6,104 words, 164 clausesupdated September 1, 2021read 11/10/2026source
·Any translated versions of the Agreement in a language other than English are provided as a courtesy only. In the event of any conflict or discrepancy between any translated version of the Agreement and the English language version, the English language version shall prevail.
·These are the standard terms of service applicable to all Miro self-serve and reseller customers. If you have subscribed to an Enterprise Plan, please visit our Master Cloud Agreement. Publication date July 19, 2021 Effective date September 1, 2021
·This Miro Terms of Service ("Agreement") is entered into by and between RealtimeBoard Inc. dba Miro or the Miro Affiliate identified in an Order ("Miro") and the entity or person placing an order for or accessing the Service ("Customer" or "you"). This Agreement consists of the terms and conditions set forth below and any Orders. If you are accessing or using the Service on behalf of your company, you represent that you are authorized to accept this Agreement on behalf of your company, and all references to "you" reference your company.
·The "Effective Date" of this Agreement is the date which is the earlier of (a) Customer's initial access to the Service through any online provisioning, registration or order process or (b) the effective date of the first Order. This Agreement will govern Customer's initial purchase on the Effective Date as well as any future purchases made by Customer that reference this Agreement. Miro may modify this Agreement from time to time as permitted in Section 19 (Modifications to Agreement). Purchase from Reseller: If Customer purchases the Service from an authorized reseller of Miro ("Reseller"), Customer's use of the Service will be governed by this Agreement, subject to Section 19.14 (Reseller Orders) below. By indicating your acceptance of this Agreement or accessing or using the Service, you are agreeing to be bound by the terms and conditions of this Agreement. Each party expressly agrees that this Agreement is legally binding upon it.
·Miro offers a unique Service for visual collaboration that is designed to allow Users to create, collaborate and centralize communication through interactive online virtual whiteboards. Customer maintains sole control over the types and content of all Customer Content it submits to the Service.
·During the Subscription Term, Customer may access and use the Service only for its internal business or personal purposes in accordance with the Documentation and this Agreement, including any usage limits in an Order. This includes the right to copy and use the Software as part of Customer's authorized use of the Service.
·Only Users may access or use the Service. Each User must keep its login credentials confidential and not share them with anyone else. Customer is responsible for its Users' compliance with this Agreement and actions taken through their accounts (excluding misuse of accounts caused by Miro's breach of this Agreement). Customer will promptly notify Miro if it becomes aware of any compromise of its User login credentials. Miro uses User account information as described in its Privacy Policy.
·Customer may designate a User as an administrator with control over Customer's Service account, including management of Users and Customer Content, as described in the Documentation. Customer is fully responsible for its choice of administrators and any actions they take.
·Customer's Affiliates may use the Service as Users of Customer. Alternatively, an Affiliate of Customer may enter its own Order(s) as mutually agreed with Miro, and this creates a separate agreement between the Affiliate and Miro that incorporates this Agreement with the Affiliate treated as "Customer." Neither Customer nor any Customer Affiliate has any rights under each other's agreement with Miro, and breach or termination of any such agreement is not breach nor termination under any other.
·If you created an account using an email address belonging to your employer or other entity, you represent and warrant that you have authority to create an account on behalf of such entity and further acknowledge that Miro may share your email address with and control of your account may be taken over by such entity (as the "Customer"). Upon such takeover, the administrator controlling the account may be able to (i) access, disclose, restrict or remove information from the account, (ii) restrict or terminate your access to the Service and (iii) prevent you from later disassociating such account from the Customer.
·If you are invited to another Customer's Board, you acknowledge that your access to that Board as well as any content you submit will be under the sole control of that other Customer.
·Through the Service you control who you share Boards with (including making Boards public). Miro has no liability for how others may access or use Customer Content as a result of your or your Users' decision to share a Board.
·The Service is not intended for, and may not be used by, anyone under the age of 16. Customer is responsible for ensuring that all Users are at least 16 years old.
·Customer will not (and will not permit anyone else to) do any of the following: (a) provide access to, distribute, sell or sublicense the Service to a third party, (b) use the Service on behalf of, or to provide any product or service to, third parties, (c) use the Service to develop a similar or competing product or service, (d) scrape, data mine, reverse engineer, decompile, disassemble or seek to access the source code or non-public APIs to or unauthorized data from the Service, except to the extent expressly permitted by Law (and then only with prior notice to Miro), (e) modify or create derivative works of the Service or copy any element of the Service (other than authorized copies of the Software), (f) remove or obscure any proprietary notices in the Service or otherwise misrepresent the source of ownership of the Service, (g) publish benchmarks or performance information about the Service, (h) interfere with the Service's operation, circumvent its access restrictions or conduct any security or vulnerability test of the Service, (i) transmit any viruses or other harmful materials to the Service, (j) allow Users to share User seats, (k) engage in any fraudulent, misleading, illegal or unethical activities related to the Service or (l) use the Service to store or transmit material which contains illegal content.
·During the Subscription Term, Miro will provide Support in accordance with the Support Policy.
·Customer grants Miro the non-exclusive, worldwide right to use, copy, store, transmit and display Customer Content and to modify and create derivative works of Customer Content (for reformatting or other technical purposes), but only as necessary to provide the Service, Support and any Technical Services to Customer under this Agreement.
·Miro uses reasonable technical and organizational measures designed to protect the Service and Customer Content as described in the Security Policy.
·Each party agrees to comply with the DPA.
·During the Subscription Term or within 30 days thereafter, Customer may export its Customer Content from the Service using the export features described in the Documentation. After this export period, Miro may delete Customer Content in accordance with its standard schedule and procedures. If Customer elects to proactively delete its account at any time, all associated Customer Content will be deleted permanently and cannot be retrieved.
·Customer is responsible for its Customer Content, including its content and accuracy, and agrees to comply with Laws in using the Service. Customer represents and warrants that it has made all disclosures and has all rights, consents and permissions necessary to use its Customer Content with the Service and grant Miro the rights in Section 4.1 (Data Use), all without violating or infringing Laws, third-party rights (including intellectual property, publicity or privacy rights) or any terms or privacy policies that apply to the Customer Content.
