This Data Processing Agreement (“DPA”) forms part of the PaperPlane Terms between the Business customer (“Controller”) and code & comments kg (“Processor”). It takes effect when the Controller uses PaperPlane to process personal data for which it determines purposes and means. GDPR article references include corresponding provisions of applicable EEA data-protection law.
1. Instructions and scope
The Processor processes personal data only on documented instructions from the Controller, including these Terms, the Controller’s configuration and its users’ actions, unless Union or Member State law requires otherwise. In that event the Processor will inform the Controller before processing unless prohibited by law. The Processor will immediately inform the Controller if it believes an instruction infringes data-protection law and may suspend that instruction while the parties clarify it.
The subject matter, nature, purpose, data and people are described in Annex 1 below. Processing lasts for the service contract plus the agreed deletion and retrieval periods.
2. Confidentiality and security
The Processor ensures that authorised persons are bound by confidentiality and receive access only as required. It maintains appropriate technical and organisational measures under Article 32, including the measures in Annex 2, taking account of risk, technology, implementation costs and the nature of processing. The Controller is responsible for lawful instructions, user administration, permissions, recipient selection and use of available security settings.
3. Subprocessors
The Controller gives general written authorisation for the subprocessors in the current register. We will give at least 30 days’ notice of an intended addition or replacement where it materially affects processing. The Controller may object on reasonable data-protection grounds during that period. The parties will seek a reasonable solution; if none is available, the Controller may terminate the affected service before the change takes effect.
Subprocessors are bound by data-protection obligations no less protective than this DPA. We remain responsible for their performance to the extent required by Article 28(4).
4. Assistance
Taking account of the nature of processing, we assist the Controller through service functions and reasonable additional measures with requests under Articles 12–22. We do not respond on the Controller’s behalf unless authorised or legally required. We assist with security, breach notifications, data-protection impact assessments and prior consultation under Articles 32–36, taking account of information available to us. Reasonable extraordinary assistance may be charged at an agreed rate where the need was not caused by our breach.
5. Personal-data breaches
We notify the Controller without undue delay after becoming aware of a personal-data breach affecting Controller data. As information becomes available, the notice describes the nature of the breach, likely consequences, affected categories and approximate numbers, contact point, and measures taken or proposed. Notification is not an admission of fault. The Controller remains responsible for notifications to authorities and affected people, with our reasonable assistance.
6. Deletion, return and switching
During the contract the Controller can access and download content through service functions. On termination, and on written request, we make Controller data available in a commonly used, machine-readable format to the extent technically available. Unless law requires retention, live operational content is deleted after the 30-day recovery/retrieval period or earlier permanent deletion instruction. Rotating backups age out under the cycles described in Annex 2 and are not used for ordinary processing. Legally retained billing and evidence data is isolated from the workspace and processed only for the retention purpose.
7. Information and audits
We make available information reasonably necessary to demonstrate Article 28 compliance, including this DPA, security information, subprocessor information and available independent reports. No more than once per year, unless a breach or authority request justifies more, the Controller may request a remote audit on reasonable notice. An on-site audit is available where documentary review is insufficient, subject to confidentiality, security, minimal disruption and reimbursement of reasonable costs. Audits may not expose another customer’s data or compromise system security.
8. International transfers
We process Controller data in the EEA except as identified in the subprocessor register or on the Controller’s instruction. For a restricted transfer we use an applicable adequacy decision or the European Commission Standard Contractual Clauses and supplementary measures. Where required, the Controller authorises us to enter the relevant processor-to-processor clauses on its behalf. We provide information reasonably required for a transfer assessment.
9. Liability and priority
GDPR Article 82 and other mandatory law remain unaffected. Contractual liability and recourse between the parties are governed by the Terms, but no limitation prejudices a data subject’s rights or a supervisory authority’s powers. If this DPA conflicts with the Terms on processing of Controller data, this DPA prevails. Applicable Standard Contractual Clauses prevail over both.
Annex 1 — Processing details
- Subject matter and purpose: hosting and operation of a document archive; upload/import, storage, OCR, metadata extraction, indexing, search, AI-assisted retrieval, sharing, signatures, support, security, backup, deletion and export.
- Nature: collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, transmission to instructed recipients/providers, restriction, deletion and destruction.
- People: Controller’s staff, customers, suppliers, advisers, applicants and any person named or identifiable in documents; workspace members, share recipients and signers.
- Data: identity and contact data, document content and metadata, correspondence, financial and contractual data, signatures, audit/access data and any categories uploaded by the Controller.
- Sensitive data: may include Article 9 special categories and Article 10 criminal-offence data if uploaded by the Controller. The Controller must assess lawfulness and risk before doing so.
- Frequency and duration: continuous or user-triggered for the contract term and deletion cycle.
Annex 2 — Technical and organisational measures
- EU-hosted production compute, database, search and object storage;
- TLS for public network transmission and protected, HttpOnly session cookies where applicable;
- Keycloak authentication, role-based workspace access and tenant-scoped authorisation checks;
- encryption of stored connector credentials and managed production secrets;
- network policies, least-privilege service identities, rate limits and restricted admin surfaces;
- audit events for material workspace actions and security monitoring;
- object-storage versioning with non-current versions normally retained for 30 days;
- daily PostgreSQL backups normally retained for 14 days, with documented restore procedures;
- controlled deployment, dependency updates, incident handling and access limited by operational role; and
- account/document deletion workflows with a 30-day recovery period and permanent-purge paths.
Measures may evolve while maintaining an equivalent or higher level of protection appropriate to risk. Customer-specific requirements require a written agreement.