Data Processing Agreement

1. Parties and definitions

This DPA is between:

• the Customer: the organisation or person that has agreed to the Terms and owns one or more Deckbell workspaces, acting as controller; and
• Symprox Solutions MMC, a limited liability company registered in the Republic of Azerbaijan (VÖEN 1009080171), Ecemi Naxcivani 26, Baku, Azerbaijan, which operates Deckbell (“Deckbell”, “we”, “us”), acting as processor.

Data protection questions about this DPA can be sent to privacy@deckbell.com.

In this DPA:

• Data Protection Law means the GDPR, the UK GDPR and UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any other data protection law that applies to the processing.
• Customer Personal Data means personal data that Deckbell processes on the Customer’s behalf to provide the Service, as described in section 3.
• Subprocessor means a third party engaged by Deckbell that processes Customer Personal Data.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

Other terms such as “controller”, “processor”, “data subject” and “processing” have the meanings given in the GDPR. Capitalised terms not defined here have the meanings given in the Terms.

2. Roles and scope

The Customer is the controller of Customer Personal Data and Deckbell is its processor. The Customer is responsible for having a lawful basis for the processing, for the instructions it gives, and for the content its users put into Deckbell.

This DPA does not cover data for which Deckbell is itself a controller, namely:

• the account details we need to run a user’s Deckbell account across workspaces, security and abuse-prevention data, and technical logs; and
• billing and tax records.

That data is handled as described in our Privacy Policy. Payments are processed by Paddle as merchant of record, acting as an independent controller under its own terms, so Paddle is not our subprocessor.

3. Details of the processing

• Subject matter: providing Deckbell, a project tracker and team chat with AI agents, to the Customer under the Terms.
• Duration: for as long as the Customer uses the Service, and afterwards until the data is deleted as set out in section 11.
• Nature and purpose: hosting, storing, organising, displaying, transmitting and deleting Customer Personal Data; running AI agents on the content the Customer’s users ask them to act on; sending notifications; importing data the Customer chooses; exporting data on request; and providing support, all to deliver the Service.
• Categories of data subjects: the Customer’s workspace members (employees, contractors, guests) and invitees, and other people whose personal data the Customer’s users put into the Service, such as people mentioned in issues, messages or imported data, or senders of email forwarded into a workspace.
• Categories of personal data: names, email addresses, usernames, profile photos, positions and departments; the content of projects, issues, comments, chat messages, voice messages and uploaded files; agent instructions and run records; integration identifiers; device and push notification data from the Deckbell apps; and presence and activity information.
• Special categories: none are intended. The Customer should not put special categories of personal data (GDPR Article 9) or criminal-offence data into Deckbell unless it has assessed that this is lawful and that the security measures are adequate.
• Frequency: continuous, for as long as the Customer uses the Service.
• Location: Customer Personal Data is stored in the European Union (in Germany, and in Cloudflare R2 under its EU jurisdiction). Deckbell’s staff access it from the Republic of Azerbaijan when needed to run, secure and support the Service. Subprocessors process it in the locations listed in section 6.

4. Processing on documented instructions

We process Customer Personal Data only on the Customer’s documented instructions, including regarding international transfers. The Terms, this DPA, and the Customer’s and its users’ use and configuration of the Service (for example settings, integrations and agents they turn on) are the Customer’s complete instructions. Further instructions must be in writing and consistent with the Terms.

We do not sell Customer Personal Data, use it for advertising, or use it to train AI models. If European Union or Member State law to which we are subject requires us to process it otherwise, we will tell the Customer first, unless that law forbids it on important grounds of public interest. Requests or obligations under the law of any other country, including the Republic of Azerbaijan, are handled as set out in section 8. We will tell the Customer if we believe an instruction infringes Data Protection Law. If we cannot follow an instruction, we will tell the Customer, which may then suspend the affected processing or end the affected part of the Service.