·Customer must not use the Service with Prohibited Data or for High Risk Activities. Customer acknowledges that the Service is not intended to meet any legal obligations for these uses, including HIPAA requirements, and that Miro is not a Business Associate as defined under HIPAA. Notwithstanding anything else in this Agreement, Miro has no liability for Prohibited Data or use of the Service for High Risk Activities.
·The Service may contain functionality allowing Customer to convert accounts previously registered by individuals using email addresses from Customer's domain into User accounts under Customer's control. Customer represents and warrants that it has all necessary rights and consents to the extent it converts any existing accounts registered using email addresses from Customer's domain into accounts under Customer's control.
·Miro may suspend Customer's or a User's access to and use of the Service and related services if Customer breaches Section 2.8 (Age Requirement for Users), Section 2.9 (Restrictions) or Section 5 (Customer Obligations), if Customer's account is 10 days or more overdue or if Customer's or User's actions risk harm to other customers or the security, availability or integrity of the Service. Where practicable, Miro will use reasonable efforts to provide Customer with prior notice of the suspension. Once Customer resolves the issue requiring suspension, Miro will promptly restore Customer's or User's access to the Service in accordance with this Agreement.
·Customer may choose to use the Service with Third-Party Platforms. Use of Third-Party Platforms is subject to Customer's agreement with the relevant provider and not this Agreement. Miro does not control and has no liability for Third-Party Platforms, including their security, functionality, operation, availability or interoperability or how the Third-Party Platforms or their providers use Customer Content. If Customer enables a Third-Party Platform with the Service, Miro may access and exchange Customer Content with the Third-Party Platform on Customer's behalf.
·Any purchased Technical Services are as described in the relevant Order. Customer will give Miro timely access to Customer Materials reasonably needed for the Technical Services, and if Customer fails to do so, Miro's obligation to provide Technical Services will be excused until access is provided. Miro will use Customer Materials only for purposes of providing Technical Services. Any Technical Services deliverables relate to the configuration or use of the Service. Customer may use Technical Services deliverables only as part of its authorized use of the Service, subject to the same terms as for the Service in Section 2 (The Service) and Section 5 (Customer Obligations).
·Unless otherwise specified in the applicable Order, each Subscription Term will renew for successive 12-month periods, unless either party gives the other party notice of non-renewal at least 90 days before the current Subscription Term ends. Upon notice of non-renewal, Customer will not be charged for the next billing cycle but will not receive any refunds or credits for amounts that have already been charged.
·Fees are as described in each Order. Customer will reimburse Miro for pre-approved travel and lodging expenses it incurs in providing Technical Services. Fees are invoiced on the schedule in the Order and reimbursable expenses are invoiced in arrears. Customer agrees that Miro may bill Customer's credit card or other payment method for renewals, expenses and any other unpaid fees, as applicable. Customer may change its payment method information by entering updated information through the user interface of the Service. Unless the Order provides otherwise, all fees and expenses are due within 30 days of the billing date specified in the applicable Order. Fees for renewal Subscription Terms are at Miro's then-current rates, regardless of any discounted pricing in a prior Order. Late payments are subject to a service charge of 1.5% per month or the maximum amount allowed by Law, whichever is less. All fees and expenses are non-refundable except as set out in Section 10.2 (Warranty Remedy) and Section 14.4 (Mitigation and Exceptions). Customer is responsible for any sales, use, goods and services, value-added, withholding or similar taxes or levies that apply to its Orders, whether domestic or foreign ("Taxes"), other than Miro's income tax. Fees and expenses are exclusive of Taxes.
·Miro warrants to Customer that:
·(a) the Service will perform materially as described in the Documentation and Miro will not materially decrease the overall functionality of the Service during a Subscription Term (the "Performance Warranty") and (b) Miro will perform any Technical Services in a professional and workmanlike manner (the "Technical Services Warranty").
·If Miro breaches Section 10.1 (Limited Warranty) and Customer makes a reasonably detailed warranty claim within 30 days of discovering the issue, then Miro will use reasonable efforts to correct the non-conformity. If Miro cannot do so within 60 days of Customer's warranty claim, either party may terminate the affected Order as relates to the non-conforming Service or Technical Services. Miro will then refund to Customer any pre-paid, unused fees for the terminated portion of the Subscription Term (for the Performance Warranty) or for the non-conforming Technical Services (for the Technical Services Warranty). These procedures are Customer's exclusive remedy and Miro's entire liability for breach of the warranties in Section 10.1. These warranties do not apply to (a) issues caused by misuse or unauthorized modifications, (b) issues in or caused by Third-Party Platforms or other third-party systems or (c) Trials and Betas or other free or evaluation use.
·Except as expressly provided in Section 10.1 (Limited Warranty), the Service, Support, Technical Services and all related Miro services are provided "AS IS". Miro and its suppliers make no other warranties, whether express, implied, statutory or otherwise, including warranties of merchantability, fitness for a particular purpose, title or noninfringement. Without limiting its express obligations in Section 3 (Support), Miro does not warrant that Customer's use of the Service will be uninterrupted or error-free or that the Service will meet Customer's requirements, operate in combination with third-party services used by Customer or maintain Customer Content without loss. Miro is not liable for delays, failures or problems inherent in use of the Internet and electronic communications or other systems outside Miro's control. Customer may have other statutory rights, but any statutorily required warranties will be limited to the shortest legally permitted period.
·This Agreement starts on the Effective Date and continues until 90 days after expiration or termination of all Subscription Terms.
·Either party may terminate this Agreement (including all Orders) if the other party (a) fails to cure a material breach of this Agreement (including a failure to pay fees) within 30 days after notice, (b) ceases operation without a successor or (c) seeks protection under a bankruptcy, receivership, trust deed, creditors' arrangement, composition or comparable proceeding, or if such a proceeding is instituted against that party and not dismissed within 60 days.
·Either party may terminate this Agreement (including all Orders) at any time for any reason upon 90 days' notice to the other party, provided (i) Customer will not be entitled to a refund of any pre-paid fees and (ii) if Customer has not already paid all applicable fees for the then-current Subscription Term, any such fees that are outstanding will become immediately due and payable.
·Upon expiration or termination of this Agreement or an Order, Customer's access to the Service and Technical Services will cease, other than limited use of the Service to export Customer Content as described in Section 4.4 (Data Export). At the disclosing party's request upon expiration or termination of this Agreement, the receiving party will delete all of the disclosing party's Confidential Information (excluding Customer Content, which is addressed in Section 4.4). Customer Content and other Confidential Information may be retained in the receiving party's standard backups after deletion but will remain subject to this Agreement's confidentiality restrictions.
