Data Processing Agreement

Draft. This page is a placeholder: it has the shape of the final document, not its approved wording. Nothing here is the agreement yet.

Last updated: not yet published.

Who this is between

You, the customer named on the account, and [company name], registered in Romania, which operates Klienta. It applies whenever you use Klienta, alongside the Terms of Service.

Which of us decides what

The people in your workspace — your contacts, leads, the companies you sell to — are yours. You decide why you hold them and what is done with them: in the law's words, you are the controller and we are the processor. For your own account details, such as your name and sign-in, we are the controller, and the Privacy Policy covers those.

What we process, and about whom

What you put into the workspace: names, email addresses, phone numbers, companies and job titles; the notes, calls, follow-ups and offers recorded against them; the email you file through Klienta; and the answers people send through your forms. The people are your customers, your leads and the people who work for them, and the employees you invite to your workspace.

For how long

For as long as your workspace is open. What happens at the end is under “When it ends” below.

We act on your instructions

We process this data only to run Klienta for you, and only as you tell us to — through the product, or in writing. If the law requires us to do something else, we will tell you first unless the law forbids it. We do not sell it, and we do not use it to train anything.

Who on our side can see it

Only the people who need to, and each of them is bound to keep it confidential. When our support looks at your workspace it is read-only, and you can see it happening.

How we keep it safe

The measures are described on the security page, which is part of this agreement. [Hosting, backups and encryption at rest to be confirmed before publication.]

The companies that help us run it

We use other providers to run the service, and each is bound by the same obligations. [Sub-processor list and their regions to be confirmed: Google for sending email, Resend for notifications, Cloudflare for file storage, and our hosting provider.] We will tell you before a new one starts, and you may object.

Where the data is

[Hosting region to be confirmed. If any provider processes data outside the European Economic Area, the safeguard relied on — usually the European Commission's standard contractual clauses — to be named here.]

When somebody asks for their data

Klienta gives you the tools: every record can be found, corrected and erased in the product, and consent is kept on the contact. If a request needs us, ask and we will help you answer it in time, at no charge.

If something goes wrong

If personal data in your workspace is lost or exposed, we will tell you without undue delay, with what we know: what happened, whose data it touched, what we are doing about it, and what you may need to do.

Assessments and questions from your regulator

If you have to carry out a data protection impact assessment, or answer your supervisory authority, we will give you the information we hold that you need.

Showing our work

Ask and we will give you what you need to see that we are keeping to this agreement. If that is not enough, you may audit us, or have somebody audit us on your behalf, at a reasonable time and not more than once a year unless the law or an incident requires it.

When it ends

When your workspace closes you can ask for your data back — we send it as a spreadsheet — and then we erase it, along with the copies in our backups as those expire. [Backup retention period to be confirmed.] We keep only what the law makes us keep.

If this and the terms disagree

For personal data, this agreement wins. [Liability wording to be confirmed with legal counsel.]

Contact

Questions about this agreement, or a request under it: contact@klienta.org.