5. Our obligations

Deckbell will:

• ensure that people authorised to process Customer Personal Data are bound by confidentiality and only access it when needed to provide the Service, support the Customer or keep the Service secure;
• implement and maintain the technical and organisational measures described in section 9 and the Annex;
• taking into account the nature of the processing, help the Customer respond to requests from data subjects exercising their rights. Most requests can be handled with the tools in the Service (for example editing or deleting content, deactivating members, exporting data or deleting the workspace). If we receive a request directly, we will pass it to the Customer and not answer it ourselves, unless the Customer asks us to;
• give the Customer reasonable help with data protection impact assessments and prior consultations with supervisory authorities about the Service, using the information available to us;
• keep records of our processing activities as Article 30(2) GDPR requires;
• handle requests from public authorities as set out in section 8.

6. Subprocessors

The Customer gives Deckbell general authorisation to engage subprocessors. The subprocessors we use today are:

Before we add or replace a subprocessor, we will update this list and our Privacy Policy, and notify the owners of all workspaces, on every plan, by email at least 14 days in advance. If we must replace a subprocessor urgently to keep the Service secure or available, we will notify as soon as we can. The Customer may object on reasonable data protection grounds within that period. We will then work with the Customer in good faith to find a solution; if we can’t, the Customer may end the affected part of the Service and receive a refund of prepaid fees for the period after it ends.

We impose data protection obligations on each subprocessor that are no less protective than those in this DPA, and remain responsible to the Customer for their performance.

Third-party services that the Customer chooses to connect, such as GitHub, Slack, Google Drive or other integrations, an AI provider used through the Customer’s own key, or a tool it imports from, are not our subprocessors: data goes to or comes from them on the Customer’s instructions, under the Customer’s own agreement with them.

7. International transfers

Customer Personal Data is stored in the EU: on servers in Germany, and in Cloudflare R2 storage under its EU jurisdiction. Deckbell is established in the Republic of Azerbaijan, for which the European Commission has not adopted an adequacy decision, and its staff access Customer Personal Data from there when needed to run, secure and support the Service. Subprocessors process it in the locations listed in section 6.

Where a transfer is a restricted transfer under Data Protection Law:

• From the Customer to Deckbell: the SCCs apply and are incorporated into this DPA by reference, using Module Two (controller to processor), or Module Three (processor to processor) where the Customer is itself a processor. The Customer is the data exporter and Deckbell the data importer. Clause 7 (docking clause) applies. Under Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 6. The optional wording in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is the one that is competent for the Customer; where the Customer is not established in the EEA but has appointed a representative under Article 27 GDPR, it is the authority of the Member State where that representative is established; otherwise it is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). Clauses 17 and 18 are governed by the law of the Federal Republic of Germany and subject to the courts of Frankfurt am Main, Germany. Annex I is completed by sections 1 and 3 and the subprocessor list in section 6, with the Customer’s details being those of its account. Annex II is completed by section 9 and the Annex to this DPA.
• From the UK: the UK International Data Transfer Addendum to the SCCs issued by the Information Commissioner applies, with the SCCs as completed above, and the Information Commissioner as the competent supervisory authority.
• From Switzerland: the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
• To subprocessors: we rely on the SCCs (Module Three) in the subprocessor’s data processing terms, or on the EU-US Data Privacy Framework or another adequacy decision where it applies.

The SCCs are used because, for processing on the Customer’s behalf, Deckbell is not itself established in the EU. If the European Commission adopts standard contractual clauses for importers that are subject to the GDPR, or replaces the SCCs, those clauses will apply in their place from the date we notify the Customer.

Before relying on the SCCs, the Customer may ask us for our transfer impact assessment for the Republic of Azerbaijan, which describes the laws on public-authority access there and the measures in section 8 and the Annex.

