Data Processing Agreement

This Data Processing Agreement is available in German and English. Both versions are equally binding.

This Data Processing Agreement (DPA) under Art. 28(3) GDPR supplements the Terms for SlugBase Cloud. It becomes part of the contract with every order as an entrepreneur and with every use of the Service for business purposes, including on the Free plan, without a separate signature (Terms clause 20 paragraph 3).

1. Parties and roles

1. Controller is the entrepreneur who orders SlugBase Cloud or uses it for business purposes (the "customer").
2. Processor is Michael David Guggenbichler, sole proprietor (Einzelunternehmer), Linzer Straße 17, 4100 Ottensheim, Austria ("we").
3. This DPA applies only to the extent that we process personal data on behalf of the customer (section 2). We are the controller ourselves for the account, billing, the security of the Service and the website; the Privacy Policy applies to that processing.

2. Subject matter, duration, nature and purpose of the processing

1. Subject matter: provision of SlugBase Cloud under the Terms: storing, organising, searching, sharing and opening bookmarks in the customer's workspaces, managing members and teams, the activity log, import and export and, optionally, AI suggestions.
2. Duration: for as long as the contract for the Service exists, including the export period under Terms clause 14 paragraph 6, and until deletion under section 9.
3. Nature of the processing: collection, storage, organisation, retrieval, display, transmission to the members designated by the customer, backup, export and erasure.
4. Purpose: solely the provision of the Service to the customer.

3. Types of data and categories of data subjects

1. Data subjects: members and invited persons of the customer's workspaces (for example employees) and persons whose data members store in bookmarks.
2. Types of data: workspace content (addresses, titles, descriptions, slugs, folders, tags, shares), member data in the workspace (display name, email address, role, teams, date of joining, last activity), invitations and the workspace activity log (time, acting person, type of action, affected object, coarse network prefix of the IP address).
3. We do not deliberately process special categories of personal data (Art. 9 GDPR). If the customer stores such data in bookmarks, the customer is responsible for this being permitted.

4. Instructions

1. We process the data only on documented instructions from the customer, including with regard to transfers to third countries, unless Union or Member State law requires us to process them; in that case we inform the customer before processing, unless that law prohibits it.
2. The instructions are set out in the Terms, in this DPA and in the settings the customer makes in the Service. The customer gives further instructions in text form to hello@slugbase.app.
3. If we consider an instruction unlawful, we inform the customer without undue delay. We may suspend carrying it out until the customer confirms or changes it.

5. Confidentiality

We commit all persons who have access to the data to confidentiality, unless they are under a statutory obligation of confidentiality. We access content only in the cases listed in section 2 point 3 of the Privacy Policy.

6. Security of processing

We take the technical and organisational measures under Art. 32 GDPR described in the annex (section 14); a summary is in section 9 of the Privacy Policy. We may develop the measures further as long as the level of protection does not fall.

7. Sub-processors

1. The customer gives general authorisation to engage sub-processors. Currently these are:

2. We inform the customer by email to the address of the account at least 30 days in advance of any intended addition or replacement of a sub-processor. The customer can object in text form within this period for an objective reason. If we cannot remedy the objection, the customer can terminate the contract at no cost with effect from the change; we refund fees paid in advance pro rata (Terms clause 8 paragraph 3).
3. We impose on every sub-processor by contract the same data protection obligations as in this DPA and are liable to the customer for its breaches as for our own.

8. Transfers to third countries

We process the data in the EU. Processing outside the EEA happens only as described in section 6 of the Privacy Policy: in the mailboxes in Switzerland on the basis of the adequacy decision, and in the answering of DNS queries by the worldwide DNS network of bunny.net (section 6 point 7 of the Privacy Policy). We make other transfers to third countries only under Art. 44 et seq. GDPR and after prior information under section 7 point 2.

9. Deletion and return

1. The customer can export the data at any time itself (Terms clause 14 paragraphs 3 and 6). This is the return of the data.
2. After the contract ends and the export period has expired, we delete the data. Backup copies expire after their retention period, after 125 days at the latest (section 3.17 of the Privacy Policy). Data that Union or Member State law requires us to keep are deleted when that obligation ends.
3. On request we confirm the deletion in text form.

