Home / Data Processing Agreement (DPA)

Data Processing Agreement (DPA)

This DPA implements Article 28 of the GDPR between GDE Systems OÜ (processor) and the customer (controller). It is public so that a pilot does not wait for legal review, and it is versioned so that an auditor can see which text applied.

18 October 2026v1.0GDE Systems OÜ

1. Parties and roles

• Processor: GDE Systems OÜ, Tallinn, Estonia, support@gde.ee (the "Processor").
• Controller: the customer identified in the workspace account (the "Controller").
• For its own account data (e-mail, name, billing) GDE Systems OÜ acts as an independent controller under the Privacy Policy; this DPA applies to the business records the Controller enters into the service.

2. Subject matter, nature and purpose

• The Processor provides a web application for invoicing, client and deal management, time tracking and document storage (the "Service").
• Processing consists of storage, synchronisation, encryption at rest as designed by the Controller, retrieval, export and deletion of the Controller's data.
• The Processor does not process Controller data for its own purposes, does not build advertising profiles and does not sell data.

3. Categories of data subjects and personal data

• Data subjects: employees and contractors of the Controller; contact persons at the Controller's customers and suppliers.
• Personal data: identification and contact data (name, e-mail, phone, address), business relationship data, and the personal data contained in invoices and documents.
• Special categories of personal data (Art. 9) are not required by the Service and must not be entered.

4. Duration

• Processing lasts for the term of the agreement plus the retention period required by Estonian law (invoices: at least 7 years).
• After termination, Controller data is deleted within 30 days unless a legal retention obligation requires otherwise; the Controller can export everything in machine-readable form before deletion.

5. Documented instructions

• The Processor processes personal data only on documented instructions from the Controller, including transfers to a third country, unless required by Union or Member State law; in that case the Processor informs the Controller before processing, unless prohibited by law.
• The Service configuration chosen by the Controller (vault on/off, optional AI lookup, optional external storage) constitutes the documented instruction for the corresponding processing.

6. Confidentiality and personnel

• Persons authorised to process personal data are bound by confidentiality obligations that survive termination.
• Access follows least privilege; production access is limited to named individuals and reviewed when team composition changes.

7. Security measures (Art. 32)

• Client-side AES-256-GCM encryption with PBKDF2 (600,000 iterations) key derivation; the Processor never receives the encryption key or recovery phrase.
• Encryption in transit (TLS 1.2+), tenant separation between workspaces, role-based access control, session and device management.
• Audit log of security-relevant events: 30 days on Pro, 90 days on Business, exportable by the Controller.
• Build-time guard against shipping secrets to the browser; public page inventory of third-party scripts.
• The current measures are described in detail on the Security page, which forms part of this DPA by reference.

8. Subprocessors

• The Controller gives general authorisation to engage subprocessors from the public, versioned Subprocessor list.
• The Processor gives at least 30 days' notice before adding or replacing a subprocessor and allows the Controller to object; if the objection cannot be resolved, the Controller may terminate without penalty.
• Every subprocessor is bound by data protection obligations no less protective than this DPA, in particular regarding security and breach notification.

9. Assistance to the Controller

• The Processor assists with data subject requests (access, rectification, erasure, portability, objection) within 5 business days of a request sent to privacy@gde.ee.
• The Processor assists with data protection impact assessments and prior consultations with supervisory authorities, taking into account the nature of the processing.
• Self-service tools in the Service (export, delete workspace, revoke sessions) satisfy most requests without Processor involvement, which the Processor recommends for speed.

10. Personal data breach notification

• The Processor notifies the Controller without undue delay and targets 24 hours after confirming a breach, so that the Controller can meet its own 72-hour obligation under Article 33.
• The notification contains: nature of the breach, categories and approximate number of data subjects and records, likely consequences, measures taken or proposed, and a contact point.
• Where the data was client-side encrypted, the Processor states explicitly whether the affected payload was readable, and does not speculate beyond evidence.

11. Audit

• The Processor makes available all information necessary to demonstrate compliance, including this DPA, the Security page, the Subprocessor list and the audit log.
• Once per year, the Controller may conduct an audit by written questionnaire, or on site with 30 days' notice and under confidentiality, during the beta limited to two business days.
• The Processor informs the Controller promptly if an instruction infringes the GDPR or other Union or Member State data protection provisions.

12. Return and deletion

• The Controller may export all data at any time in machine-readable form (CSV) together with generated documents (PDF).
• After termination the Processor deletes personal data within 30 days and confirms deletion in writing on request, except for data that must be retained by law.
• Backups are rotated out within 35 days of deletion.

13. International transfers

• Production data is stored in the EEA (Frankfurt).
• The only transfers outside the EEA relate to Cloudflare (edge), Resend (e-mail) and Google Gemini (optional AI lookup), each covered by Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
• An EU-only configuration (no AI lookup, EU data localisation at the edge) is available on request for regulated customers.

14. Liability and precedence

• Liability under this DPA is subject to the limitations in the Terms of Service, including the beta clause (no SLA, no uptime guarantee).
• In case of conflict between this DPA and the Terms of Service on data protection matters, this DPA prevails.
• The DPA is governed by the law of the Republic of Estonia; the controller's statutory rights under the GDPR are unaffected.

Annex 1 — Subprocessors

The subprocessors authorised as of the version date, with purpose, region and transfer basis:

This page is a product and compliance document, not legal advice. Contracts, transfer mechanisms and retention periods are reviewed by Estonian counsel before they become binding.

gde.ee · Data Processing Agreement — gde.ee · https://gde.ee/en/dpa/