This data processing agreement ("DPA") is part of the terms of service between the customer that uses a Notulous workspace ("the customer", the controller) and ZAPP Development, Hopstraat 19A, 2611 TA Delft, the Netherlands, KvK 42043946 ("Notulous", the processor). It applies automatically to every workspace, so you don't need to sign anything. If your organisation needs a signed copy, email privacy@notulous.com.
Words such as personal data, processing, controller, processor, data subject and personal data breach have the meaning they have in the General Data Protection Regulation (EU) 2016/679 ("GDPR").
1. Subject and roles
Notulous processes personal data for the customer in order to provide the Notulous service, as described in Annex 1.
The customer is the controller of that personal data, and Notulous is the processor. The customer is responsible for having a legal basis for the processing, and for the instructions it gives.
This DPA lasts as long as Notulous processes personal data for the customer, including the time needed to delete it after the subscription ends.
2. Instructions
Notulous processes the personal data only on the customer's documented instructions. These terms, this DPA, and what the customer and its users set up and do in the workspace are those instructions.
Notulous doesn't use the personal data for its own purposes, and doesn't sell it.
If the law requires Notulous to process the data otherwise, Notulous tells the customer first, unless the law forbids that.
Notulous tells the customer if it thinks an instruction breaks the GDPR.
3. Confidentiality
Notulous makes sure that everyone who can access the personal data is bound to confidentiality, and only accesses it where needed for the service, for support the customer asks for, or to keep the service secure.
4. Security
Notulous takes appropriate technical and organisational measures to protect the personal data, taking into account the state of the art, the costs, and the risks for data subjects. Annex 2 lists them.
Notulous may improve these measures over time, as long as the level of protection doesn't go down.
5. Sub-processors
The customer gives Notulous general permission to use sub-processors. Annex 3 lists the current ones.
Notulous announces a new or replaced sub-processor at least 30 days in advance, by email to the workspace's admins. The customer may object on reasonable grounds within that period. If the parties can't resolve the objection, the customer may cancel the subscription with a pro rata refund of a prepaid period.
Notulous gives each sub-processor the same data protection obligations as in this DPA, and stays responsible to the customer for its sub-processors.
6. Transfers outside the EEA
The workspace databases, files and backups are stored in the European Union. Where a sub-processor processes personal data outside the European Economic Area, Notulous makes sure an adequate safeguard is in place, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
7. Helping the customer
Requests from data subjects. Admins can view, correct, export and delete the data in the workspace themselves. Where they can't, Notulous helps the customer answer requests from data subjects. If a data subject contacts Notulous directly, Notulous passes the request on to the customer and doesn't answer it on its own.
Other obligations. Notulous helps the customer, where reasonable, with data protection impact assessments, prior consultation with a supervisory authority, and security, based on the information available to Notulous.
Help that goes beyond what the service already offers may be charged at our usual rates, after notice.
8. Personal data breaches
Notulous notifies the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach that affects the customer's personal data.
The notification describes, as far as known: what happened, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Notulous adds information as it becomes available.
Notulous takes the measures needed to limit the breach and its consequences. Deciding whether to notify the supervisory authority or data subjects is up to the customer.
9. End of the processing
While the workspace is active, admins can export all of its data at any time.
After the subscription ends, Notulous keeps the data for 30 days so the customer can reactivate the workspace. Notulous then deletes it. Copies in backups are deleted within another 30 days.
If the law requires Notulous to keep some data longer, Notulous keeps only that data, protects it under this DPA, and deletes it when the obligation ends.
10. Audits
On request, Notulous gives the customer the information needed to show that it meets this DPA, such as a description of its security measures.
If that isn't enough, the customer may have an audit done once a year, by an independent auditor bound to confidentiality, after at least 30 days' notice, during office hours and without disturbing the service for other customers. The customer bears the costs of the audit.
11. Liability and precedence
The liability of the parties under this DPA follows the limits in the terms of service, as far as the law allows.
If this DPA and the terms of service conflict on the protection of personal data, this DPA prevails.
Dutch law applies to this DPA, and disputes go to the court named in the terms of service.
Annex 1: The processing
Purpose and nature
Providing Notulous to the customer: storing, showing, searching, sending (in notifications and integrations the customer turns on), exporting, backing up and deleting the data in the workspace. This includes, when the customer turns them on:
Email to issues: reading new email from mailboxes the customer connects, and turning each message into an issue or a comment, with its attachments.
Code links: receiving events from GitHub and Bitbucket repositories the customer connects, and linking branches, commits and pull requests to the issues they mention.
