Data Processing Agreement

Draft. This page is a placeholder: it has the shape of the final document, not its approved wording. Nothing here is the agreement yet.

Last updated: not yet published.

Who this is between

You, the customer named on the account, and [company name], registered in Romania, which operates Klienta. It applies whenever you use Klienta, alongside the Terms of Service.

Which of us decides what

The people in your workspace — your contacts, leads, the companies you sell to — are yours. You decide why you hold them and what is done with them: in the law's words, you are the controller and we are the processor. For your own account details, such as your name and sign-in, we are the controller, and the Privacy Policy covers those.

What we process, and about whom

What you put into the workspace: names, email addresses, phone numbers, companies and job titles; the notes, calls, follow-ups and offers recorded against them; the email you file through Klienta; and the answers people send through your forms. The people are your customers, your leads and the people who work for them, and the employees you invite to your workspace.

For how long

For as long as your workspace is open. What happens at the end is under “When it ends” below.

We act on your instructions

We process this data only to run Klienta for you, and only as you tell us to — through the product, or in writing. If the law requires us to do something else, we will tell you first unless the law forbids it. We do not sell it, and we do not use it to train anything.

Who on our side can see it

Only the people who need to, and each of them is bound to keep it confidential. When our support looks at your workspace it is read-only, and you can see it happening.

How we keep it safe

The measures are described on the security page, which is part of this agreement. Hosting and PostgreSQL run on Railway in Amsterdam, EU, with encrypted database backups scheduled daily to Cloudflare R2 in the EU and a configured 35-day lifecycle.

The companies that help us run it

We use other providers to run the service, and each is bound by the same obligations. [Sub-processor list and their regions to be confirmed: Google for sending email, Resend for notifications, Cloudflare for file storage, and our hosting provider.] We will tell you before a new one starts, and you may object.

Where the data is

[Application hosting and PostgreSQL: Railway, Amsterdam, EU. Database backups: Cloudflare R2, EU jurisdiction; daily schedule and first upload verified on 12 October 2026. If any provider processes data outside the European Economic Area, the safeguard relied on — usually the European Commission's standard contractual clauses — to be named here.]

When somebody asks for their data

You can manage supported records and record consent in Klienta. Personal-data erasure requires an authorised Klienta operator; the current tool covers contacts and legacy clients, and other copies need separate handling. Contact us for access, correction, export or erasure requests so we can identify the data involved and help you respond.

If something goes wrong

If personal data in your workspace is lost or exposed, we will tell you without undue delay, with what we know: what happened, whose data it touched, what we are doing about it, and what you may need to do.

Assessments and questions from your regulator

If you have to carry out a data protection impact assessment, or answer your supervisory authority, we will give you the information we hold that you need.

Showing our work

Ask and we will give you what you need to see that we are keeping to this agreement. If that is not enough, you may audit us, or have somebody audit us on your behalf, at a reasonable time and not more than once a year unless the law or an incident requires it.

When it ends

When your workspace closes you can ask for your data back — we send it as a spreadsheet — and then we erase it, along with the copies in our backups as those expire. [New database archives expire after 35 days; retention and deletion of legacy archives still need confirmation.] We keep only what the law makes us keep.

If this and the terms disagree

For personal data, this agreement wins. [Liability wording to be confirmed with legal counsel.]

Contact

Questions about this agreement, or a request under it: contact@phantomtechind.com.