Data processing agreement – draft

Subprocessor overview – actual use and outstanding evidence

Netlify: website, API and scheduled server jobs; requests may contain customer data and technical metadata. DigitalOcean: database on an administered Droplet in Frankfurt (FRA1), including customer records, attachments and encrypted mailbox credentials. Frankfurt is evidenced for the server, not for all processing or every backup.

Resend: system messages and customer replies when managed sending is selected, including recipients, content and attachments. OpenAI: optional reply suggestions when enabled by the organization and requested by a user. Selected dialogue and the user instruction are transmitted; internal notes and attachment content are not automatically included. The API request uses store:false; this does not establish zero provider retention.

Google/Microsoft or another selected email provider: the customer mailbox handles receipt, sending and folders. Contractual roles must be assessed for the customer account. Stripe currently handles subscriptions in test mode only; this setup does not enable real charges.

This overview identifies service names and observed roles. The legal contracting entity, executed DPA and version, other processing countries, retention and any transfer mechanism must be evidenced for the actual vendor accounts before finalization. Public standard terms alone do not prove that a contract was executed.

1. Parties and status

The controller is the customer organization identified in the workspace. The processor is Waseem Mirza Consulting, contact support@kundesaker.no. Norwegian organization number: 926 272 152. Business address: v/Mishkaat Norge, Tøyengata 2, Grønland basar, 0190 Oslo, Norway.

This is a draft, not an executed agreement or confirmation that operational arrangements are fully documented. Complete these fields and the annexes, and record acceptance and dates before execution.

2. Processing description

Processing covers receiving, storing, organizing and sending customer dialogue, attachments, internal notes, tasks, call records, assignments and change history. The purpose is customer service and follow-up under customer instructions, for as long as the supplier processes personal data on the customer’s behalf.

Data subjects may include customers, prospects, business contacts and staff. Data may include names, email addresses, telephone numbers, business details, message content, attachments, timestamps and case activity. Special categories are excluded unless separately agreed with suitable safeguards.

3. Instructions and confidentiality

Proposed term: Process only on documented instructions, including transfer instructions, unless applicable law requires otherwise; inform the customer where legally permitted. Notify the customer immediately if an instruction is considered contrary to data protection rules. Only authorized persons subject to confidentiality may access the information.

4. Security and assistance

Annex A must document agreed technical and organizational measures: access controls, encryption, logging, backup, recovery, updates, incident response and verification. Attach operational responsibilities and documented tests; product features alone are insufficient.

Proposed term: Assist with data subject rights and, considering processing and information available, with security, breaches, risk assessments and prior consultation. Notify the customer of personal data breaches without undue delay, providing available information and subsequent updates.

5. Subprocessors and transfers

Annex B must list each approved subprocessor’s legal identity, function, processing countries, agreements and transfer grounds. Services to clarify include Netlify, DigitalOcean (database in Frankfurt, administered by Waseem Mirza Consulting), Resend and optional OpenAI use. Assess the customer’s email provider and Stripe’s roles separately.

Proposed term: New subprocessors require agreed approval or notice and a meaningful opportunity to object. Equivalent data protection duties apply to subprocessors. Transfers outside the EEA require valid grounds, assessments and any necessary supplementary measures.

6. Termination, evidence and audit

Annex C – return and deletion: The owner can export customer records, including stored incoming and reply attachments, as JSONL. Expired trials and ended subscriptions receive an export window of at least 30 days. A daily job handles up to 20 eligible workspaces; the deadline is the earliest deletion time, not a guarantee of deletion at that exact instant. Continuing subscriptions with payment failures are not automatically deleted. The platform administrator workspace is exempt and needs separate handling. Accounts belonging to other workspaces are retained. A deletion log retains the organization ID and timestamp without a fixed automatic expiry; retention must be agreed. Files held only by the email provider must be exported there. Documented weekly Droplet backups show four copies with approximately four weeks of scheduled retention. Backup region, expiry controls and deletion of manual export/test copies remain to be confirmed. The database job does not delete records held by external services.

Proposed term: On termination, return or delete data at the customer’s choice and delete copies unless law requires retention. Provide information demonstrating compliance and cooperate with agreed audits and inspections. Contact support@kundesaker.no to complete the agreement.