Data Processing Addendum

1. Scope and roles

• This DPA applies when Stunda processes personal data on the Customer's behalf in providing the Service, including data about the Customer's members, contractors and clients ("Customer Personal Data").
• The Customer is the controller (or a processor acting for its own controller), and Stunda is the processor (or subprocessor).
• "Data Protection Laws" means all laws that apply to the processing, including the EU GDPR, the UK GDPR and Data Protection Act 2018, Swiss data protection law, and US state privacy laws such as the CCPA. Where the CCPA applies, Stunda acts as a "service provider" and will not sell or share Customer Personal Data, or retain, use or disclose it outside the direct business relationship with the Customer.
• Stunda is a controller, not a processor, for data it uses to run its own business, such as account and billing records. That is covered by the Privacy Policy.

2. Details of processing

3. Instructions

• Stunda processes Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA, and the Customer's configuration and use of the Service are those instructions.
• Stunda will tell the Customer if it believes an instruction breaks Data Protection Laws, unless the law forbids telling.
• If the law requires Stunda to process data otherwise, Stunda will inform the Customer first, unless the law forbids it.
• The Customer is responsible for having a lawful basis for its processing, for giving tracked people any required notice and obtaining any required consent, and for the accuracy of its instructions. See section 4 of the Terms.

4. Confidentiality

Stunda ensures that anyone it authorizes to process Customer Personal Data is bound by confidentiality obligations, and accesses Customer Personal Data only as needed to provide, secure and support the Service, or as the Customer asks (for example, in a support request).

5. Security

Stunda maintains technical and organizational measures appropriate to the risk, including:

• Encryption in transit with TLS for all connections to the Service.
• Encryption at rest provided by our database and file storage providers.
• Passwords hashed with bcrypt. Sign-in links, sign-in codes and API tokens stored only as hashes.
• Short-lived access tokens with rotating refresh tokens.
• Role-based permissions within workspaces, and an audit log of sensitive actions.
• Rate limiting on the API.
• Data minimization in the desktop app: input counts only, never typed content; query strings and fragments removed from browser addresses before upload; screenshots off by default.
• Hashed (not raw) IP addresses for visits to shared report links.
• A limited, defined set of data sent to AI providers, as described in the Privacy Policy.

Stunda may update these measures as long as the overall level of protection does not decrease. The Customer is responsible for securing its own accounts, choosing appropriate roles and settings, and keeping shared report links and screenshot addresses confidential.

6. Subprocessors

• The Customer gives general authorization for Stunda to use the subprocessors listed on our subprocessor page.
• Stunda will give notice of any new or replacement subprocessor by updating that page and emailing workspace owners at least 14 days before the change, except in an emergency where a change is needed to keep the Service running securely, in which case notice will follow as soon as possible.
• The Customer may object on reasonable data protection grounds within that notice period by emailing help@stunda.io. Stunda will try to resolve the objection. If it cannot, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.
• Stunda imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for its subprocessors' performance.

7. Assistance

• Data subject requests. The Service lets the Customer view, correct, export and delete much of its data itself. Where it cannot, Stunda will help the Customer answer requests from data subjects. If Stunda receives a request directly, it will pass it to the Customer and will not respond itself except to direct the person to the Customer.
• Impact assessments and consultations. Stunda will provide reasonable information to help the Customer with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing.

8. Personal data breaches

Stunda will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe what is known about the breach, the data and people likely affected, the likely consequences, and the steps taken or proposed. Stunda will update the Customer as more becomes known and take reasonable steps to contain it. Notifying a breach is not an admission of fault.

9. Deletion and return

The Customer can export and delete Customer Personal Data through the Service while it has access. When the Customer's use of the Service ends, Stunda will, at the Customer's choice, return the Customer Personal Data in a common machine-readable format or delete it, within 30 days of the Customer's written request, unless the law requires Stunda to keep it. Data in backups is deleted as backups expire on their normal schedule, and is protected under this DPA until then.

10. Audits

Stunda will make available the information reasonably necessary to show compliance with Article 28 of the GDPR. Stunda will first meet audit requests by answering a reasonable written security questionnaire and providing relevant documentation, no more than once a year unless a breach or a supervisory authority requires otherwise. If that is not enough to show compliance, the Customer may conduct an audit at its own cost, with reasonable notice, during business hours, in a way that does not disrupt the Service or expose other customers' data, under a confidentiality agreement.

11. International transfers

• Customer Personal Data is hosted in Singapore, some subprocessors process it in the United States, and Stunda is operated from Pakistan. See the subprocessor page for locations.
• Where Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the parties agree to the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 ("SCCs"), which are incorporated by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is a processor. For the SCCs: clause 7 (docking) applies; in clause 9, option 2 (general authorization) applies with the notice period in section 6 above; the optional wording in clause 11 does not apply; clauses 17 and 18 are governed by and decided in the courts of Ireland; and Annexes I and II are completed by section 2 and section 5 of this DPA.
• For data subject to the UK GDPR, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner applies, with the tables completed by this DPA. For Swiss data, the SCCs apply with references read as the Swiss Federal Act on Data Protection, and the competent authority is the Swiss Federal Data Protection and Information Commissioner.
• Stunda requires subprocessors that receive Customer Personal Data outside the EEA, UK or Switzerland to protect it with SCCs or another valid transfer mechanism.

12. General

• If this DPA conflicts with the Terms on the processing of personal data, this DPA wins. If it conflicts with the SCCs, the SCCs win.
• Each party's liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws or the SCCs do not allow it.
• This DPA ends when Stunda stops processing Customer Personal Data for the Customer.
• Contact for this DPA: help@stunda.io.