·These Sections survive expiration or termination of this Agreement: 2.9 (Restrictions), 4.4 (Data Export), 5 (Customer Obligations), 9.2 (Fees and Taxes), 10.3 (Disclaimers), 11.4 (Effect of Termination), 11.5 (Survival), 12 (Ownership), 13 (Limitations of Liability), 14 (Indemnification), 15 (Confidentiality), 16 (Required Disclosures), 20 (General Terms) and 21 (Definitions). Except where an exclusive remedy is provided, exercising a remedy under this Agreement, including termination, does not limit other remedies a party may have.
·Neither party grants the other any rights or licenses not expressly set out in this Agreement. Except for Miro's use rights in this Agreement, between the parties Customer retains all intellectual property and other rights in Customer Content and Customer Materials provided to Miro. Except for Customer's use rights in this Agreement, Miro and its licensors retain all intellectual property and other rights in the Service, any Technical Services deliverables and related Miro technology, templates, formats and dashboards, including any modifications or improvements to these items made by Miro. Miro may generate and use Usage Data to operate, improve, analyze and support the Service and for other lawful business purposes. If Customer provides Miro with feedback or suggestions regarding the Service or other Miro offerings, Miro may use the feedback or suggestions without restriction or obligation.
·The disclaimer in this Section 13.1 (Consequential Damages Waiver) will not apply to the extent prohibited by Laws. Except for Excluded Claims, neither party (nor its suppliers) will have any liability arising out of or related to this Agreement for any loss of use, lost data, lost profits, failure of security mechanisms, revenues, goodwill, interruption of business or any indirect, special, incidental, reliance or consequential damages of any kind, even if informed of their possibility in advance.
·Except for Excluded Claims, each party's (and its suppliers') entire liability arising out of or related to this Agreement will not exceed in aggregate the amounts paid or payable by Customer to Miro during the prior 12 months under this Agreement.
·"Excluded Claims" means: (a) Customer's breach of Sections 2.9 (Restrictions) or 5 (Customer Obligations), (b) either party's breach of Section 15 (Confidentiality) (but excluding claims relating to Customer Content), (c) amounts payable to third parties under Customer's obligations in Section 14.2 (Indemnification by Customer), (d) either party's willful misconduct or (e) Miro's performance of the Service that results in death, personal injury or damage to tangible property.
·The waivers and limitations in this Section 13 apply regardless of the form of action, whether in contract, tort (including negligence), strict liability or otherwise and will survive and apply even if any limited remedy in this Agreement fails of its essential purpose.
·Miro will defend Customer from and against any third-party claim to the extent alleging that the Service, when used by Customer as authorized in this Agreement, infringes a third party's patent, copyright, trademark or trade secret, and will indemnify and hold harmless Customer against any damages or costs awarded against Customer (including reasonable attorneys' fees) or agreed in settlement by Miro resulting from the claim.
·Customer will defend Miro from and against any third-party claim to the extent resulting from Customer Content, Customer Materials or Customer's breach or alleged breach of Section 5 (Customer Obligations), and will indemnify and hold harmless Miro against any damages or costs awarded against Miro (including reasonable attorneys' fees) or agreed in settlement by Customer resulting from the claim.
·The indemnifying party's obligations in this Section 14 are subject to receiving (a) prompt notice of the claim, (b) the exclusive right to control and direct the investigation, defense and settlement of the claim and (c) all reasonably necessary cooperation of the indemnified party, at the indemnifying party's expense for reasonable out-of-pocket costs. The indemnifying party may not settle any claim without the indemnified party's prior consent if settlement would require the indemnified party to admit fault or take or refrain from taking any action (other than relating to use of the Service, when Miro is the indemnifying party). The indemnified party may participate in a claim with its own counsel at its own expense.
·In response to an actual or potential infringement claim, if required by settlement or injunction or as Miro determines necessary to avoid material liability, Miro may at its option: (a) procure rights for Customer's continued use of the Service, (b) replace or modify the allegedly infringing portion of the Service to avoid infringement without reducing the Service's overall functionality or (c) terminate the affected Order and refund to Customer any pre-paid, unused fees for the terminated portion of the Subscription Term. Miro's obligations in this Section 14 do not apply (1) to the extent infringement results from Customer's modification of the Service or use of the Service in combination with items not specified in the Documentation or provided by Miro (including Third-Party Platforms), (2) to infringement resulting from Software other than the most recent release provided by Miro, (3) to unauthorized use of the Service, (4) if Customer settles or makes any admissions about a claim without Miro's prior consent, (5) if Customer continues to use the Service (or any element thereof) after being notified of allegedly infringing activity or informed of modifications that would have avoided the alleged infringement or (6) to Trials and Betas or other free or evaluation use. This Section 14 sets out Customer's exclusive remedy and Miro's entire liability regarding infringement of third-party intellectual property rights.
·"Confidential Information" means information disclosed to the receiving party under this Agreement that is designated by the disclosing party as proprietary or confidential or that should be reasonably understood to be proprietary or confidential due to its nature and the circumstances of its disclosure. Miro's Confidential Information includes the terms and conditions of this Agreement and any technical or performance information about the Service. Customer's Confidential Information includes Customer Content.
·As receiving party, each party will (a) hold Confidential Information in confidence and not disclose it to third parties except as permitted in this Agreement, including Section 4.1 (Data Use), and (b) only use Confidential Information to fulfill its obligations and exercise its rights in this Agreement. The receiving party may disclose Confidential Information to its employees, agents, contractors and other representatives having a legitimate need to know (including, for Miro, the subcontractors referenced in Section 20.9), provided it remains responsible for their compliance with this Section 15 and they are bound to confidentiality obligations no less protective than this Section 15.
·These confidentiality obligations do not apply to information that the receiving party can document (a) is or becomes public knowledge through no fault of the receiving party, (b) it rightfully knew or possessed prior to receipt under this Agreement, (c) it rightfully received from a third party without breach of confidentiality obligations or (d) it independently developed without using the disclosing party's Confidential Information.
