Data processing agreement

1. Scope and instructions

The subject matter is operation of the customer's GoodCompany workspace for the service term and necessary return/deletion period. Instructions include the agreement, authorised configuration and actions in the service, and additional documented instructions agreed with the customer. We process only on those instructions, including for transfers, unless applicable EU or Member State law requires otherwise. In that case we inform the customer before processing unless the law prohibits notice. We will inform the customer if we consider an instruction to infringe applicable data-protection law.

2. Processing particulars

• Operations: collection/import, storage, organisation, retrieval, display, sharing under access controls, matching, extraction, search indexing/embeddings, AI inference, communication, sync, export and deletion.
• Purposes: the customer's business administration through mail, calendars, contacts, projects, tasks, financial records, documents and Sidekick.
• Data subjects: users and staff, clients, prospects, suppliers, email correspondents, meeting attendees and other people appearing in customer records.
• Data: identifiers and contact details, correspondence and attachments, meeting details, business/financial records, transaction information, uploaded images/documents, prompts/outputs, access and activity records, and integration authentication data.
• Sensitive data is not necessary for the intended service. The customer must assess incidental sensitive information in imported correspondence and agree appropriate safeguards before deliberately using the service for special-category or criminal-conviction data.

3. Confidentiality and security

We must ensure people authorised to process customer personal data are subject to confidentiality obligations and have access appropriate to their responsibilities. We must maintain measures appropriate to risk, including tenant and role controls, secure authentication, encryption in transit and at rest, protection of integration credentials, controls for administrators, vulnerability management, incident handling and recovery procedures. The implemented application controls are described below; production infrastructure controls must be established before processing production customer data.

• Application controls: tenant-scoped database row-level security, membership and sharing checks, hashed account passwords, encrypted integration credentials, session revocation, request validation and upload validation.
• Operational measures required for production: HTTPS, encrypted database/file/backup storage, controlled keys and privileged access, monitoring, tested backup restoration, scheduled deletion and documented incident response.
• AI handling: disclose automated processing; use non-collection/zero-retention inference routing; review provider contracts and downstream recipients separately; restrict human access to Google content as stated in the privacy policy.

4. Sub-processors and transfers

The customer gives general authorisation to use the sub-processors identified for the active production service on the provider page. Before granting access, we must bind each sub-processor to data-protection obligations that provide the required level of protection, and remain responsible for its performance of those obligations. We will notify the customer in advance of an intended addition or replacement, normally at least 30 days before access, and allow reasonable time to object on substantiated data-protection grounds. We will discuss an alternative or ending the affected service if the objection cannot be resolved.

Processing outside the EEA must have an applicable Chapter V transfer basis and any necessary supplementary safeguards. This agreement does not itself create standard contractual clauses with an external provider or declare an unverified supplier adequate. The customer can request information about the actual transfer arrangement. Google-derived data remains subject to Limited Use restrictions throughout the processing chain.

5. Assistance and incidents

Taking account of the processing and information available, we assist with data-subject requests, security obligations, breach notices, impact assessments and supervisory-authority consultation. Requests received directly about customer-controlled data are referred to the customer unless law requires otherwise. We notify the customer of a personal data breach affecting its data without undue delay after awareness, provide known details of its nature, affected data/people, likely consequences, contact and mitigation, and supplement the notice as investigation progresses.

6. Return and deletion

At the end of processing, we will, at the customer's choice, return or delete customer personal data and delete existing copies unless applicable law requires storage. Request export before instructing company deletion. Live database deletion, file cleanup, previously created derivatives and backup rotation are separate operations; the privacy policy describes the app's controls and limitations. We will document the applicable recovery-copy deletion schedule with the customer before production processing and restrict retained recovery copies to recovery/security purposes. Restored data must have outstanding deletion instructions reapplied. If law requires retention, we will identify the basis where permitted and limit further processing accordingly.

7. Accountability and audits

We will make information necessary to demonstrate compliance available and allow and contribute to audits, including inspections, by the customer or its mandated auditor. We may agree reasonable notice, confidentiality, scope and practical arrangements to protect other customers, but these arrangements do not exclude legally required audit rights or urgent investigations. We will cooperate with competent supervisory authorities.

8. Customer responsibilities and priority

The customer determines its lawful basis, informs data subjects, limits data to what is needed, manages user/integration access, sets appropriate retention and provides lawful instructions. The customer should review AI-derived records and maintain statutory records independently where required. This DPA takes priority over conflicting service terms on customer personal-data processing. It does not restrict data-subject rights or the parties' direct obligations under the GDPR. A countersigned copy and operational annex can be requested from the operator.