Data Processing Addendum

This Data Processing Addendum (DPA) forms part of the Terms of Service between you (Controller) and Torsten Labs DOO (Processor) and applies whenever we process personal data on your behalf through poolse.

It takes effect automatically when you accept the Terms — you do not need to sign anything. If your procurement process requires a countersigned copy, email [email protected] with your entity details and we will return an executed PDF, normally within two business days.

Terms defined in the GDPR — controller, processor, personal data, processing, data subject, personal data breach, supervisory authority — carry their GDPR meaning here. Terms defined in the Terms of Service keep that meaning.

1. Roles

You are the controller of the personal data contained in Customer Content. You decide the purposes and means; you hold the legal basis; you are responsible for the notices and consents your End Users are owed. We are the processor and act only on your documented instructions.

For our own account, billing, and support data about you, we are an independent controller and the Privacy Policy governs that processing. This DPA does not apply to it.

Where a US state privacy law applies, we act as your service provider (California) or processor (Colorado, Connecticut, Virginia and comparable statutes). We do not sell or share personal information, do not retain it outside the direct business relationship, do not use it for any purpose other than providing the Service, and do not combine it with data from other sources except as those statutes permit.

2. Scope of the processing

3. Your instructions

Our processing instructions are: the Terms, this DPA, the configuration you set in the dashboard and through the API, and any further written instruction you give that is within the scope of the Service.

We will not process personal data for any other purpose. If we believe an instruction infringes the GDPR or another applicable data protection law, we will tell you and may suspend the affected processing until it is resolved. If we are required by law to process beyond your instructions, we will tell you first unless that law forbids it on important grounds of public interest.

4. Confidentiality

Everyone we authorise to process personal data is bound by an enforceable duty of confidentiality that survives the end of their engagement, is instructed on their obligations, and is given access only to what their role requires. Access to production servers is by personal SSH key only; the operator console requires a password and a one-time code sent by email, and records privileged actions in an append-only audit log.

5. Subprocessors

You give general written authorisation for us to engage subprocessors. The current list, with each one's purpose, location, and transfer mechanism, is published and maintained at /legal/subprocessors.

Before a new subprocessor starts processing your data, we will give at least 30 days' notice by email to your account's administrative contacts and by updating that page. You may object on reasonable data protection grounds within that period. If you do, we will work with you in good faith to find an alternative; if we cannot within a reasonable time, you may terminate the affected part of the Service without penalty and we will refund the unused prepaid portion.

Every subprocessor is bound by a written contract imposing data protection obligations no less protective than this DPA. We remain fully liable to you for a subprocessor's performance.

6. Security

We implement the technical and organisational measures required by Art. 32 GDPR, including:

• Encryption at rest of message bodies, webhook signing secrets and push credentials with AES-256-GCM under a Data Encryption Key unique to your workspace, itself wrapped by a master key (envelope encryption). Other data is stored without application-level encryption; the encryption docs list which. Our servers hold the keys; this is not end-to-end encryption.
• Encryption in transit — TLS 1.2 or higher for REST, WSS for the realtime transport, HSTS enabled, plain HTTP redirected. Call media is encrypted in transit (DTLS-SRTP).
• Pseudonymisation — your End Users are identified by the opaque external_id you assign, not by a name we hold.
• Access control — least privilege; production servers reachable by SSH key only, with password and root login disabled and a default-deny firewall; a password plus emailed one-time code for the operator console; and an operator console with no code path that decrypts message bodies, verified by an automated regression test.
• Credential protection — bcrypt-hashed passwords; API-key secrets stored as a keyed hash (HMAC-SHA256); short-lived signed tokens for browser and mobile clients.
• Integrity — HMAC-SHA256 signed webhook deliveries with a five-minute replay window; append-only audit logging of privileged actions.
• Resilience and recovery — nightly database backups kept for 35 days; rate limiting and denial-of-service protection at the edge.
• Tenant isolation — every query is scoped to a workspace, enforced at the data-access layer rather than left to callers.
• Secure development — an automated test suite that runs on every change to the backend, automated dependency update alerts, and deployment from version control only.
• Deletion — deleting a workspace purges its data and destroys its key, so no remaining copy in the live system can be decrypted.

We may update these measures as technology moves, provided the level of protection does not decrease. The current description is available on request in a form suitable for your own vendor assessment.