·Unauthorized use or disclosure of Confidential Information may cause substantial harm for which damages alone are an insufficient remedy. Each party may seek appropriate equitable relief, in addition to other available remedies, for breach or threatened breach of this Section 15.
·Nothing in this Agreement prohibits either party from making disclosures, including of Customer Content and other Confidential Information, if required by Law, subpoena or court order, provided (if permitted by Law) it notifies the other party in advance and cooperates in any effort to obtain confidential treatment.
·If Customer receives access to the Service or Service features on a free or trial basis or as an alpha, beta or early access offering ("Trials and Betas"), use is permitted only for Customer's internal evaluation during the period designated by Miro (or if not designated, 30 days). Trials and Betas are optional and either party may terminate Trials and Betas at any time for any reason. Trials and Betas may be inoperable, incomplete or include features that Miro may never release, and their features and performance information are Miro's Confidential Information. Notwithstanding anything else in this Agreement, Miro provides Trials and Betas "AS IS" with no warranty, indemnity or support and its liability for Trials and Betas will not exceed US$50.
·Neither party may publicly announce this Agreement except with the other party's prior consent or as required by Laws. However, Miro may include Customer and its trademarks in Miro's customer lists and promotional materials but will cease this use at Customer's written request.
·Miro may modify this Agreement (which may include changes to Service pricing and plans) from time to time by giving notice to Customer by email or through the Service. Unless a shorter period is specified by Miro (e.g., due to changes in the Law or exigent circumstances), modifications become effective upon renewal of Customer's current Subscription Term or entry into a new Order. If Miro specifies that the modifications to the Agreement will take effect prior to Customer's next renewal or Order and Customer notifies Miro of its objection to the modifications within 30 days after the date of such notice, Miro (at its option and as Customer's exclusive remedy) will either: (a) permit Customer to continue under the existing version of this Agreement until expiration of the then-current Subscription Term (after which time the modified Agreement will go into effect) or (b) allow Customer to terminate this Agreement and receive a refund of any pre-paid Service fees allocable to the terminated portion of the applicable Subscription Term. Customer may be required to click to accept or otherwise agree to the modified Agreement in order to continue using the Service, and, in any event, continued use of the Service after the updated version of this Agreement goes into effect will constitute Customer's acceptance of such updated version.
·Neither party may assign this Agreement without the prior consent of the other party, except that either party may assign this Agreement in connection with a merger, reorganization, acquisition or other transfer of all or substantially all its assets or voting securities. Any non-permitted assignment is void. This Agreement will bind and inure to the benefit of each party's permitted successors and assigns.
·This Agreement is governed by the laws of the State of California and the United States without regard to conflicts of laws provisions and without regard to the United Nations Convention on the International Sale of Goods. The jurisdiction and venue for actions related to this Agreement will be the state and United States federal courts located in San Francisco, California and both parties submit to the personal jurisdiction of those courts.
·The prevailing party in any action to enforce this Agreement will be entitled to recover its reasonable attorneys' fees and costs in connection with such action.
·Except as set out in this Agreement, any notice or consent under this Agreement must be in writing and will be deemed given: (a) upon receipt if by personal delivery, (b) upon receipt if by certified or registered U.S. mail (return receipt requested) or (c) one day after dispatch if by a commercial overnight delivery service. As of September 17th 2026, if to Miro, notice must be provided to RealtimeBoard Inc. dba Miro, 315 Montgomery Street, Suite 900, San Francisco, CA 94104, Attention: Legal Department. All notices to Miro must include a copy emailed to legal@miro.com. If to Customer, Miro may provide notice to the address Customer provided at registration. Either party may update its address with notice to the other party. Miro may also send operational notices to Customer by email or through the Service.
·This Agreement (which includes all Orders, the Policies and the DPA) is the parties' entire agreement regarding its subject matter and supersedes any prior or contemporaneous agreements regarding its subject matter. In this Agreement, headings are for convenience only and "including" and similar terms are to be construed without limitation. This Agreement may be executed in counterparts (including electronic copies and PDFs), each of which is deemed an original and which together form one and the same agreement.
·Except as otherwise provided herein, any amendments, modifications or supplements to this Agreement must be in writing and signed by each party's authorized representatives or, as appropriate, agreed through electronic means provided by Miro. Nonetheless, with notice to Customer, Miro may modify the Policies to reflect new features or changing practices, but the modifications will not materially decrease Miro's overall obligations during a Subscription Term. The terms in any past, contemporaneous or future Customer purchase order, business form or vendor management portal will not amend or modify this Agreement and are expressly rejected by Miro; any of these documents are for administrative purposes only and have no legal effect.
·Waivers must be signed by the waiving party's authorized representative and cannot be implied from conduct. If any provision of this Agreement is held invalid, illegal or unenforceable, it will be limited to the minimum extent necessary so the rest of this Agreement remains in effect.
·Neither party is liable for any delay or failure to perform any obligation under this Agreement (except for a failure to pay fees) due to events beyond its reasonable control, such as a strike, blockade, war, act of terrorism, riot, Internet or utility failures, refusal of government license or natural disaster.
·Miro may use subcontractors and permit them to exercise Miro's rights, but Miro remains responsible for their compliance with this Agreement and for its overall performance under this Agreement.
·The parties are independent contractors, not agents, partners or joint venturers.
·Customer agrees to comply with all relevant U.S. and foreign export and import Laws in using the Service. Customer (a) represents and warrants that it is not listed on any U.S. government list of prohibited or restricted parties or located in (or a national of) a country that is subject to a U.S. government embargo or that has been designated by the U.S. government as a "terrorist supporting" country, (b) agrees not to access or use the Service in violation of any U.S. export embargo, prohibition or restriction and (c) will not submit to the Service any information controlled under the U.S. International Traffic in Arms Regulations.
·The Software may incorporate third-party open source software ("OSS"), as listed in the Documentation or by Miro upon request. To the extent required by the OSS license, that license will apply to the OSS on a stand-alone basis instead of this Agreement.
·Elements of the Service are commercial computer software. If the user or licensee of the Service is an agency, department, or other entity of the United States Government, the use, duplication, reproduction, release, modification, disclosure, or transfer of the Service or any related documentation of any kind, including technical data and manuals, is restricted by the terms of this Agreement in accordance with Federal Acquisition Regulation 12.212 for civilian purposes and Defense Federal Acquisition Regulation Supplement 227.7202 for military purposes. The Service was developed fully at private expense. All other use is prohibited.