If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

8. Requests from public authorities

This section sets out how we meet Clauses 14 and 15 of the SCCs. We will not disclose Customer Personal Data to a public authority unless we are legally compelled to. If we receive a legally binding request for Customer Personal Data, including one under the law of the Republic of Azerbaijan, we will:

• notify the Customer promptly and, where possible, before disclosing anything, unless the law prohibits notification; if it does, we will use our best efforts to obtain a waiver of the prohibition so that we can tell the Customer as much as possible, as soon as possible;
• review the legality of the request and challenge it where, after careful assessment, we conclude that there are reasonable grounds to consider it unlawful, using the available appeals, and not disclose the data requested until we are required to under the applicable procedural rules;
• disclose only the minimum the request requires, based on a reasonable interpretation of it;
• not give any authority direct or bulk access to our systems, not create back doors, and not hand over encryption keys, unless a court order compels it and we cannot successfully challenge it;
• keep a record of every request and our response, and give the Customer, on request and as far as the law allows, information about the requests we have received.

If we can no longer comply with this section or the SCCs because of a change in the law that applies to us, we will tell the Customer promptly, and the Customer may suspend the transfer or end the affected part of the Service.

9. Security measures

We maintain technical and organisational measures appropriate to the risk, as Article 32 GDPR requires. They are listed in the Annex at the end of this DPA, which forms part of it, and summarised for everyone on our Security page.

We may update these measures as technology and risks change, as long as the overall level of protection does not decrease.

10. Personal Data Breaches

We will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a Personal Data Breach. We send the notice to the workspace owner’s email address and to any security contact the Customer has given us.

The notice will describe, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will follow up with more information as it becomes available, take reasonable steps to contain and remedy the breach, and help the Customer meet its own obligations to notify supervisory authorities and data subjects.

Notifying the Customer of a breach is not an admission of fault or liability.

11. Deletion and return of data

During the term, the Customer can delete Customer Personal Data with the tools in the Service and, on the plans that include it, download a full export of its workspace.

When a workspace is deleted, or the Customer asks us in writing to delete it at the end of the Service, we delete the Customer Personal Data in it within 30 days. Copies in backups are overwritten within a further 30 days. Before deletion, the Customer may ask us for a copy of its workspace data in a machine-readable format, whatever its plan. We may keep data only where European Union or Member State law requires it, and then only for as long as it requires, keeping it confidential and not processing it for any other purpose.

Content sent to our AI provider when an agent runs on Deckbell is deleted from our AI provider within 30 days, except content that the provider’s automated safety systems flag for review as possibly violating its usage policy, which it may keep for up to 2 years. We delete the agent sessions we hold at our AI provider when each run finishes.

12. Information and audits

We will make available to the Customer the information reasonably needed to demonstrate compliance with this DPA and Article 28 GDPR, including by answering reasonable security questionnaires and giving access to relevant documentation.

If that information is not enough, or a supervisory authority requires it, the Customer (or an independent auditor bound by confidentiality, who is not our competitor) may audit our compliance. Audits require at least 30 days’ written notice, take place no more than once a year (unless after a Personal Data Breach, where there are indications of non-compliance with this DPA, or where a supervisory authority requires it), during business hours, without unreasonably disrupting our operations or compromising other customers’ data, and at the Customer’s expense. Audits of a subprocessor are carried out through the reports and information it makes available.

13. Liability

Each party’s liability to the other arising out of or relating to this DPA is subject to the exclusions and limits in the Limitation of liability section of the Terms, and counts towards the same total. Nothing in this DPA:

• limits either party’s liability to data subjects, including under Clause 12 of the SCCs, or any liability that cannot be limited under Data Protection Law; or
• limits or excludes a party’s obligations under the SCCs.

14. US state privacy laws

Where Deckbell processes personal information on the Customer’s behalf under the California Consumer Privacy Act or a similar US state law, Deckbell acts as a “service provider” or “processor”. It will not sell or share that information, keep, use or disclose it outside the direct business relationship with the Customer, or combine it with other data, except as those laws allow. It will tell the Customer if it can no longer meet these obligations.

