Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Agreement between you (“Customer”) and Voitas Ventures s.r.o. (“Tandmade”) and governs how Tandmade processes personal data on your behalf, as Article 28 of the GDPR requires. You accept it by accepting the Terms of Service; no signature is needed.

Definitions

Terms defined in the GDPR (controller, processor, personal data, processing, personal data breach, data subject, supervisory authority) have the same meaning here. Other capitalised terms have the meaning given in the Terms of Service. “Customer Personal Data” means personal data in Customer Content that Tandmade processes on your behalf. “Sub-processor” means a third party Tandmade engages to process Customer Personal Data. “SCCs” means the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914.

Roles

2.1 You are the controller of Customer Personal Data and Tandmade is your processor. If you act as a processor for your Client, Tandmade is your sub-processor; you confirm that your Client has authorised you to engage Tandmade and that your instructions reflect the Client’s.

2.2 Each party complies with the data protection law that applies to it. Tandmade is the controller for account, billing and usage data under its Privacy Policy; this DPA does not cover that data.

Your instructions

3.1 Tandmade processes Customer Personal Data only on your documented instructions. Your complete instructions are: the Agreement; your use and configuration of the Service, including the actions of your Authorized Users and Connected Agents; and this DPA. They include processing to provide, secure, support and maintain the Service, to fix errors and to measure the quality of AI Features. Further instructions require our written agreement and may carry fees.

3.2 Tandmade may process Customer Personal Data outside your instructions where EU or Member State law requires it; we then tell you first, unless that law prohibits it. We tell you if, in our opinion, an instruction infringes data protection law. We are not obliged to check your instructions legally.

Your responsibilities

4.1 You are responsible for: a lawful basis for all Customer Personal Data; the notices and consents your Sites need (privacy notices, cookie consent, form consents); the accuracy of the data; and setting the retention of form submissions and other content appropriately.

4.2 The Service is not designed for special categories of personal data (Article 9 GDPR), data on criminal convictions (Article 10 GDPR) or data of children. If you collect such data, for example through a form, you do so at your own responsibility and must make sure the measures in Annex II are sufficient for it.

Confidentiality

Tandmade gives access to Customer Personal Data only to staff and contractors who need it to perform the Agreement and who are bound by confidentiality.

Security

6.1 Tandmade implements the technical and organisational measures in Annex II (Article 32 GDPR). We may update them, provided the overall level of protection does not decrease materially.

6.2 You are responsible for securing your accounts, managing your Authorized Users and their roles, and for exports and copies you take out of the Service.

Sub-processors

7.1 You give Tandmade general authorisation to engage Sub-processors. The current list is in Annex III and at tandmade.com/legal/subprocessors.

7.2 We notify you of a new Sub-processor at least 14 days before it starts processing Customer Personal Data, by email to the Workspace owner or by updating the list, which you can subscribe to. You may object on reasonable data protection grounds within those 14 days. If we cannot address your objection, your sole remedy is to terminate the affected Plans with effect before the change, and we refund prepaid fees for the unused period.

7.3 We impose on each Sub-processor data protection obligations equivalent in substance to this DPA, and remain responsible to you for its performance as Article 28(4) GDPR requires, subject to Section 12.

Requests from data subjects

8.1 The Service lets you find, export, correct and delete Customer Personal Data, including collection entries and form submissions. Use these tools first.

8.2 If a data subject contacts us about Customer Personal Data, we refer them to you and do not respond ourselves unless you instruct us or the law requires it. Where the tools are not enough, we assist you with reasonable measures, taking into account the nature of the processing. Assistance beyond the tools may be charged at our standard rates.

Personal data breaches

9.1 Tandmade notifies you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice describes, as far as then known, the nature of the breach, the data and data subjects concerned, its likely consequences, and the measures taken or proposed. We provide further information as it becomes available.

9.2 You are responsible for notifying supervisory authorities and data subjects where required. Our notice or assistance is not an admission of fault or liability.

Impact assessments

Tandmade provides the information reasonably available to it to help you carry out data protection impact assessments and prior consultations (Articles 35 and 36 GDPR). Assistance beyond providing existing documentation may be charged.

Deletion and return

11.1 During the Agreement you can export and delete Customer Personal Data at any time. For 30 days after the Agreement ends, you may ask us to export it.

11.2 After that, Tandmade deletes Customer Personal Data from its active systems within 60 days. Copies in backups and logs are deleted as they rotate out of their retention cycles and stay protected under this DPA until then. This does not apply where EU or Member State law requires storage. On request, we confirm deletion in writing.

Audits

12.1 On request, Tandmade provides the information necessary to demonstrate compliance with Article 28 GDPR: this DPA, Annex II, and the security certifications or reports of our main Sub-processors where available.

12.2 If that information is insufficient, or a supervisory authority requires it, you may audit our compliance with this DPA no more than once every 12 months, with 30 days’ written notice, during business hours, through an independent auditor bound to confidentiality who is not our competitor. The audit must be limited to what is necessary, must not disrupt the Service or give access to other customers’ data, and is at your cost. We may charge reasonable fees for our time.

Transfers outside the EEA

Tandmade and its Sub-processors may process Customer Personal Data outside the European Economic Area. Each such transfer is based on an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or on the SCCs, Module 3 (processor to processor), with supplementary measures where needed.

Liability

Each party’s liability arising out of or in connection with this DPA is subject to the limitations and exclusions in the Terms of Service, and counts towards the same overall cap. This does not limit any party’s liability to data subjects under Article 82 GDPR.

Term and precedence

This DPA applies for as long as Tandmade processes Customer Personal Data. If it conflicts with the Terms of Service on the processing of personal data, this DPA prevails. Its governing law and courts are those of the Terms of Service.

Annex I — Description of the processing

Annex II — Technical and organisational measures

• Encryption. All connections to the Service and to Sites use TLS. Our infrastructure providers encrypt databases and file storage at rest.
• Separation. Each Site has its own database and file storage, separate from other Sites and from the platform’s own data.
• Access for customers. Passwordless sign-in (single-use magic links, Google, GitHub); rate limits on sign-in; a list of active devices with remote sign-out; roles in Workspaces (owner, admin, member, content editor) and access limited to selected projects.
• Access for staff. Production access only for named staff who need it; administrative actions are recorded in an audit log; payment and AI provider keys are held only by the edge service and never by the containers that run Site code.
• Logging and monitoring. Audit log of security-relevant actions (sign-in, invitations, role changes, deletions, suspensions); error monitoring configured not to send personal data by default.
• Availability and recovery. Global hosting network; platform state backed up to object storage every minute; point-in-time recovery of databases offered by our infrastructure provider.
• Abuse protection. Rate limits; spam protection for forms (honeypot field, optional bot challenge); suspension of accounts and Sites.
• Data minimisation. Visitor statistics store no IP addresses, cookies or visitor identifiers.
• Secure development. Changes go through pull requests and automated tests; continuous integration scans for leaked secrets and known vulnerabilities.
• People and vendors. Confidentiality obligations for staff and contractors; data processing agreements with every Sub-processor.
• Incidents. A documented process to investigate breaches and notify customers (Section 9).

Annex III — Sub-processors