·This Section applies to any access to the Service purchased by Customer through a Reseller. (a) Commercial Terms. Instead of paying Miro, Customer will pay applicable amounts to the Reseller as agreed between Customer and the Reseller. Customer's order details (e.g., scope of use and fees) will be as stated in the Order placed by the Reseller with Miro on Customer's behalf. The Reseller is responsible for the accuracy of such Order. Miro may suspend or terminate Customer's rights to use the Service if it does not receive the corresponding payment from the Reseller. If Customer is entitled to a refund under this Agreement, Miro will refund any applicable fees to the Reseller and the Reseller will be solely responsible for refunding the appropriate amounts to Customer, unless otherwise specified. (b) Relationship with Miro. This Agreement is directly between Miro and Customer and governs all use of the Service by Customer. Resellers are not authorized to modify this Agreement or make any promises or commitments on Miro's behalf, and Miro is not bound by any obligations to Customer other than as set forth in this Agreement. Miro is not party to (or responsible under) any separate agreement between Customer and Reseller and is not responsible for the Reseller's acts, omissions, products or services. The amount paid or payable by the Reseller to Miro for Customer's use of the applicable Service under this Agreement will be deemed the amount paid or payable by Customer to Miro under this Agreement for purposes of Section 13 (Limitations of Liability).
·"Affiliate" means an entity that, directly or indirectly, owns or controls, is owned or controlled by, or is under common ownership or control with a party, where "ownership" means the beneficial ownership of fifty percent (50%) or more of an entity's voting equity securities or other equivalent voting interests and "control" means the power to direct the management or affairs of an entity.
·"Board" means an online virtual whiteboard or other element of the Service displaying Customer Content.
·"Customer Content" means any data, content or materials that Customer (including its Users) creates within or submits to the Service, including from Third-Party Platforms.
·"Customer Materials" means materials, systems and other resources that Customer provides to Miro in connection with Technical Services.
·"DPA" means the Data Processing Addendum between the parties, the current version of which is here.
·"Documentation" means Miro's usage guidelines and standard technical documentation for the Service, the current version of which is here.
·"High Risk Activities" means activities where use or failure of the Service could lead to death, personal injury or environmental damage, including life support systems, emergency services, nuclear facilities, autonomous vehicles or air traffic control.
·"Laws" means all relevant local, state, federal and international laws, regulations and conventions, including those related to data privacy and data transfer, international communications and export of technical or personal data.
·"Order" means any Miro-provided ordering document, online registration, order description or order confirmation referencing this Agreement.
·"Policies" means the Privacy Policy, Security Policy and Support Policy.
·"Privacy Policy" means the Privacy Policy, the current version of which is here.
·"Prohibited Data" means any (a) special categories of data enumerated in European Union Regulation 2016/679, Article 9(1) or any successor legislation, (b) patient, medical or other protected health information regulated by the Health Insurance Portability and Accountability Act (as amended and supplemented) ("HIPAA"), (c) credit, debit or other payment card data subject to the Payment Card Industry Data Security Standards (PCI DSS), (d) other information subject to regulation or protection under specific Laws such as the Children's Online Privacy Protection Act or Gramm-Leach-Bliley Act (or related rules or regulations), (e) social security numbers, driver's license numbers or other government ID numbers or (f) any data similar to the above protected under foreign or domestic Laws.
·"Security Policy" means the Miro Security Policy, the current version of which is here.
·"Service" means Miro's proprietary cloud service, as identified in the relevant Order and as modified from time to time. The Service includes the Software and Documentation but does not include Technical Services deliverables or Third-Party Platforms.
·"Software" means any Miro client software, scripts, apps or other code provided to Customer by Miro for use with the Service.
·"Subscription Term" means the term for Customer's use of the Service as identified in an Order.
·"Support" means support for the Service as described in the Support Policy. Customer's Support level will be identified in its Order.
·"Support Policy" means the Miro Support Policy, the current version of which is here.
·"Technical Services" means any training, enablement or other technical services provided by Miro related to the Service, as identified in an Order.
·"Third-Party Platform" means any platform, add-on, service, product, app or integration not provided by Miro that Customer elects to integrate or enable for use with the Service.
·"Usage Data" means Miro's technical logs, data and learnings about Customer's use of the Service, but excluding Customer Content.
·"User" means any individual that Customer or its Affiliate permits or invites to use the Service, as further described in the Documentation.
4,418 words, 106 clausesupdated September 17, 2024read 11/10/2026source
·For the previous version of the Customer Data Processing Addendum click here.
·This Customer Data Processing Addendum ("DPA") is entered into between RealtimeBoard, Inc., dba Miro ("Miro" or "data importer") and the entity identified as the Customer ("Customer" or "data exporter") and is appended to either (i) the Miro Master Cloud Agreement or Terms of Service (as applicable); or (ii) other electronic or written agreement incorporating this DPA, governing the Customer's access and use of the Miro platform and related services (the "Agreement"). Capitalized terms used but not defined in this DPA shall take the meanings assigned to such terms in the Agreement.
·The parties agree that this DPA shall be incorporated into and form part of the Agreement and subject to the provisions therein.
·If Customer makes any deletions or revisions to this DPA, those deletions or revisions are hereby rejected and invalid, unless agreed by Miro. Customer's signatory represents and warrants that they have the authority to bind the Customer to this DPA.
·"Applicable Privacy Law(s)" means any data protection and privacy laws and regulations, including Data Protection Law, applicable to Miro's processing of Customer Personal Data.
·"Customer Personal Data" means any Customer Content that is Personal Data and/or Personal Information as defined and protected by Applicable Privacy Law(s).
·"Data Privacy Framework" or "DPF" means the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework, and the UK Extension to the EU-US Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce, as may be amended, superseded, or replaced from time to time.
·"Data Privacy Framework Principles" or "DPF Principles" means the Data Privacy Framework Principles and Supplemental Principles contained in the relevant Data Privacy Framework, as may be amended, superseded, or replaced from time to time.