Single sign-on: signing users in through the customer's identity provider, and creating their accounts when the customer allows it.
AI assistants: answering the AI assistants that users connect with a personal access token, with the same permissions as that user.
Categories of data subjects
The customer's employees and other members of its workspace.
The customer's clients and other guests it invites.
People mentioned in the content the customer adds, such as contacts at a client.
People who email a mailbox the customer has connected, such as its clients' staff. Unless the customer turns this off, they are added to the workspace as contacts, which can't sign in until the customer invites them.
People whose names appear in the code events of the customer's repositories, such as developers.
Categories of personal data
Account data: name, email address, job title and role, profile picture, the company someone belongs to, settings, password hash, two-factor sign-in secret, and sign-in sessions.
Content: issues, comments, notes, documents and files, releases, boards, and everything users write in them, which may contain any personal data the customer chooses to add.
Time data: time entries, timers, hourly rates, and reports and invoice exports made from them.
Email data: the sender's name and email address, the subject, the text and attachments of each message read from a connected mailbox, and a record of each message (sender, subject, date and what it became).
Code data: branch names, commit messages and hashes, pull request titles and states, links, and the names or usernames of their authors.
Integration settings: the addresses and logins of connected mailboxes, repository settings, single sign-on settings, and personal access tokens.
Technical data: IP addresses and other request data in server logs.
The service isn't meant for special categories of personal data (article 9 GDPR) or data about criminal convictions. The customer decides whether to put such data in Notulous, and is responsible for doing so.
Duration
For as long as the subscription runs, and up to 60 days after it ends (30 days to reactivate, and 30 days more for the backups).
Annex 2: Security measures
Separation and storage
Every workspace has its own database and its own database login, which can only open that database. The workspace's database credentials are stored encrypted (AES-GCM).
The databases, files and backups are stored in data centres in Germany.
Passwords are never stored, only their Argon2 hashes.
The logins of connected mailboxes (IMAP passwords and the access granted by Google or Microsoft) and the client secrets of single sign-on are stored encrypted (AES-256-GCM). Personal access tokens are stored only as SHA-256 hashes.
Each repository has its own webhook address and secret, and events whose signature doesn't match are refused.
Access
Users sign in with a password and, if they turn it on, a second factor (an authenticator app), with Google, or through the customer's single sign-on. Single sign-on checks the signature, issuer, audience and expiry of every sign-in, and the email domains the customer allows.
Access to a connected mailbox is read-only: Notulous asks Google and Microsoft only for permission to read mail and to see the account's email address, and doesn't change, move or mark anything as read in any mailbox. The customer can withdraw the access at its provider, or remove the mailbox in Notulous, at any time.
An AI assistant connected with a personal access token can only do what that user can do. Users can see when their tokens were last used and revoke them.
Sign-in attempts are limited per account and per network address. Sign-in sessions can be ended by signing out.
Admins decide who can access the workspace and which projects users and guests see.
Access to the production servers is limited to authorised people, with personal SSH keys. The accounts at our hosting and service providers use two-factor sign-in.
In transit
All connections use HTTPS (TLS), with HSTS. The databases can't be reached from the internet.
Availability
Backups of every database are made every hour, stored apart from the servers, and kept for 30 days. Restoring them is tested regularly.
The servers get security updates automatically, and the software is updated at least once a month.
Organisation
Logs are kept for up to 30 days.
Security incidents are handled following section 8, and recorded.
Annex 3: Sub-processors
Hetzner Online GmbH, Germany: hosting of the servers and databases, and storage of uploaded files and backups (Hetzner Object Storage), in Germany.
Railsware Products Studio LLC, Delaware, United States, which operates Mailtrap: sending the emails of the service, such as invites and notifications.
Google Ireland Limited, Ireland: sign-in with Google, for users who choose it.
Functional Software, Inc., California, United States, which operates Sentry: reports of errors in the service, stored in its EU data region (Germany) for [PLACEHOLDER: the retention of the Sentry plan, such as 30 days]. Names, email addresses, cookies, passwords and submitted forms are left out, but a report can contain parts of the customer data involved in the error.
The customer's own integrations are services the customer chooses and connects itself, under its own agreement with them; they are not sub-processors of Notulous. These are Slack, GitHub and Bitbucket, the customer's mailbox at Google, Microsoft or another email provider, its single sign-on provider (such as Microsoft Entra ID, Google Workspace or Okta), the AI assistants its users connect through MCP, and imports from Jira, Asana and Trello.