Data Processing Agreement

This is a template, not an agreement in force. There is no legal entity behind this platform today, so there is no processor able to sign it. It is published so a prospective customer can read the terms before asking for them, and so what is offered is on the record rather than drafted under time pressure. Nothing below binds anyone until an entity signs it.

What this is

The clauses follow the shape of the European Commission’s standard contractual clauses for processors (Article 28(7) GDPR, Decision 2021/915), so that a customer’s legal reviewer meets a familiar structure. Bracketed fields are filled in per customer. The annexes are written from what the code enforces rather than from a template’s wish list, which is what makes them checkable.

Parties

Between [Customer legal name, address, registration] (the Controller) and [Processor legal name, address, registration] (the Processor), together the Parties.

1. Subject matter and duration

The Processor provides the Bonacchi Platform (the Service), a multi-tenant business application, to the Controller under the Terms of Use. This Agreement governs the processing of personal data the Controller and its users put into the Service, for as long as the Controller holds a workspace and for the deletion period in clause 9.

2. Nature and purpose

Storage, retrieval, display, computation and transmission of the data described in Annex 1, for the purpose of operating the modules the Controller has enabled. The Processor does not use the data for any other purpose, including training any model.

3. Instructions

The Processor processes personal data only on the Controller’s documented instructions. Enabling a module, configuring a connector, or invoking an AI feature in the Service constitutes an instruction. The Processor informs the Controller if an instruction infringes data protection law.

4. Confidentiality

Persons authorised by the Processor to process the data are bound by confidentiality. Today that is the operator alone.

5. Security

The Processor implements the measures in Annex 2 and reviews them at least annually. Those measures are described from what is enforced in the codebase, not from intent.

6. Sub-processors

The Controller gives general authorisation to the sub-processors in Annex 3. The Processor gives at least 30 days’ written notice before adding or replacing one; the Controller may object on reasonable grounds and, if no solution is found, may terminate the affected part of the Service. The Processor remains liable for its sub-processors.

7. Data subject rights

The Processor assists the Controller with requests under Articles 15 to 22 GDPR through the Service’s own export and deletion functions, and where those do not suffice, within 10 working days of a written request.

8. Personal data breach

The Processor notifies the Controller without undue delay and in any case within 48 hours of becoming aware of a breach affecting the Controller’s data, with the information Article 33(3) requires as it becomes available.

9. Deletion and return

On termination the Controller may export its data through the Service. The Processor deletes the Controller’s personal data within 30 days of termination, and backups on their own rotation as described in Annex 2, unless EU or Member State law requires retention.

10. Audit

The Processor makes available the information necessary to demonstrate compliance: this Agreement, the security measures, the published sub-processor list, and on request the outputs of the Service’s own security gates. On-site audits are limited to once a year, on 30 days’ notice, at the Controller’s cost, unless a supervisory authority requires otherwise.

11. International transfers

Personal data is stored in the European Union. Transfers to sub-processors outside the European Economic Area rely on the mechanisms named per sub-processor in Annex 3.

12. Liability

Liability follows the Terms of Use. A cap is a commercial term and is deliberately not fixed in this template.

13. Precedence

In case of conflict, this Agreement prevails over the Terms of Use on matters of personal data.

Annex 1 — Description of processing

Data subjects are the Controller’s own members and the people its workspace holds records about — staff, candidates, clients and their contacts. Categories are the fields of the modules the Controller enables, reproduced per customer with those modules ticked. No special categories are intended; free-text fields may incidentally contain them and are covered by the retention rules in Annex 2.

Annex 2 — Technical and organisational measures

Written from what the repository enforces, with the mechanism named, so the annex can be checked rather than believed:

• Tenant isolation by row-level security on every workspace table, evaluated in the database rather than in application code, with behavioural SQL suites asserting it on every change.
• Encryption in transit throughout, and at rest on managed disks; third-party credentials held in a vault rather than in table columns.
• Access control per workspace by role and capability; administrative acts audited; API keys hashed, scoped and rate-limited; magic-link and OAuth sign-in, with a workspace able to require a particular sign-in provider.
• Application security: a per-request Content-Security-Policy with nonces, dependency scanning daily, static analysis on every change, and build actions pinned to commit digests.
• AI processing: prompts and responses are summarised rather than stored verbatim; retention is capped at one year and can be set shorter per workspace; output from external tools is fenced against prompt injection; every provider a workspace’s data can reach is a declared sub-processor, enforced by a build gate.
• Retention and erasure: automated sweeps, plus export and deletion endpoints that are under test.
• Backups: a logical dump taken weekly, encrypted, kept 28 days, and restore-tested on every run rather than assumed — the drill restores it into a throwaway database and counts the tables.
• Monitoring: error tracking with alert rules on every project, and uptime probes on every public host.
• Change control: no change reaches production without passing the gates above; the gate suite and its results are available to the Controller on request.

Backups are weekly, not daily, and there is no point-in-time recovery. The recovery point objective is therefore one week. This is stated rather than softened because a data processing agreement claiming "daily automated backups" would be claiming something this platform does not do.

Annex 3 — Authorised sub-processors

For each: the entity, where it is, what it does, and whether it receives data unconditionally or only after the Controller turns something on. This is the same list the privacy notice renders, from the same source, so the annex a customer signs and the notice their users read cannot name different vendors.

• Vercel — hosting and delivery of the websites and their server functions, request logs, and analytics where consented.
• Supabase — database, authentication, file storage and edge functions.
• Anthropic — the AI features inside the platform (only when the workspace enables the AI features).
• OpenAI — search indexing (embeddings) of workspace content; the stand-in that serves AI requests when the primary provider is unavailable — only where the AI features are enabled; and, where the operator has enabled it and a member opens one, a real-time voice session in which that member’s speech is processed as audio.
• Google — sign-in with a Google account (OAuth), and the Google Workspace connector when a workspace connects it.
• Freshservice — creation of IT onboarding tickets from the staffing module (only when the workspace configures the Freshservice connector).
• Resend — delivery of transactional e-mail: invitations, verification and notification messages, and digests.
• Twilio — delivery of text messages: the recipient’s phone number and the message body (only when the workspace enables the SMS channel).
• Sentry — error reports from the applications and the edge functions: the failing request’s URL and metadata, and whatever an error message or stack trace carries.
• Stripe — subscription checkout, invoices and payment details for a paid plan (only when the workspace subscribes to a paid plan).

Status, review and contact

No lawyer has reviewed this text, and no supervisory authority has approved it. It is drafted to be accurate about the system, which is the half an engineer can get right, and it will be reviewed before any first signature. Questions, and requests to negotiate it, go to pbonacchi@gmail.com.