·"Data Protection Law" means: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the Processing of Personal Data and on the free movement of such data (General Data Protection Regulation) (the "EU GDPR"); (ii) the GDPR as saved into United Kingdom law by virtue of section 3 of the United Kingdom's European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018 (collectively the "UK GDPR"); (iii) the EU e-Privacy Directive (Directive 2002/58/EC); (iv) the Swiss Federal Data Protection Act ("Swiss DPA"), and (v) any and all applicable national data protection laws made under, pursuant to or that apply in conjunction with any of (i), (ii) (iii) or (iv); in each case as may be amended or superseded from time to time;
·"Miro Subsidiary" means any entity that is directly or indirectly controlled by, controlling or under common control with Miro.
·"Restricted Transfer" means: (i) where the EU GDPR applies, a transfer of Personal Data from the EEA to a country outside of the EEA which is not subject to an adequacy determination by the European Commission; (ii) where the UK GDPR applies, a transfer of Personal Data from the United Kingdom to any other country which is not subject to adequacy regulations pursuant to Section 17A of the United Kingdom Data Protection Act 2018; and (iii) where the Swiss DPA applies, a transfer of Personal Data from Switzerland to any other country which is not determined to provide adequate protection for Personal Data by the Federal Data Protection and Information Commission or Federal Council (as applicable).
·"Standard Contractual Clauses" means: (i) where the EU GDPR or the Swiss DPA applies, the contractual clauses annexed to the European Commission's Implementing Decision (EU) 2021/914 of 4 June 2021 ("EU SCCs"); and (ii) where the UK GDPR applies, standard data protection clauses for processors adopted pursuant to Article 46(2)(c) or (d) of the UK GDPR (specifically, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses) ("UK SCCs"), as applicable in accordance with Section 8 (Data Transfers).
·"Security Incident" means any unauthorized or unlawful breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to Customer Personal Data. A "Security Incident" shall not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.
·"Subprocessor" means any Processor engaged by Miro to process Customer Personal Data.
·The terms "Business," "Controller," "data subject." "Personal Data," "Personal Information," "Processor," "process(ing)," "Sale," "Sell," "Service Provider," and "Share" have the meanings given to them in Applicable Privacy Law(s). If and to the extent that Applicable Privacy Law(s) do not define such terms, then the definitions given in Data Protection Law will apply.
2.12.1 The parties acknowledge that regarding the processing of Customer Personal Data, Customer shall be the Controller and Miro shall process Customer Personal Data as a Processor on behalf of Customer.
2.22.2 Miro will process Customer Personal Data only in accordance with Customer's documented instructions and will not process Customer Personal Data for its own purposes, except as set out in the Agreement and this DPA or where required by applicable law(s). The Agreement, including this DPA, along with Customer's configuration of any settings or options in the Services (as Customer may be able to modify from time to time), constitute Customer's complete and final instructions to Miro regarding the Processing of Customer Personal Data, including for purposes of the Standard Contractual Clauses, as may be applicable. Additional Processing instructions (if any) require prior written agreement between the parties.
2.32.3 Each party shall comply with its obligations under Applicable Privacy Law(s) in respect of any Customer Personal Data. Without prejudice to the foregoing, Customer is responsible for determining whether the Services are appropriate for the storage and processing of Customer Personal Data under Applicable Privacy Law(s) and for the accuracy, quality and legality of the Customer Personal Data and the means by which it acquired Customer Personal Data. Customer further agrees that it has provided notice and obtained all consents, permissions and rights necessary for Miro and its Sub-processors to lawfully process Customer Personal Data for the purposes contemplated by the Agreement (including this DPA).
2.42.4 Miro shall promptly notify Customer if it makes a determination that Customer's instructions infringe Applicable Privacy Law(s) (but without obligation to actively monitor Customer's compliance with Applicable Privacy Law(s) and in such event, Miro shall not be obligated to undertake such Processing until such time as the Customer has updated its processing instructions and Miro has determined that the incidence of non-compliance has been resolved.
2.52.5 Details of Data Processing:
2.5.12.5.1 Subject matter: The subject matter of the data processing under this DPA is the Customer Personal Data.
2.5.22.5.2 Duration: As between Customer and Miro, the duration of the processing is the term of the Agreement plus any period after the termination or expiry of the Agreement during which Miro will process Customer Personal Data in accordance with the Agreement.
2.5.32.5.3 Purpose: Miro will process Customer Personal Data as necessary to perform the Services pursuant to the Agreement, as further instructed by Customer in its use of the Services.
2.5.42.5.4 Nature of the processing: The provision of the Services as described in the Agreement and initiated by the Customer from time to time.
2.5.52.5.5 Types of Customer Personal Data: Any Customer Personal Data submitted to the Services under Customer's Miro account.
2.5.62.5.6 Categories of data subjects: The data subjects could include Customer's employees, consultants, agents and third parties authorized to access and use the Services as Users under Customer's Miro account and any other data subjects whose Customer Personal Data is submitted to Miro by Customer and/or its Users through the Services.
3.13.1 Customer grants Miro a general authorization to subcontract the processing of Customer Personal Data to Subprocessors, including those listed at: https://miro.com/static/legal/Miro-Current-Subprocessors-List.pdf (or such other successor URL) ("Subprocessor List").
3.23.2 If Miro engages a new or replacement Subproccessor, Miro will:
3.2.13.2.1 update the Subprocessor List;
3.2.23.2.2 impose substantially the same data protection terms on any Subprocessor it engages as contained in this DPA (including data transfer provisions, where applicable); and
3.2.33.2.3 remain liable to Customer for any breach of this DPA caused by an act, error or omission of such Subprocessor.
3.33.3 If Customer elects to be notified at least ten (10) days prior to Miro engaging a new or replacement Subprocessor, Customer must subscribe to such notifications here;
3.43.4 Customer may object to Miro's appointment of any new or replacement Subprocessor promptly in writing within thirty (30) days after receipt of notice in accordance with (3.2.1) and on reasonable grounds related to Subprocessor's ability to comply with Applicable Privacy Law(s). In such a case, the parties shall discuss Customer ́s concerns in good faith with a view to achieving a commercially reasonable resolution. If the parties cannot reach such resolution, Miro shall have the right, at its sole discretion, to either not appoint the disputed Subprocessor, or permit Customer to suspend or terminate the applicable Order and/or the Agreement. These procedures are Customer's exclusive remedy and Miro's entire liability for resolving Customer's objections to Miro's appointment of Subprocessor's under this DPA.
