Data Processing Agreement

1. Roles and scope

The Customer is the controller of the personal data it sends to the Service, or a processor acting for its own controller, in which case the Processor is its sub-processor. The Processor is the Customer's processor ("Customer Personal Data"). Personal data that the Processor processes as a controller, such as data about the Customer's account holders and billing, is covered by our Privacy Policy, not this DPA.

2. Details of the processing

• Subject matter: providing the Service, which displays in-app notifications to the end users of the Customer's applications.
• Duration: the term of the Terms, plus the period until deletion under section 12.
• Nature and purpose: receiving, storing and updating end user profiles; evaluating targeting rules and segments; personalizing, scheduling and delivering notifications; recording read, seen, archived and clicked state; and showing this data to the Customer in the dashboard and through the API.
• Data subjects: end users of the Customer's applications.
• Categories of personal data: user identifiers, name, email address, avatar URL, locale, time zone, custom attributes and tags supplied by the Customer, notification content, interaction timestamps, and technical data such as IP addresses in request logs.
• Special categories of data: none. The Customer will not send special categories of personal data or data relating to criminal convictions unless agreed in writing.
• Frequency: continuous, for as long as the Customer uses the Service.

3. Instructions

The Processor processes Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers. The Terms, this DPA and the Customer's configuration and use of the Service (through the dashboard, API and SDKs) are the Customer's complete instructions. If EU or Member State law requires other processing, the Processor will inform the Customer before processing, unless that law prohibits it. The Processor will immediately inform the Customer if, in its opinion, an instruction infringes data protection law.

4. Confidentiality

The Processor ensures that everyone authorized to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality.

5. Security

The Processor implements the technical and organizational measures in Annex A, as required by Article 32 GDPR. The Processor may update these measures, provided the overall level of security is not reduced.

6. Sub-processors

The Customer gives the Processor general authorization to engage sub-processors. The current sub-processors are listed in Annex B. The Processor will notify the Customer by email at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining period.

The Processor imposes on each sub-processor, by written contract, data protection obligations that offer the same level of protection as this DPA, and remains fully liable to the Customer for its sub-processors' performance of those obligations.

7. Data subject requests

Taking into account the nature of the processing, the Processor helps the Customer respond to requests from data subjects exercising their rights. The Customer can retrieve, correct and delete end user data itself through the API and dashboard. If the Processor receives a request directly, it will forward it to the Customer without undue delay and will not respond itself, except to direct the data subject to the Customer.

8. Assistance

Taking into account the nature of the processing and the information available to it, the Processor assists the Customer with its obligations under Articles 32 to 36 GDPR, including data protection impact assessments and prior consultations with supervisory authorities.

9. Personal data breaches

The Processor will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, as far as the information is available, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available will be provided as it becomes available. The Processor will take reasonable steps to contain the breach and mitigate its effects.

10. International transfers

The Service runs on Cloudflare's global network, so Customer Personal Data may be processed outside the European Economic Area. The Processor only transfers Customer Personal Data to a third country if it ensures appropriate safeguards under Chapter V GDPR, such as an adequacy decision (including the EU-U.S. Data Privacy Framework) or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") with its sub-processors.

Where the Customer is located in a third country without an adequacy decision, Module 4 (processor to controller) of the SCCs applies to the extent required, and is incorporated by reference. For transfers subject to the UK GDPR or Swiss law, the SCCs apply as amended by the UK International Data Transfer Addendum or as required by the Swiss Federal Data Protection and Information Commissioner, respectively. If the SCCs conflict with this DPA, the SCCs prevail.

11. Audits

The Processor makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, including answers to reasonable security questionnaires. The Processor allows for and contributes to audits, including inspections, conducted by the Customer or by an independent auditor mandated by it and bound by confidentiality. Audits require at least 30 days' written notice, take place during business hours no more than once a year (unless a personal data breach or a supervisory authority requires otherwise) and are at the Customer's cost. For sub-processors, the Processor may rely on their independent certifications and audit reports.

12. Retention, deletion and return

• Notifications are shown in end user feeds for the retention period of the Customer's plan and are permanently deleted 365 days after they are created, or after a longer retention period agreed in writing.
• End user profiles and their notification state are kept until the Customer deletes them, or deletes the project they belong to, through the API or the dashboard.
• Deleted data is removed from the live database immediately and remains in point-in-time backups for no longer than 30 days.
• When the Terms end, the Customer may export its data through the API. The Processor then deletes all remaining Customer Personal Data within 30 days, unless EU or Member State law requires it to be kept.

13. Customer obligations

The Customer is responsible for the lawfulness of its instructions and of the personal data it sends to the Service. This includes having a legal basis, informing end users (including about the local storage used by our SDKs, described in our Cookie Policy), obtaining any required consents, and keeping its secret API keys and private signing keys confidential.

14. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms, except where the law does not allow such limitations, including the rights of data subjects under Article 82 GDPR. This DPA applies for as long as the Processor processes Customer Personal Data.

Annex A: Technical and organizational measures

• Encryption in transit (TLS) and at rest by the hosting provider.
• Secret API keys stored only as SHA-256 hashes. Dashboard passwords stored only as salted hashes.
• Identity verification: end user tokens signed by the Customer's backend (ES256) with a private key the Processor never receives (only the public key is stored), so one end user cannot read another's notifications.
• Logical tenant isolation: every query is scoped to the Customer's project.
• Role-based access for dashboard users (owner, admin, member), and least-privilege access to production systems.
• Automatic deletion of notifications after the retention period in section 12.
• Point-in-time database recovery for up to 30 days.
• DDoS protection and rate limiting at the network edge.

Annex B: Sub-processors

Stripe (through its Link merchant of record service), which processes our payments, does not process Customer Personal Data.

Contact

RCHITECTED QUBILA SRL, trading as NotificationStream, a limited liability company registered in Romania with the Trade Register under no. J12/4516/2022, sole registration code (CUI) 46532650, VAT no. RO46532650, with its registered office in Cluj-Napoca, Cluj County, Romania. Data protection contact: support@notificationstream.com.