7. Assistance to you

Taking into account the nature of the processing and the information available to us, we will assist you with:

• Data subject requests — where an End User contacts us directly we will not respond substantively, but will refer them to you and tell you promptly. The API lets you read and correct End User data yourself. Where you need data deleted or exported that the API does not cover, ask us and we will do it within one month, at no charge for a reasonable volume of requests.
• Security of processing, breach notification, and impact assessments — Art. 32 to 36 GDPR, including prior consultation with a supervisory authority where required.

8. Personal data breaches

We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting your personal data. The notice will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, the measures taken or proposed, and a contact point for more information — supplemented as the investigation progresses where not all of it is available at first.

You are responsible for notifying your supervisory authority and your End Users, since you hold the controller relationship. We will provide the information you reasonably need to do that.

9. Audits

We will make available all information reasonably necessary to demonstrate compliance with Art. 28 GDPR, and allow for and contribute to audits and inspections conducted by you or an independent auditor you mandate.

In practice: we will first offer our current security documentation and answers to a reasonable security questionnaire, which satisfies most audits. Where that is genuinely insufficient, you may conduct an on-site or remote audit once per twelve months (and additionally after a personal data breach affecting your data, or where a supervisory authority requires it), on 30 days' written notice, during business hours, limited to systems processing your data, subject to confidentiality, and conducted so as not to disrupt our operations or the data of other customers. You bear your own costs; we bear ours, unless the audit reveals a material breach on our side, in which case we bear both.

10. Return and deletion

On termination, and at any time on your written request, we will delete your personal data. Concretely:

• Deleting a workspace, from the dashboard or on your request, takes effect at once: its database rows and attachment objects are purged and its Data Encryption Key is destroyed. Read anything you want to keep through the API before you delete.
• Backups are not individually edited. Each is kept for 35 days and then deleted, so data deleted from the live system can remain in backups taken before the deletion for up to 35 days. Backups are never restored to reverse a deletion.
• We may retain personal data where EU, UK, or North Macedonian law requires it, and only for as long and to the extent that law requires, with the protections of this DPA continuing to apply.

We will confirm deletion in writing on request.

11. International transfers

Torsten Labs DOO is established in North Macedonia, for which the European Commission has issued no adequacy decision. Where you transfer personal data from the EEA, the UK, or Switzerland to us, the following apply and are incorporated into this DPA by reference:

• The EU Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor) — or Module Three (processor to processor) where you are yourself a processor for your customer — with you as data exporter and Torsten Labs DOO as data importer.
  • Clause 7 (docking) applies.
  • Clause 9: Option 2, general written authorisation, with the 30-day notice period in § 5.
  • Clause 11: the optional independent dispute-resolution body is not used.
  • Clause 17: governed by the law of Ireland.
  • Clause 18(b): the courts of Ireland.
  • Annex I(A) parties: as identified in your account and in this DPA. Annex I(B) description of transfer: § 2. Annex I(C) competent supervisory authority: determined under Clause 13. Annex II technical and organisational measures: § 6. Annex III subprocessors: /legal/subprocessors.
• For UK transfers, the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner (version B1.0), with Tables 1 to 4 completed by reference to this DPA and neither party permitted to end the Addendum under Section 19 except as the Addendum itself allows.
• For Swiss transfers, the SCCs apply with the adaptations the Federal Data Protection and Information Commissioner requires: references to the GDPR are read as references to the revFADP, the FDPIC is the competent authority, and the term "member state" does not restrict Swiss data subjects from suing in Switzerland.

We apply the supplementary measures described in § 6 and handle government access requests under our request policy: we will challenge any request that appears unlawful or overbroad, will disclose only the minimum legally required, and will tell you unless legally prohibited, in which case we will use reasonable efforts to obtain a waiver.

The application servers and database run in Frankfurt, Germany. Attachments are stored in Cloudflare R2, which is not restricted to the EU. Subprocessors outside the EEA, and the transfer mechanism each relies on, are listed at /legal/subprocessors.

12. Liability and precedence

Each party's liability under this DPA is subject to the limitations in § 17 of the Terms of Service, except where those limitations are not permitted by applicable data protection law.

If this DPA conflicts with the Terms, this DPA controls on data protection. If this DPA conflicts with the Standard Contractual Clauses, the Clauses control.

13. Contact