15. Term, changes, governing law and order of precedence

This DPA applies for as long as we process Customer Personal Data. We may update it to reflect changes in the law, in our subprocessors or in the Service, and will change the “Last updated” date above; changes that reduce the protection of Customer Personal Data will be notified in advance in the same way as changes to the Terms.

We will not change the SCCs, except to replace them with a version approved by the European Commission. A change that reduces the protection of Customer Personal Data does not apply to a Customer that objects in writing before it takes effect, until that Customer’s current subscription term ends.

If there is a conflict, the SCCs prevail over this DPA, and this DPA prevails over the Terms for the processing of Customer Personal Data. This DPA, and any dispute arising out of or in connection with it, is governed by the laws of the Federal Republic of Germany, and the courts of Frankfurt am Main, Germany have exclusive jurisdiction, whatever law and courts the Terms choose.

16. Contact

Questions about this DPA, requests for a signed copy, or data protection requests: email privacy@deckbell.com, or write to Symprox Solutions MMC, Ecemi Naxcivani 26, Baku, Azerbaijan. Security incidents and vulnerabilities: security@deckbell.com.

Annex: Technical and organisational measures

These are the measures referred to in section 9, and they complete Annex II of the SCCs.

1. Hosting and location. The servers and the primary database are hosted by Hetzner Online GmbH in Nuremberg, Germany, in ISO 27001-certified data centres. Uploaded files, exports and backups are stored in Cloudflare R2 under its EU jurisdiction.
2. Encryption in transit. All connections to the Service use TLS 1.2 or later, and HTTP Strict Transport Security (HSTS) tells browsers to use only HTTPS. The connection between Cloudflare and our servers is also encrypted, and Cloudflare validates our servers’ certificate (Full (strict) mode).
3. Encryption at rest. The database is stored on a LUKS-encrypted volume whose key is held off the server. Files in Cloudflare R2 are encrypted at rest. Backups are encrypted with age before they leave the server. Secrets we hold for the Customer (such as provider keys and integration and import tokens) are additionally encrypted in the database with an application key held separately. Passwords are stored only as bcrypt hashes, and API tokens only as fingerprints.
4. Staff access. Access to production systems is limited to named administrators who are bound by confidentiality, on a least-privilege basis, and is used only to operate, secure or support the Service, or at the Customer’s request. Administrators work from the Republic of Azerbaijan and connect only over encrypted connections.
5. Application security. Role-based access within workspaces (Owner, Admin, Member); scoped API tokens, with optional expiry, limited to one workspace; passkeys and two-factor authentication; re-confirmation of identity before sensitive changes; rate limiting of sign-in attempts; signature checks on incoming payment webhooks. On the relevant plans: SAML single sign-on, SCIM provisioning, allowed email domains, message retention and legal hold.
6. Network protection. All traffic passes through Cloudflare, which protects the Service against denial-of-service attacks and malicious bots before requests reach our servers.
7. Logging and monitoring. Workspaces on the relevant plans have an audit log of security-relevant actions (such as invitations, role changes, security settings, exports and SSO sign-ins). Technical and access logs are kept for up to 90 days. The Service and the arrival of backups are monitored around the clock, with alerts, and the current status is published at status.deckbell.com.
8. Backups and recovery. The database and server files are backed up every night, encrypted, to Cloudflare R2 in the EU, and kept for 30 days. We have tested restoring from them.
9. Vulnerability management. Software and dependencies are kept up to date and security patches are applied promptly. Our vulnerability disclosure policy is published on our Security page.
10. Incident response. We contain, assess and remedy security incidents, and notify the Customer within the time in section 10.
11. Data minimisation and deletion. AI providers receive only the content an agent is asked to work on. Import tokens and files are deleted when an import ends. Data is deleted as set out in section 11.
12. Subprocessors. Chosen for their security, and bound by data protection terms as set out in section 6.