Enterprise and business customers may have additional data protection rights and obligations governed by a separate Customer Data Processing Addendum (DPA), which operates alongside but may supersede certain provisions of the standard Privacy Policy.
This analysis describes what Miro's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
The existence of a separate DPA means that individual and free-tier users may have fewer contractual data protections than enterprise customers who have negotiated or accepted a formal DPA.
Interpretive note: The specific provisions of the DPA are not reproduced in the truncated document; analysis is based on the document's reference to a separate Customer Data Processing Addendum.
If you use Miro through a business or enterprise account, your data protections may be determined by the DPA your employer has agreed to, not the public Privacy Policy alone. Individual users on free plans rely primarily on the standard Privacy Policy without the enhanced protections a DPA may provide.
How other platforms handle this
to request that your data be transferred to a third party (data portability)
Your organization may allow you to access and export your data in order to back it up or transfer it to a service outside of Google.
Further, you may take legal actions in relation to any potential breach of your rights regarding the processing of your Personal Information, as well as to lodge complaints before the competent data prot...
(1) REGULATORY LANDSCAPE: The DPA structure is designed to satisfy GDPR Article 28 requirements for controller-processor agreements, and equivalent requirements under UK GDPR and CCPA for service provider designations.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
The existence of a separate DPA means that individual and free-tier users may have fewer contractual data protections than enterprise customers who have negotiated or accepted a formal DPA.
If you use Miro through a business or enterprise account, your data protections may be determined by the DPA your employer has agreed to, not the public Privacy Policy alone. Individual users on free plans rely primarily on the standard Privacy Policy without the enhanced protections a DPA may provide.
ConductAtlas has identified this type of provision across 290 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Miro.