Business Data Processing Agreement

Business Data Processing Agreement

Standard Article 28 terms: effective only when accepted by both parties. Customer identity and any customer-specific additions must be completed at acceptance.

Parties and priority

Customer: the business customer identified in the signed order form or electronic acceptance record, including its legal name, registered address and privacy contact. Processor: Szegi Roland Attila E.V., 5000 Szolnok, Városmajor út 59/B, B épület, 2. emelet 24., Hungary; registration 61835722; hello@dropsite.hu.

This DPA applies where the Processor processes personal data on the Customer's behalf in providing resolvenengine. The Customer is controller or, if acting for another controller, a processor authorised to appoint us as subprocessor. Account, billing and security processing for our own purposes is governed separately by our Privacy Policy. In a conflict concerning processor obligations, this DPA prevails over general software terms. Mandatory law prevails over both.

1. Instructions and purpose

The Processor processes the data described in Annex 1 only on documented instructions, including instructions about international transfers, unless Union or Member State law requires otherwise. In that case it informs the Customer beforehand unless legally prohibited. Service configuration, authorised task requests and written support instructions form part of the instructions. The Processor promptly informs the Customer if an instruction appears to infringe applicable data protection law and may suspend that instruction pending resolution.

The Customer is responsible for lawful collection, applicable notices and bases, authorised use of connected accounts, and limiting data to what is necessary. This does not relieve the Processor of its own GDPR obligations.

2. Confidentiality and security

Access is limited to authorised persons bound by confidentiality obligations. The Processor implements appropriate technical and organisational measures under Article 32, taking account of processing risks, state of the art and implementation cost. Annex 3 records measures and gaps; an unimplemented item is not represented as an existing safeguard. Measures must not be materially reduced during the agreement without appropriate alternative protection.

3. Subprocessors

The Customer grants general written authorisation only for the subprocessors listed in the completed Annex 2. The Processor gives at least 30 days' prior written notice of intended additions or replacements and sufficient information for a reasoned data-protection objection. The parties will seek a reasonable alternative; if none is available, the affected processing may be terminated with appropriate treatment of unused paid service. Urgent security replacements require notice as soon as practicable and a lawful authorisation arrangement, not an unlimited exception.

The Processor imposes substantially equivalent Article 28 obligations on each subprocessor and remains responsible to the Customer for their performance. A user-selected AI endpoint, custom OpenAPI connector or MCP server must not receive Customer personal data until the Customer has documented its instruction and established the recipient's role, lawful basis and any required transfer safeguards. A destination selected solely by the Customer is not appointed by the Processor as a general subprocessor.

4. Assistance, incidents and audits

Taking account of the nature of processing and available information, the Processor assists the Customer with data-subject requests and obligations under Articles 32–36. It promptly forwards requests concerning Customer-controlled data and does not independently respond beyond lawful instructions or legal obligations.

The Processor notifies the Customer without undue delay after becoming aware of a personal-data breach, giving available information about its nature, affected categories and approximate numbers, likely consequences, mitigation and a contact. Missing details may follow in phases; notification is not delayed until investigation is complete. The Customer determines its controller notifications, with assistance from the Processor.

The Processor makes available information needed to demonstrate compliance and allows and contributes to reasonable audits, including inspections, by the Customer or its mandated auditor. Reasonable arrangements protect other customers' information and system security without defeating Article 28 rights. Confidentiality or commercial terms cannot prevent disclosures to competent authorities.

5. Transfers

The Processor does not transfer data to a third country without documented instructions and compliance with GDPR Chapter V. Annex 2 must identify the actual transfer mechanism and any supplementary safeguards. This DPA is not itself a replacement for the Commission's Standard Contractual Clauses where those are required; the applicable modules and parties must be separately completed without modifying mandatory clauses.

6. End of service

At the Customer's choice, the Processor returns or deletes personal data after the processing services end and deletes existing production copies within 30 days of a verified instruction unless applicable law requires retention. Encrypted provider-managed backups remain protected and outside ordinary use for the provider's documented backup lifecycle; restoration must reapply deletion before ordinary use. The Processor confirms completion and explains any legally required retention.

Annex 1: Processing description

• Subject: AI-assisted browser and connector tasks and account-linked conversation storage.
• Duration: service term and the agreed return/deletion period.
• Nature: receipt, retrieval, structuring, transmission to authorised AI providers, generation, storage, user-directed modification/deletion and export.
• Purposes: perform authorised tasks and maintain Customer conversation history.
• Data subjects: Customer staff, contractors, customers, correspondents, meeting participants and other people appearing in authorised content.
• Data types: identifiers, contact details, communications, files, calendar/task data, browser content, prompts/outputs and task metadata.
• Sensitive data: not intentionally supported as a special-category workflow under this standard template; incidental inclusion must be assessed and minimised. Intentional processing requires a documented basis and additional safeguards.
• Customer instructions/contact: the administrator and privacy contact recorded in the order form or electronic acceptance record.

Annex 2: Authorised subprocessors and transfers

The authorised subprocessor categories are:

Google, ClickUp and GitHub act primarily as services connected by the Customer under their own account terms, rather than general subprocessors appointed to host all Customer data. Polar acts as Merchant of Record for account billing. A user-selected AI endpoint, OpenAPI API or MCP server is an instructed recipient and is not authorised as the Processor's subprocessor merely because the Customer enters its URL or credential. If the parties intend any of these recipients to act as a subprocessor for a particular deployment, the acceptance record must identify the legal entity, country, duties, data, DPA and Chapter V transfer mechanism before Customer personal data is sent.

Annex 3: Technical and organisational measures

Implemented measures include HTTPS; AES-GCM encryption of stored connector credentials and synchronised payloads with owner/record-bound authenticated data; account-associated records; service-role-only database access with row-level policies; 30-day app sessions; 10-minute OAuth state and two-minute hand-off validity; single-use hand-offs and approval tickets; per-operation Allow/Ask/Deny controls; explicit-intent checks for writes; replay protection for consequential actions; request and response size limits; rate limiting; HTTPS-only custom endpoints; rejection of private/local/metadata hosts, URL credentials and redirects; and secret redaction from model-visible connector responses. These statements describe the implemented architecture and are not a penetration-test certificate.

The Processor maintains least-privilege administrative access, confidential access by authorised personnel, tenant-isolation tests, managed secret storage, change-controlled releases, authenticated account deletion, deletion replay after backup restoration, incident handling, bounded/redacted diagnostics, and periodic review of subprocessors and transfers. Customer-specific security evidence may be supplied subject to confidentiality and protection of other customers. Any security requirement beyond this annex must be agreed in the acceptance record before processing begins.

Acceptance

For Customer: name, role, date, signature / recorded electronic acceptance. For Processor: name, role, date, signature / recorded electronic acceptance.