Data Processing Agreement

1. Parties and Scope

This Data Processing Agreement ("DPA") is between the customer that uses Workspace Sync ("Customer", the controller) and Web rješenja d.o.o., Markuševečka cesta 115, 10040 Zagreb, Croatia, OIB 97669668809 ("we", the processor).

It forms part of our Terms of Service and applies automatically to every Customer, without a separate signature, whenever we process personal data on the Customer's behalf. Where this DPA and the Terms conflict on the protection of personal data, this DPA prevails. If a Customer needs a countersigned copy, we will provide one on request at hello@ws.agency.

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the EU General Data Protection Regulation 2016/679 ("GDPR").

2. The Processing

We process Customer Personal Data only to provide Workspace Sync to the Customer, as described in Annex 1. We do not process it for our own purposes, sell it, or use it for advertising.

3. Instructions

We process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the settings the Customer's administrators choose in the admin dashboard (for example who has app access, which fields are shown, the sync scope and whether company contacts are added to phones) are the Customer's complete instructions. Further instructions must be in writing and agreed by both parties.

We tell the Customer promptly if we believe an instruction infringes the GDPR or other EU or Member State data protection law. If EU or Member State law requires us to process Customer Personal Data otherwise, we tell the Customer first unless that law forbids it.

4. Confidentiality

Everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality and has access only to the extent needed to run and support the service.

5. Security

We implement and maintain the technical and organizational measures in Annex 2, which are appropriate to the risk as required by Article 32 GDPR. We may improve them over time, but will not reduce the overall level of protection.

6. Subprocessors

The Customer gives us general authorization to engage subprocessors. The current subprocessors are listed in Annex 3 and in section 7 of our Privacy Policy.

We tell the Customer's administrators by email at least 30 days before we add or replace a subprocessor. The Customer may object on reasonable data protection grounds within that period. If we cannot address the objection, the Customer may terminate the affected service before the change takes effect and receives a pro-rata refund of any fees paid in advance for the period after termination.

We impose data protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible to the Customer for their performance.

7. International Transfers

Customer Personal Data is stored in the European Union. Where a subprocessor processes it outside the European Economic Area, as described in Annex 3, the transfer is protected by an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or by the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914, together with any supplementary measures needed.

8. Data Subject Requests

Taking into account the nature of the processing, we help the Customer respond to requests from data subjects exercising their GDPR rights. Most requests can be handled by the Customer directly: its administrators control the directory in Google Workspace and in the admin dashboard. If a data subject contacts us directly, we pass the request to the Customer without undue delay and do not respond ourselves, except to confirm that we have passed it on.

9. Other Assistance

We give the Customer reasonable help, taking into account the information available to us, with its obligations under Articles 32 to 36 GDPR: security, breach notification, data protection impact assessments and prior consultation with a supervisory authority.

10. Personal Data Breaches

We notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice goes to the Customer's administrators by email and describes, as far as we know at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. We add information as it becomes available and take reasonable steps to contain the breach and limit its effects.

11. Deletion at the End of the Service

When the Customer asks us to delete its organization, access ends immediately, and we delete the Customer Personal Data 30 days later, or straight away if the Customer asks (see Delete your account and data). Before deletion, the Customer can ask us for an export of its directory. We keep only what EU or Member State law requires us to keep, such as invoices. Copies in our providers' encrypted backups expire in their normal backup cycle.

Cancelling a paid subscription is not deletion: the Customer's organization moves to the free plan and its data stays until the Customer asks us to delete it.

12. Information and Audits

We make available to the Customer the information needed to demonstrate compliance with Article 28 GDPR, and answer reasonable written questions about our processing.

Where that information is not sufficient, or a supervisory authority requires it, we allow and contribute to audits by the Customer or an independent auditor it appoints who is bound by confidentiality: once a year at most (unless there has been a personal data breach), with at least 30 days' written notice, during normal business hours and without disrupting the service or the confidentiality of other customers. Each party bears its own costs.

13. Liability

Each party's liability under this DPA is subject to the limitations in the Terms, except where the GDPR does not allow liability to be limited.

14. Term, Changes and Law

This DPA applies for as long as we process Customer Personal Data. We may update it to reflect changes in law or in our service; material changes are announced by email at least 30 days before they take effect, as for the Terms. This DPA is governed by the laws of the Republic of Croatia, and the courts of Zagreb have jurisdiction, as in the Terms.

Annex 1: Details of the Processing

Subject matter	Providing Workspace Sync: making the Customer's Google Workspace directory available to its team members in the mobile app and, where turned on, in their phones' Contacts app.
Duration	For as long as the Customer uses Workspace Sync, and until deletion under section 11.
Nature and purpose	Reading the directory from Google Workspace every hour; storing it; showing it to the team members the Customer allows, with the fields the Customer allows; writing it into team members' phones where turned on; signing users in; supporting the Customer.
Categories of data subjects	The Customer's employees and other people in its Google Workspace directory, including its administrators and the team members who use the app.
Types of personal data	First and last name, email address, phone numbers, job title, department, organization (company name), addresses, profile photo, Google user identifier and organizational unit; whether each person has app access and appears in the directory; group memberships; each user's default number choices; sign-in records (time, IP address, browser user agent).
Special categories	None intended. The Customer should not put special categories of personal data into the directory fields Workspace Sync reads.

Annex 2: Technical and Organizational Measures

• Encryption: TLS on every connection; database and file storage encrypted at rest; the Customer's Google Workspace key stored encrypted in a separate secrets vault and never shown after it is saved.
• Access control: sign-in with Google only; the database itself enforces that each user sees only their own organization's directory, only the fields the Customer allows, and only while they have access; administrators are a separate role; our staff's access to customer data in our support tools is logged.
• Least privilege: Workspace Sync asks Google only for read-only access to the directory; our servers and functions receive only the permissions they need.
• Data minimization: the app loads the directory from our servers while in use and keeps no copy of its own on the phone; fields switched off never reach the app.
• Records: changes that affect billing and the Google Workspace connection are recorded with who made them and when.
• Location: database, file storage, the admin dashboard and our helpdesk run in the European Union.
• Availability: our providers keep encrypted backups; the service is monitored and failing jobs alert our operators.
• Secure development: every change is reviewed and must pass automated checks before it reaches production; security reviews of the whole service are repeated before major releases.
• People: staff are bound by confidentiality, and access is removed when it is no longer needed.

Annex 3: Subprocessors

Subprocessor	Processing	Location and transfer safeguard
Supabase, Inc.	Database, file storage, sign-in, server functions	Data stored in the EU (Ireland); server functions may run outside the EEA (Standard Contractual Clauses)
Hetzner Online GmbH	Servers for the admin dashboard and our self-hosted helpdesk	EU (Finland, Germany)
Cloudflare, Inc.	Delivery and protection of the website and DNS	Global network (EU-US Data Privacy Framework)
Google LLC	Google Sign-In and the Google Workspace Directory API	United States and EU (EU-US Data Privacy Framework)
Stripe, Inc. and Stripe Payments Europe, Ltd.	Payments and invoices (administrators' billing details only)	EU (Ireland) and United States (EU-US Data Privacy Framework)
Mailgun Technologies, Inc. (Sinch)	Transactional email to administrators and users	United States (Standard Contractual Clauses)
650 Industries, Inc. (Expo)	Delivering app updates; no directory data	United States (Standard Contractual Clauses)