4.14.1 Miro shall reasonably cooperate with Customer to enable Customer to respond to any requests, complaints or other communications from data subjects and regulatory or judicial bodies relating to the processing of Customer Personal Data, including requests from data subjects seeking to exercise their rights under Applicable Privacy Law(s). In the event that any such request, complaint or communication is made directly to Miro, Miro shall, once it has identified the request is from or related to a data subject for whom the Customer is responsible, pass this onto Customer and shall not respond to such communication without Customer's express authorization (unless required to do so in order to comply with applicable law(s)).
4.24.2 To the extent Miro is required under Applicable Privacy Law(s), Miro will assist Customer to conduct a data protection impact assessment and, where legally required, consult with applicable data protection authorities in respect of any proposed processing activity that presents a high risk to data subjects.
4.34.3 Taking into account the nature of the processing, Customer agrees that it is unlikely that Miro would become aware that Customer Personal Data transferred under the DPF and/or Standard Contractual Clauses, as may be applicable, is inaccurate or outdated. Nonetheless, if Miro becomes aware that Customer Personal Data transferred under the DPF and/or Standard Contractual Clauses, as may be applicable, is inaccurate or outdated, it will inform Customer without undue delay. Miro will reasonably cooperate with Customer to erase or rectify inaccurate or outdated Customer Personal Data transferred hereunder.
5.15.1 Miro will ensure that any personnel tasked with the processing of Customer Personal Data are subject to an appropriate duty of confidentiality (whether a contractual or statutory duty) and that they process Customer Personal Data only for the purpose of delivering the Services.
5.25.2 Miro will implement and maintain reasonable and appropriate technical and organizational security measures with the aim of protecting Customer Personal Data from Security Incidents in accordance with the measures listed in Exhibit 2 ("Security Measures"). Customer acknowledges that the Security Measures are subject to technical progress and development and that Miro may update or modify the Security Measures from time to time, provided that such updates and modifications do not degrade or diminish overall security of the Services.
·In the event of a Security Incident, Miro shall inform Customer without undue delay and will provide written details of the Security Incident to Customer, including the type of data affected and the identity of affected person(s), once such information becomes known or available to Miro. Miro shall, to the extent possible, provide timely information and cooperation to Customer to allow Customer to fulfill its data breach reporting obligations under Applicable Privacy Law(s) and shall take reasonable steps to remedy or mitigate the effects of the Security Incident. The obligations herein shall not apply to Security Incidents that are caused by the Customer or its Users.
7.17.1 Upon request, Miro shall provide copies of any certifications, audit report summaries and/or other relevant documentation it holds, where reasonably required by Customer to verify Miro's compliance with this DPA.
7.27.2 While it is the parties' intention ordinarily to rely on Miro's obligations set forth in Section 7.1 to verify Miro's compliance with this DPA, following a confirmed Security Incident or where a data protection authority requires it, Customer may provide Miro with thirty (30) days' prior written notice requesting that a third-party conduct an audit of Miro's operations and facilities ("Audit"); provided that: (i) any Audit shall be conducted at Customer's expense; (ii) the parties shall mutually agree upon the scope, timing and duration of the Audit; (iii) the Audit shall not unreasonably impact Miro's regular operations.
7.37.3 Any written responses or Audit described in this Section 7 shall be subject to the confidentiality provisions of the Agreement. The parties agree that any audit provisions described in Clause 8.9 of EU SCCs, where applicable, shall be carried out in accordance with this Section 7 (Security Reports & Instructions).
8.18.1 Customer Personal Data that Miro processes under the Agreement may be processed in any country in which Miro, its Miro Subsidiaries and Sub-processors maintain facilities to perform the Services, as further detailed in the Subprocessor List. Miro shall not process or transfer Customer Personal Data (nor permit such data to be processed or transferred) outside of EEA, Switzerland or UK, unless it first takes such measures as are necessary to ensure the transfer is in compliance with Data Protection Law.
8.28.2 The parties agree that the DPF applies with respect to Restricted Transfers of Customer Personal Data to the US from the EEA and/or Switzerland as Miro is certified under the DPF program and complies with the DPF Principles when processing such Customer Personal Data. If Miro's certification under the DPF is revoked or otherwise invalidated, Miro shall inform Customer where applicable and upon request, take reasonable and appropriate steps to remediate any unauthorized processing by providing an Alternative Transfer Mechanism (such as Standard Contractual Clauses), as outlined in this Section.
8.38.3 The parties agree that where the DPF does not apply with respect to a Restricted Transfer, the Standard Contractual Clauses are hereby incorporated and will apply, completed with the following modifications as may be applicable:
8.3.18.3.1 Where Customer is a Controller of Customer Personal Data protected by the EU GDPR: Module 2 of the EU SCCs applies between Customer as "data exporter" (notwithstanding that the Customer may be an entity located outside the EEA) and Miro as "data importer" on the following basis: (i) in Clause 7, the optional docking clause will apply, (ii) in Clause 9, Option 2 will apply, and the time period for prior notice of Sub-Processor changes shall be as set out in this DPA, (iii) in Clause 11, the optional language shall not apply, (iv) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Dutch law, (v) in Clause 18(b), disputes shall be resolved before the courts of the Netherlands, (vi) Annex 1 to the EU SCCs will be deemed to incorporate Exhibit 1 to this DPA and (vii) Annex 2 to the EU SCCs will be deemed to incorporate Exhibit 2 of this DPA.
8.3.28.3.2 Where Customer is a Controller of Customer Personal Data protected by the Swiss DPA: Module 2 of the EU SCCs applies between Customer as "data exporter" and Miro as "data importer" on the preceding basis and additionally: (i) in Clause 13 the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commission; (ii) the term Member State must not be interpreted in such a way as to exclude Data Subjects in Switzerland from enforcing their rights in their place of habitual residence in accordance with Clause 18(c), (iii) and all references to the EU GDPR in this DPA are also deemed to refer to the Swiss DPA.
