Data processing agreement (DPA)
Version 1 · in force since Oct 15, 2026
⚠️ Draft for legal review. The highlighted fields must be filled in before there are paying customers.
The contract required by the GDPR (Art. 28) between the customer organization (controller) and [COMPANY NAME] (processor) for the content the organization puts into Bolas Planner.
1. Parties and subject matter
The customer organization, represented by its owner, is the controller. [COMPANY NAME], tax number [TAX NUMBER], registered at [ADDRESS], is the processor. The subject matter is the processing of the personal data included in the organization’s content, to provide the Bolas Planner service.
2. Nature, purpose, duration, data and data subjects
| Item | Description |
|---|---|
| Nature and purpose | Store, organize, show, search, export and delete content, according to the features the organization uses |
| Duration | For as long as the service lasts, plus 30 days for export |
| Types of data | Names, emails, photos and roles of the team; whatever the organization writes in tickets, comments, pages and attachments; activity logs |
| Data subjects | Team members and guests; people mentioned in the content (for example, the organization’s customers) |
3. Processor obligations
- Process the data only on the controller’s documented instructions, including these terms and the organization’s settings.
- Ensure that everyone with access is bound by confidentiality.
- Apply the security measures in the annex (Art. 32).
- Only use sub-processors from the published list, under contracts with the same obligations, and give 30 days’ notice before adding a new one, so the controller can object.
- Help the controller answer data subjects’ requests, with tools in the app (export, correct, anonymize, delete).
- Notify the controller without undue delay of any data breach affecting the organization, with the information needed for its own notifications.
- Help with impact assessments and consultations with the supervisory authority, where applicable.
- At the end of the service, allow export for 30 days and then delete the data, unless the law requires keeping it.
- Make available the information needed to demonstrate compliance, and allow reasonable audits.
4. Transfers outside the EU
Data is stored in Ireland (EU). When a sub-processor processes it outside the EU, the GDPR safeguards apply (EU-US Data Privacy Framework or standard contractual clauses), as shown in the subprocessors list.
Annex: security measures
- Encryption of connections (TLS) and storage.
- Isolation of each organization in the database (row-level security), with automatic tests.
- Per-project permissions, security levels and groups; two-step verification, which the organization can make mandatory.
- Strong passwords, checked against data leaks; notices of sign-ins from new devices.
- Activity log and error log; alerts.
- Encrypted daily backups and restore rehearsals.
- Dependency updates and a security review in each version.