Data Processing Agreement

a) Confidentiality (GDPR Article 28(3)(b))

Ensures that persons authorized to process personal data have committed themselves to confidentiality.

b) Technical and Organizational Measures (GDPR Article 32)

Implements appropriate technical and organizational measures to protect data:

• • Encryption: TLS 1.3 (transit), AES-256 (storage)
• • Access control: RBAC, optional 2FA
• • Audit logging: 30 days (FREE) / 90 days (PRO) / 1 year (ENTERPRISE), security events 1 year
• • Backups: Daily, encrypted
• • System updates: Regular security patches

c) Deletion or Return of Data (GDPR Article 28(3)(g))

At the end of the provision of services, deletes or returns all personal data at the controller’s choice, and deletes existing copies. The controller may state that choice when the account ends, or at any point before; absent a choice, deletion is the default. Return happens through self-service export (JSON or CSV) or, on request, as a complete data package.

Exception: retention required by Union or Member State law — this covers the processor’s own accounting records (issued subscription invoices, Hungarian Accounting Act §169), not workspace content data. Section 10 lists the affected data and its legal basis item by item.

d) Audit Rights (GDPR Article 28(3)(h))

Makes available all information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits — including inspections — conducted by the controller or an auditor mandated by the controller. This right applies to every controller regardless of plan. Practical frame: one audit per calendar year with 30 days’ prior written notice, during business hours, under an NDA; out of cycle where justified (an incident, a regulator’s investigation). Reasonable costs of additional audits are borne by the controller. Document-based evidence (the Annex II TOM list, the sub-processor list, an extract of the breach register) is free of charge on every plan.

e) Transfers to Third Countries (GDPR Article 28(3)(a))

Processes personal data only on documented instructions from the controller, including with regard to transfers to a third country or an international organisation — unless required to do so by Union or Member State law. In such a case, the processor informs the controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

In its default state the service performs no third-country transfer. This only occurs if a user activates the Google Calendar integration themselves (see section 7).

f) Assistance with Articles 32–36 (GDPR Article 28(3)(f))

Taking into account the nature of processing and the information available to it, assists the controller in complying with Articles 32–36: security of processing (Article 32), breach notification and communication (Articles 33–34), data protection impact assessment (Article 35) and prior consultation (Article 36). For this we provide the Annex II TOM list, the data-flow description and the technical inputs needed for a DPIA, free of charge, on every plan.

g) Notifying Unlawful Instructions (GDPR Article 28(3), second subparagraph)

Immediately informs the controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions. Until it has done so — or until the instruction is confirmed — the processor may suspend execution of the instruction in question.

h) Data Breach Notification (GDPR Article 33)

Notifies the controller of any personal data breach without undue delay and in any event within 48 hours of becoming aware of it, via privacy@cadensa.io. Where all the information is not available within that window, it is provided in phases as the facts emerge, under Article 33(4) — the first notice does not wait for the investigation to finish.