8.3.38.3.3 Where Customer is a Processor on behalf of a third party Controller of Customer Personal Data protected by the EU GDPR: Module 3 of the EU SCCs applies between Customer as "data exporter" (notwithstanding that Customer or the third party Controller may be an entity located outside the EEA) and Miro as "data importer" on the following basis: (i) in Clause 7, the optional docking clause will apply, (ii) in Clause 9, Option 2 will apply, the time period for prior notice of Sub-Processor changes shall be as set out in this DPA, and Miro shall fulfill its Sub-Processor notification obligations as set out in this DPA; (iii) in Clause 11, the optional language shall not apply, (iv) in Clause 17, Option 1 will apply, and the EU SCCs will be governed by Dutch law, (v) in Clause 18(b), disputes shall be resolved before the courts of the Netherlands, (vi) Annex 1 to the EU SCCs will be deemed to incorporate Exhibit 1 to this DPA and (vii) Annex 2 to the EU SCCs will be deemed to incorporate Exhibit 2 of this DPA.
8.3.48.3.4 Where Customer is a Processor on behalf of a third party Controller of Customer Personal Data protected by the Swiss DPA: Module 3 of the EU SCCs applies between Customer as "data exporter" and Miro as "data importer" on the preceding basis and additionally: (i) in Clause 13 the competent supervisory authority shall be the Swiss Federal Data Protection and Information Commission; (ii) the term Member State must not be interpreted in such a way as to exclude data subjects in Switzerland from enforcing their rights in their place of habitual residence in accordance with Clause 18(c), (iii) and all references to the EU GDPR in this DPA are also deemed to refer to the Swiss DPA.
8.3.58.3.5 Where Customer is a Controller or Processor of Customer Personal Data protected by the UK GDPR, the EU SCCs apply, completed with the following modifications, as may be applicable: each party will be deemed to have signed the "UK Addendum to the EU Standard Contractual Clauses" ("UK Addendum") issued by the Information Commissioner's Office under Section 119 A of the United Kingdom Data Protection Act 2018, (ii) the EU SCCs shall be deemed amended as specified by the UK Addendum in respect of the transfer of Customer Personal Data, (iii) in Table 1 of the UK Addendum, the parties' contact information is located in Exhibit 1 of this Addendum, (iv) in Table 2 of the UK Addendum, information on the Standard Contractual Clauses, modules and selected clauses is located in Section 8.3 above, (v) Table 3 of the UK Addendum shall be deemed completed with the information set out at Exhibits 1 & 2 of this Addendum, and (vi) in Table 4 of the UK Addendum, either party may end the UK Addendum in accordance with its terms and the respective box for each is deemed checked ("UK SCCs").
8.48.4 If Miro adopts an alternative lawful data export mechanism for the transfer of Customer Personal Data not described in this DPA ("Alternative Transfer Mechanism"), the Alternative Transfer Mechanism shall apply instead of any applicable transfer mechanism described in this DPA (but only to the extent such Alternative Transfer Mechanism complies with Data Protection Law and extends to the territories to which the relevant Customer Personal Data is transferred).
·Upon Customer's request during the Agreement Subscription Term and/or at termination or expiry of this DPA, Miro shall delete or return to Customer all Customer Personal Data in its possession in accordance with Miro's then-current data deletion timelines and policies, which may be requested by Customer at any time. This requirement shall not apply to the extent that Miro is required by any applicable law to retain some or all of the Customer Personal Data, or to Customer Personal Data archived on back-up systems, which data Miro shall isolate and protect from any further processing except to the extent required by such law. The parties agree that confirmation of the deletion of Customer Personal Data shall be provided by Miro to Customer upon Customer's written request.
·To the extent that Miro processes Customer Personal Data of Users who are residents of the US state of California, the parties agree as follows:
10.110.1 Customer is a Business and Miro is a Service Provider. Customer's transfer of Customer Personal Data to Miro is not a Sale, and Miro provides no monetary or other valuable consideration to Customer in exchange for Customer Personal Data. Miro processes Customer Personal Data solely as a Service Provider on Customer's behalf for one or more business purposes as described in the Agreement or as otherwise permitted of Service Providers under Applicable Privacy Laws.
10.210.2 Miro shall not "Sell" or "Share" Customer Personal Data and Miro agrees to comply with all applicable requirements of the CCPA as modified by the CPRA, and if and to the extent agreed between Customer and Miro in writing as set forth in this DPA.
10.310.3 As applicable to the Services, Miro shall reasonably assist Customer in responding (at Customer's expense) to any request from a data subject (including "verifiable consumer requests", as such term is defined in the CCPA), relating to the processing of Customer Personal Data under the Agreement.
11.111.1 Except for the changes made by this DPA, the Agreement remains unchanged and in full force and effect. If there is any conflict between any provision in this DPA and any provision in the Agreement, this DPA prevails. With effect from the effective date, this DPA is part of, and incorporated into the Agreement.
11.211.2 In no event does this DPA restrict or limit the rights of any data subject or of any competent supervisory authority.
11.311.3 Any claim or remedy Customer may have against Miro, its employees, agents and Subprocessors, arising under or in connection with this DPA, whether in contract, tort (including negligence) or under any other theory of liability, shall to the maximum extent permitted by law be subject to the limitations and exclusions of liability in the Agreement. Accordingly, any reference in the Agreement to the liability of a party means the aggregate liability of that party under and in connection with the Agreement and this DPA together.
11.411.4 This DPA shall be governed by and construed in accordance with the governing law and jurisdiction provisions in the Agreement, unless required otherwise by Applicable Privacy Law(s).
11.511.5 If any part of this DPA is held unenforceable, the validity of all remaining parts will not be affected.
·Data exporter(s):
·Data importer(s):
·The Customer's competent supervisory authority will be determined in accordance with the Data Protection Law.
·TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA
·Description of the technical and organizational measures implemented by the data importer(s) (including any relevant certifications) to ensure an appropriate level of security, taking into account the nature, scope, context and purpose of the processing, and the risks for the rights and freedoms of natural persons:
·Miro uses reasonable technical and organizational measures designed to protect the Service and Customer Content as described in the Security Policy.
·For transfers to (sub-) processors, also describe the specific technical and organizational measures to be taken by the (sub-) processor to be able to provide assistance to the controller and, for transfers from a processor to a sub-processor, to the data exporter:
·The technical and organizational measures taken by the data importer to assist the data exporter in fulfilling its obligations to respond to data subjects' requests for the exercise of their rights under Regulation (EU) 2016/679 are set out in Section 4 (Cooperation) of the DPA.