Data processing agreement

1. Subject matter and duration

We process personal data on behalf of the customer in order to provide, operate and support Etappe Flow and Etappe Book under the terms of service. This agreement applies for as long as the main contract runs and beyond that until we have deleted all of the customer's data.

2. Types of data and data subjects

Data: names and contact details of users, login and usage data (such as sessions and the security log), all content the customer stores — tickets, comments, attachments, documentation pages — including the personal data contained in it, notification settings and device identifiers for push notifications.

Data subjects: the customer's employees, its customers and their contacts, and other persons appearing in the content.

Special categories of personal data (Art. 9 GDPR) are not intended. If the customer stores them nonetheless, it is responsible for doing so.

3. Instructions

We process the data only on documented instructions from the customer. Instructions are this agreement, the terms of service and the settings the customer makes in its workspace — such as enabled integrations or the AI switches. The customer gives further instructions in text form.

If, in our view, an instruction infringes data protection law, we inform the customer. We notify the customer of a legal obligation to process in advance, unless the law prohibits this.

4. Our obligations

Everyone at our company with access to the customer's data is bound to confidentiality.

We assist the customer by appropriate means with requests from data subjects (Art. 15 to 22 GDPR) and with its obligations under Art. 32 to 36 GDPR. If a data subject contacts us directly, we forward the request to the customer.

We notify the customer of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it, with the information it needs for its own notification.

5. Technical and organisational measures

Location: the application, database and backups are hosted by Hetzner Online GmbH in data centres in Germany. Attachments and documentation images are stored in object storage of Cloudflare, Inc. with EU data residency.

Access: the servers accept connections only through Cloudflare's edge; administrative access is key-based only. All connections are encrypted with TLS.

Separation and permissions: each workspace is logically separated from all others. Visibility rules — internal comments, private tickets, company and project access — are enforced by the server, not the browser.

Authentication: passwords are stored only as hashes. Login attempts are throttled per account and per address; unusual numbers of locked accounts raise an alarm. Security-relevant events are recorded in a log kept for 730 days.

Availability: data is backed up daily, additionally to separate storage in the EU. An independent monitor checks operation every minute and publishes incidents at status.etappe.ai.

We develop these measures in line with the state of the art. We may change them as long as the level of protection does not decrease.

6. Sub-processors

The customer authorises us to engage the following sub-processors. We bind them contractually to an equivalent level of protection.

Hetzner Online GmbH, Germany — hosting of the application and database, backups.

Cloudflare, Inc., USA — object storage for attachments with EU data residency, DNS, encryption and protection of connections.

Anthropic, PBC, USA — language model for the AI features, only while AI is switched on.

Voyage AI, Inc., USA — vector representations for finding related tickets and articles, only while AI is switched on.

Mailgun Technologies, Inc., EU region — sending notifications and system emails.

Apple Inc., USA — push notifications to the iOS app, only for persons who have switched push on.

Transfers to the USA are based on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

We announce new or changed sub-processors to administrators by email at least four weeks in advance. The customer may object for an important data protection reason; if we find no solution, it may terminate the contract with effect from the change.

Integrations the customer switches on itself — such as Slack, GitHub or FastBill — are not our sub-processors. Data then goes, on the customer's instruction, to the customer's own contractual partner.

7. Evidence and audits

On request we demonstrate to the customer that we comply with this agreement. On-site audits are possible after notice of 30 days during business hours, at most once a year unless a specific reason justifies more. The customer bears the costs.

8. Deletion and return

When the contract ends, we freeze the workspace and delete all of the customer's data completely after 30 days. Until then we provide it to the customer on request in a common, machine-readable format.

We do not clean backups individually; deleted data drops out as the backups rotate, after three months at the latest. An archive copy of uploaded files is currently not cleaned automatically; on request we delete the customer's files there specifically.

Data we are legally required to keep — such as invoices — we keep until the retention period ends.

9. Liability and precedence

Liability is governed by Art. 82 GDPR and otherwise by the terms of service. Where this agreement conflicts with the terms of service on a question of data protection, this agreement prevails.

This agreement is governed by the laws of the Republic of Cyprus. If the German and English versions differ, the English version prevails.