by reference, and you and we are deemed to have signed them, with you as data exporter and us as data importer. These choices apply:
United Kingdom. For transfers from the UK, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, in force March 21, 2022) applies and is incorporated by reference. Table 1 is completed by Annex I. Table 2 is completed by the module and choices above. Table 3 is completed by Annexes I to III. For Table 4, either party may end the Addendum as its Section 19 allows.
Switzerland. For transfers from Switzerland, the Clauses apply as above, with the Swiss Federal Data Protection and Information Commissioner as supervisory authority and references to the GDPR read as references to the Swiss Federal Act on Data Protection.
When you stop using the service, ask support to erase your account and its data. We erase it from our live systems within 30 days, unless law requires us to keep it, and confirm when it's done. Copies in backups are overwritten as the backups rotate.
Each party's liability under this agreement is subject to the limitation of liability in the Terms, except where the Clauses in section 9 do not allow it. This agreement lasts as long as we process personal data for you.
| Data exporter | The customer that accepted the Terms, with the name, address and contact on its Meeting Room 365 account. Role: controller (or processor for its own client). Activity: uses our services for its rooms, desks, visitors and floor plans. |
|---|---|
| Data importer | Meeting Room 365, LLC, a Washington limited liability company. 440 N Barranca Ave #3659, Covina, CA 91723, United States. Contact: James Futhey, Security and Data Protection, support@meetingroom365.com. Role: processor. Activity: provides the services described in the Terms. |
| Data subjects | Your administrators and staff; people named in the calendars of rooms you connect (organizers and attendees); people who book desks; visitors and their hosts. |
|---|---|
| Personal data |
Administrator names and email addresses; room and resource email addresses. Calendar details shown on displays: meeting subject, organizer and times. We don't copy your calendars. We store the current and next meeting shown on each display, and room finder and analytics keep 15-minute snapshots of each room's status and occupancy, and, if you turn it on, the meeting subject and organizer. Desk bookings: name, email and booking times. Visitors: name, email, phone number, company, host, visit times, signed documents (such as NDAs) and photos, as your kiosk is configured to collect. Support screenshots of our app on your displays. Logs: IP addresses, email addresses and browser details of people using the admin and displays. |
| Sensitive data | None is intended. You should not configure the service to collect special category data. |
| Frequency | Continuous, while you use the service. |
| Nature and purpose | Hosting, storing, displaying and sending (by email and SMS) the data, solely to provide the services to you and to support you. |
| Retention | While your account is active. After the retention window set on your kiosk (730 days by default), visit records are anonymized and their files deleted. Everything else is deleted as section 10 describes. |
| Transfers to subprocessors | As listed in Annex III, for the purposes listed there, for as long as we provide the services. |
The supervisory authority of the EU member state where you are established; if you are not established in the EU, the authority of the member state where your EU representative is; if you have no representative, the authority of the member state where the affected data subjects are.
Our current subprocessors, with what each does and where, are listed at https://www.meetingroom365.com/security
AI. Our only AI subprocessor is Anthropic (United States). It runs AI features such as floor-plan analysis, and the AI tools our support and engineering team use. No other AI provider receives your personal data. Anthropic does not train models on it.
This copy is unsigned. It already applies under section 1, so you don't need to sign it. For a countersigned copy, sign this page and email it to support@meetingroom365.com. We'll sign it and send it back.
| Meeting Room 365, LLC | Customer | |
|---|---|---|
| Signature | ||
| Name | James Futhey | |
| Title | ||
| Company | Meeting Room 365, LLC | |
| Date |