Data processing agreement

1 The parties and their roles

You, the business that signs up, are the controller of the personal data in your instance. We, Krisztián Tóth (IČO 14273799, details in the Legal notice), are your processor. For your account and billing data (who signed up, invoices) we are a controller ourselves; the privacy page covers that.

2 What we process

The personal data you and your users put into your instance, and the data your instance records about its users (names, e-mail addresses, sign-ins, changes made). Annex I lists it.

3 Your instructions

We process the data only to run your instance as the terms describe, and otherwise only on your documented instructions, which include what you and your users do in the instance. If the law requires us to process it otherwise, we tell you first unless the law forbids it. If we think an instruction breaks data protection law, we tell you.

4 Confidentiality

We do not read your records except when you ask us to help, or when it is needed to fix a fault, and then only what is needed. Anyone who works on the service for us is bound to confidentiality.

5 Security

We protect the data with the measures in Annex II and keep them at least at that level. We may improve them; we do not weaken them.

6 Sub-processors

You allow us to use the sub-processors in Annex III. We e-mail the administrator 30 days before we add or replace one. You may object, with a reason, within those 30 days; if we cannot meet the objection, you may end the contract before the change, and we refund what you paid for the time after it. Each sub-processor is bound by data protection terms that give at least the protection of this agreement. We remain responsible to you for them.

7 Transfers outside the EU

Your data is stored in the EU. Some sub-processors may access or handle it outside the EU (Annex III says which); each such transfer is covered by an adequacy decision (for the US, the EU-U.S. Data Privacy Framework) or by the European Commission's standard contractual clauses. If you are outside the EU, the standard contractual clauses of module 4 (processor to controller) apply between us where the GDPR requires them.

8 Helping you

We help you, as far as we reasonably can, to answer the people whose data it is (access, correction, deletion and the other rights), mostly through the instance itself, and with your security, breach notices, impact assessments and prior consultations (GDPR Articles 32 to 36). If a person asks us directly, we pass the request to you and do not answer it ourselves.

9 Breaches

If we become aware of a breach of the security of your data, we tell you without undue delay and within 48 hours, with what we know: what happened, which data and people, what it may lead to and what we are doing about it. We send what we learn later as we learn it.

10 Checks and audits

We give you the information you need to show that this agreement is kept, and answer your questions. Once a year, with 30 days' notice, you or an auditor bound to confidentiality may inspect how we process your data, at your cost, in a way that does not reach other customers' data or harm the service.

11 At the end

When the contract ends, your instance stays suspended for 14 days so you can ask for an export; then we delete it. Backups that contain it expire within 30 days after that, and nothing is restored from them. We keep no copy unless the law requires it.

12 Your own AI provider

If you turn on the instance's AI assistant, you connect it with your own key or account. Data the assistant sends then goes to your provider under your contract with it; that provider is not our sub-processor.

13 Order of documents

Where this agreement and the terms differ on personal data, this agreement applies. The terms' sections on liability, changes and law apply to it too.

Annex I — The processing

• Whose data: your users; and anyone whose data you put into your instance (for example contacts, employees or customers in your reference data).
• What data: what you put into your instance; your users' names, e-mail addresses, roles and sign-in records; the instance's history of changes; technical logs (addresses and times of requests, error messages).
• Special categories: none are needed for the service. If you put them in, you tell us, and the same measures apply.
• What we do with it: store it, back it up, restore it, upgrade the software that holds it, move it between our servers, monitor and repair the instance, and delete it.
• How long: for the contract, then as section 11 says.
• Where: the instance and its database in Sweden; backups, encrypted, in Cloudflare's EU storage.

Annex II — Security measures

• Separation: each customer has its own instance, its own database and database role (which cannot open another customer's database), its own network, files and encryption keys.
• In transit: HTTPS from your browser to Cloudflare and from Cloudflare to our server (a verified certificate); the server accepts web traffic from Cloudflare only.
• Backups: every night, encrypted on the server before they leave it, to keys the servers do not hold; kept 7 days daily and 4 weeks weekly; locked against deletion and overwriting within those periods; a restore is tried every week.
• Access: only the maintainer reaches the servers, with SSH keys; the operations console needs a passkey behind Cloudflare Access. Automated repairs act only through a fixed command set, and anything that cannot be undone waits for the maintainer's approval.
• Updates: the servers install security updates automatically; refiroo is upgraded in rings, with a backup first and an automatic return to the old version if the new one fails.
• Inside the instance: refiroo's own roles and permissions, its record of every change, and passwords stored only as hashes.
• Logs: limited in size on each server and overwritten as they fill.

Annex III — Sub-processors