This Data Processing Agreement ("DPA") is between the customer who opens a Pumi workspace ("Customer", the controller) and TopScale Kft., Viola utca 2, 8200 Veszprém, Hungary, company registration number 19-09-523454 ("we", the processor). It forms part of our Terms of Service and applies from the moment Customer accepts them. Where the two conflict on data protection, this DPA prevails.
1. Subject matter and duration
We process personal data in Customer's workspace to provide Pumi. This DPA lasts as long as we process such data, including the export and deletion period after the contract ends.
2. Nature and purpose
Hosting, storing, displaying, transmitting (including by email), backing up, exporting and deleting workspace data, solely to provide the service to Customer.
3. Data subjects and personal data
- Data subjects: Customer's team members; Customer's clients and their staff invited to the client portal; people mentioned in workspace content.
- Personal data: names, email addresses, roles, working hours and hourly rates; the content of tasks, estimates, comments, messages and files; work logs; activity history.
- The service is not designed for special categories of data (Art. 9 GDPR) or criminal records. Customer should not upload them.
4. Customer's instructions
- We process personal data only on Customer's documented instructions. These are the Terms, this DPA, and Customer's use and settings of the service.
- We tell Customer if we think an instruction breaks data protection law.
- If EU or Member State law requires other processing, we tell Customer before processing, unless that law forbids it.
5. Confidentiality
Everyone we authorise to process the data is bound by confidentiality.
6. Security
We take the measures required by Art. 32 GDPR, including:
- Encrypted connections (HTTPS/TLS) between browsers, the service and email delivery
- Passwords stored only as hashes
- Role-based access inside the app: users see only the workspaces and projects they belong to
- Access to production systems limited to authorised staff with individual credentials
- Regular backups of production data
- Hosting in EU data centres certified to ISO/IEC 27001
- Security updates applied to servers and dependencies regularly
7. Sub-processors
Customer gives general authorisation for us to use the following sub-processors:
| Sub-processor | Location | Purpose |
|---|---|---|
| Hetzner Online GmbH | Germany (EU data centres) | Servers, database, file storage and backups |
| Shipmail | Germany (EU); some of its own subprocessors are US companies | Sending service emails (invitations, approvals, reminders, notifications) |
- We email the workspace owner at least 30 days before adding or replacing a sub-processor and update this list.
- Customer may object on reasonable data protection grounds. If we can't resolve it, Customer may end the contract before the change takes effect.
- We impose the same data protection obligations on each sub-processor and remain responsible for their work.
8. Helping Customer
- Data subject requests: Customer can handle many requests directly in the app, for example by editing or removing users and content. We forward any request we receive to Customer without undue delay and help answer it. We don't reply ourselves unless Customer asks us to.
- Other obligations: we help Customer with security, breach notification, data protection impact assessments and prior consultation (Art. 32–36 GDPR), based on the information available to us.
9. Personal data breaches
We notify Customer without undue delay, and where feasible within 48 hours, after becoming aware of a breach affecting workspace data. We give the information required by Art. 33(3) GDPR as it becomes available, and take reasonable steps to contain the breach.
10. Return and deletion
When the contract ends, Customer can export its data as in section 12 of the Terms. Then we delete the data within 30 days, and from backups within a further 90 days, unless the law requires us to keep it.
11. Audits and information
- We give Customer the information needed to demonstrate compliance with this DPA.
- Customer, or an auditor bound by confidentiality, may audit us once a year with 30 days' notice, at Customer's cost. More often only after a breach or at an authority's request.
- We may first answer with documentation or a written questionnaire.
12. International transfers
We transfer personal data outside the European Economic Area only with safeguards under Chapter V GDPR. Our subprocessors host in Germany. Shipmail uses some US-based subprocessors of its own; those transfers rely on the Standard Contractual Clauses or the EU–US Data Privacy Framework.
13. Liability and contact
Liability follows the Terms of Service. Questions about this DPA: info@pumi.co.