Data Processing Agreement

1. Subject and duration

The Provider processes personal data on behalf of the Customer in order to provide GrantFlow: recording working time, personnel and other costs, reporting and keeping audit records for EU-funded grants. The details (data subjects, categories of data, purpose, nature and duration) are in Annex 1. This DPA lasts as long as the Provider processes personal data for the Customer.

2. Instructions

The Provider processes personal data only on documented instructions from the Customer. The Terms of Service, this DPA and the way the Customer configures and uses GrantFlow (for example which projects, people and integrations it sets up) are the Customer's complete instructions. Further instructions must be in writing.

If the Provider believes an instruction infringes data protection law, it informs the Customer without delay and may suspend that instruction. Where Union or Member State law requires processing, the Provider informs the Customer before processing, unless that law prohibits it.

3. Confidentiality

The Provider ensures that persons authorised to process personal data are bound by confidentiality and access only what they need for their task (for example to resolve a support request the Customer has raised).

4. Security

The Provider implements the technical and organisational measures in Annex 2, appropriate to the risk (GDPR Art. 32). It may update them as long as the overall level of protection does not decrease.

5. Sub-processors

The Customer gives a general authorisation for the sub-processors listed in Annex 3. The Provider informs the Customer at least 30 days before adding or replacing a sub-processor. The Customer may object on reasonable data-protection grounds within that period; if the parties cannot agree, the Customer may terminate the affected service and receive a refund of fees paid in advance for the period after termination.

The Provider imposes on each sub-processor data protection obligations equivalent to this DPA and remains liable to the Customer for its sub-processors.

6. Transfers outside the EEA

The Customer's database and files are hosted in the European Union (Ireland). Where a sub-processor or its group may access personal data from a country outside the EEA, the transfer is based on an adequacy decision (including the EU–US Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses.

7. Help with data subjects' rights and with compliance

GrantFlow gives the Customer tools to answer data subjects itself: export of a person's data, correction of records by a new version (signed records are never overwritten), pseudonymisation of a profile and the audit trail. If the Provider receives a request directly, it forwards it to the Customer within 5 working days and does not answer it on its own.

Taking into account the nature of processing and the information available to it, the Provider helps the Customer with security, breach notification, data protection impact assessments and prior consultation (GDPR Arts. 32–36).

8. Personal data breaches

The Provider notifies the Customer of a personal data breach without undue delay and in any case within 48 hours after becoming aware of it, so that the Customer can meet its own 72-hour deadline. The notification describes, as far as known: the nature of the breach, the categories and approximate number of persons and records concerned, the likely consequences, and the measures taken or proposed. Information that is not yet available is provided as soon as it is.

9. End of the service: return and deletion

During the contract and for 30 days after it ends, the Customer can export all its data, in particular through the audit package (timesheets in PDF, Form C, ledger, receipts, certificates, documents and the audit trail).

The Provider then deletes the Customer's personal data within a further 60 days, unless Union or Member State law requires storage, or the Customer has asked in writing for the read-only archive to be kept for the EU grant retention period (5 years after the balance payment) under a separate arrangement. Data in backups is deleted when the backups are overwritten in their normal cycle and is not restored in the meantime except for disaster recovery.

10. Information and audits

The Provider makes available the information needed to demonstrate compliance with Article 28 GDPR. The Customer (or an independent auditor bound by confidentiality) may audit the Provider once a year, with at least 30 days' notice, during business hours and at the Customer's cost, or at any time after a personal data breach. Where available, certifications or audit reports of the Provider or its sub-processors are provided first and may make an on-site audit unnecessary.

11. The Customer's obligations

• The Customer has a legal basis for the processing and informs its staff and the other persons concerned (for example with its own employee privacy notice).
• The Customer keeps the data accurate and limits it to what the grant requires. It should avoid recording health information where a neutral absence type is enough.
• Consortia: each partner organisation is the controller of its own staff's data. When a coordinator invites partner organisations, the Customer confirms that the consortium agreement allows the coordinator to see the data it sees in GrantFlow (roles restrict organisation administrators to their own organisation).
• The Customer manages its users, assigns roles and switches on two-factor sign-in for its users where appropriate.

12. Liability, term and law

Liability under this DPA follows the Terms of Service, without limiting the rights of data subjects under Article 82 GDPR. This DPA is governed by Romanian law; disputes are heard by the competent courts of București.

Annex 1 — Description of the processing

Annex 2 — Technical and organisational measures

• Location: database and files hosted in the European Union (Ireland); application servers in Dublin.
• Encryption: all connections over TLS; data encrypted at rest by the hosting provider.
• Access control: sign-in with password (stored only as a hash by the authentication service), optional two-factor sign-in that the service then enforces, single sign-on with Microsoft, Google or SAML where configured; public sign-up disabled, accounts created by administrators.
• Authorisation: six roles with least privilege; organisation administrators see only their organisation; auditors have read-only access; Row Level Security enabled on every database table.
• Integrity: rules in the database itself prevent changing or deleting signed timesheets, approved expenses, the ledger (corrected only by reversal), receipts, certificates, documents and the audit trail; four-eyes principle for timesheets and expenses.
• Traceability: every change, export and download is logged with person, time, IP address and reason in a hash-chained audit log whose integrity can be verified.
• Files: type checked from the file's content, size-limited, stored with a SHA-256 fingerprint; receipts are read by text recognition in the user's browser.
• Retention: closed projects can be archived read-only for the EU retention period; profiles can be pseudonymised.
• Monitoring: technical error reports have personal data removed before they are sent.
• Secrets: service keys are kept only on the server, never in the browser.
• Backups and recovery: backups by the database hosting provider according to the service plan. [TO CONFIRM: daily backups with a stated retention, once the paid plan is active.]
• Development: automated tests of the compliance rules and of every main user flow before each release.
• People: confidentiality obligations for everyone with access; access limited to what a task requires.

Annex 3 — Sub-processors

Public services that receive no personal data: European Central Bank (exchange rates), Nager.Date (public holidays).