Data processing agreement

1. Subject

This agreement is part of the terms of service. The customer (controller) processes personal data on the Stafeta platform; Stafeta (processor) does so on the customer's instructions under GDPR Article 28(3).

2. Description of the processing

• Duration: the term of the contract, plus the 60-day export period.
• Nature and purpose: running the platform – storage, display, search, AI drafts and proposals, executing approved steps in the connected tools, notifications, backups.
• Types of data: identification and contact data, job data, the content of cards and documents, e-mails and messages, meeting transcripts, rota and absence (including the fact of sick leave), expense claims and invoices, contracts, GDPR requests, customer and supplier data, files.
• Data subjects: the customer's staff and candidates, its customers, suppliers and partners, people submitting forms, guests invited to the portal.

3. The processor's obligations

• Processes only on the customer's documented instructions (the instructions are the use of the platform and its settings); flags an instruction that would break the law.
• Everyone with access is bound by confidentiality.
• The Article 32 measures are in the annex (two-step sign-in, per-workspace isolation, encryption, logging, EU hosting).
• Assists with data subject rights: forwards a request to the customer within 5 working days and performs the export and deletion in the platform.
• Assists with the obligations of Articles 32–36 (impact assessment, breaches).
• At the end of the contract returns (export) and deletes the data at the customer's choice; the deletion follows the 60-day export period.
• Makes available the information needed to demonstrate compliance; one written report a year, an on-site audit at the customer's cost where justified: audit frequency: once a year.

4. Sub-processors

The customer gives general authorisation for the processors on the sub-processor list. We e-mail about a new sub-processor the notice period: 30 days in advance; the customer may object on reasonable grounds, and if no solution is found, may cancel for the end of the period. We bind sub-processors to the same obligations.

5. Personal data breaches

We notify the customer within 48 hours of becoming aware of a breach, with the known facts (what happened, who is affected, what we did), so the customer can meet its 72-hour deadline. We document the breach.

6. Transfers

The database and files are in the EU. Processing outside the EU happens only as marked on the sub-processor list, under the DPF or SCCs (in particular Anthropic for running the model). We transfer to no other country.

7. Liability

Section 11 of the terms of service governs liability. The parties' liability towards data subjects follows GDPR Article 82.

Annex: technical and organisational measures

• Sign-in: password + authenticator code for everyone; a fresh code for sensitive actions; recovery codes; sign-ins logged.
• Isolation: row-level security (RLS) on every database table by workspace; an AI run queries with the customer's own rights and never sees another company.
• Encryption: TLS on every connection; storage encrypted at the provider; envelope encryption of sensitive fields being introduced.
• The AI agent has no send, delete or pay tool; inbound content reaches it as data only; a prompt-injection screen and a canary.
• Logging: sign-in events, approvals and decisions, guest activity, kiosk events.
• Secrets server-side only, rotated every 90 days; packages only from releases older than 7 days; a secret-leak check on every commit.
• Backups in the EU; the incident runbook in SECURITY.md.