Data processing agreement
Last updated:
Scope and roles
This agreement applies when your organization (the controller) uses windeal to process personal data, and Adrian Wasielewski, ul. Rzeźnicza 10/26, 31-540 Kraków, Poland (the processor) processes it on your behalf, in accordance with Art. 28 GDPR. It forms part of the Terms of service.
Subject matter, nature and duration
Processing consists of storing, organizing, displaying, syncing, sending and deleting CRM data for the duration of the agreement. Data subjects are your contacts, leads and workspace users. Data categories are names, business contact details, communication history including emails, activities, notes and deal information.
Instructions
We process personal data only on your documented instructions, which are these terms and the settings you and your users choose in windeal, including connecting Google or an AI assistant. We will tell you if we believe an instruction breaks data protection law.
Confidentiality
Everyone authorized to process the data is bound by confidentiality.
Security measures
We apply appropriate technical and organizational measures under Art. 32 GDPR, including encryption of sensitive contact fields and connection tokens with a key per workspace, masking by default, an audit trail of access, encryption in transit, least-privilege access and backups.
Sub-processors
You authorize these sub-processors: Cloudflare, Inc. (USA; network delivery and protection, and receiving Smart BCC emails, under the Data Privacy Framework and standard contractual clauses) and Brevo (Sendinblue SAS, France; service email delivery). We announce new sub-processors to workspace owners by email at least 30 days in advance, and you may object on reasonable data protection grounds. We impose the same data protection obligations on every sub-processor. Google and AI assistant providers are not our sub-processors: each user connects them on their own instruction.
Assistance and breach notification
We help you answer data subject requests and carry out data protection impact assessments. We notify you without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting your data.
Return and deletion
When the agreement ends, you can export your data. We erase the workspace 30 days after it is deleted and overwrite backup copies within a further 30 days, unless the law requires us to keep the data.
Audits
We make available the information needed to demonstrate compliance with this agreement and allow audits with reasonable notice, at your cost, no more than once a year unless a breach has occurred.