10. Assistance to the customer

1. Data subject rights: we assist the customer with appropriate measures in responding to requests under Chapter III GDPR. The customer can handle many requests itself with the functions of the Service (export, rectification, removing members, deletion). If data subjects contact us with a request about the customer's data, we forward it to the customer.
2. Personal data breaches: we notify the customer of a breach affecting its data without undue delay, and at the latest within 48 hours, after becoming aware of it, with the information under Art. 33(3) GDPR as far as it is available to us, and add to it as soon as we know more.
3. Other obligations: taking into account the nature of the processing and the information available to us, we assist the customer in meeting the obligations under Art. 32 to 36 GDPR, in particular with communicating a breach to data subjects (Art. 34), data protection impact assessments and prior consultation, where they concern the Service.

11. Demonstrating compliance and audits

1. On request we make available to the customer the information necessary to demonstrate compliance with this DPA.
2. The customer, or an auditor appointed by it who is bound to confidentiality, can verify compliance at most once per calendar year after at least 30 days' notice, during business hours, without disrupting operations and without access to other customers' data. In the case of a well-founded suspicion of a breach of this DPA, the once-a-year limit and the notice period do not apply. The customer bears the costs of an audit unless it reveals a material breach by us.

12. Notes for the customer

1. The workspace activity log records who made which significant changes and when, including a coarse network prefix of the IP address (section 3.9 of the Privacy Policy). If the customer uses the Service for its employees, it checks whether employment law rules apply, in Austria for example §§ 96 and 96a of the Labour Constitution Act (Arbeitsverfassungsgesetz), and informs its employees about the processing.
2. The customer is responsible for being permitted to process the data that it and its members store in the Service.

13. Liability and final provisions

1. Between the customer and us, liability is governed by clause 18 of the Terms. Liability towards data subjects under Art. 82 GDPR remains unaffected.
2. In case of conflict, this DPA takes precedence over the Terms as far as the protection of personal data is concerned.
3. Changes to this DPA are governed by clause 19 paragraph 5 of the Terms. A change that concerns only a new sub-processor is governed by section 7 point 2.
4. Austrian law applies; the venue is governed by clause 21 paragraph 4 of the Terms.

14. Annex: Technical and organisational measures

1. Physical access control: the servers are in data centres of the hosting providers in the EU (section 7). Their physical security is governed by our Art. 28 GDPR agreements with them; we operate no premises of our own that hold customer data.
2. System access control: the servers are protected by a firewall. Databases and internal services are not reachable through open ports, only through the network of the respective server and a secured tunnel. The operator console and the test environment are reachable only after signing in through a single sign-on service; the operator console additionally requires its own sign-in with mandatory two-factor authentication.
3. Data access control: the application accesses the database with a role without owner rights for which row-level security is enforced; every query sees only the data of the respective workspace. Migrations, operations and the console use separate roles with only the rights they need. The operator console reads product data only through approved views without bookmark content. Credentials and keys are kept only in the environment of the deployment platform, never in the source code. We access content only in the cases of section 5.
4. Transmission control: all transmissions are encrypted with TLS, including the transfer of backups to the object storage. Transfers to third countries happen only under section 8.
5. Input control: significant changes in a workspace are recorded in the activity log (section 3.9 of the Privacy Policy); actions in the operator console are logged. Application logs contain no bookmark content, no slugs and no email addresses and are kept for 14 days.
6. Processor control: we engage sub-processors only under section 7 and with agreements under Art. 28 GDPR.
7. Availability control: the database is backed up hourly, daily and monthly to versioned object storage in the EU (section 3.17 of the Privacy Policy). An automated restore test runs monthly. Failed backups and restore tests, storage, load and reachability are monitored and raise alerts.
8. Separation control: workspaces are separated at database level (point 3). The test and production environments run on separate servers with separate databases.
9. Pseudonymisation and encryption: passwords are hashed with a memory-hard algorithm; session, API and email tokens are stored only as hashes; two-factor secrets are encrypted with a key that exists only in the deployment platform and is renewed yearly. We store IP addresses only as a coarse network prefix or as a hash.
10. Incident handling: we assess security incidents without undue delay and notify them under section 10 point 2.
11. Personnel: the processor operates the Service in person. Other persons receive access only as far as necessary and are committed to confidentiality under section 5.
12. Review: we review these measures at least once a year and after significant changes to the Service, and adapt them under section 6.