Effective Date: 24 May 2026 — Version 1.3 (updated 2 October 2026)
This Data Processing Agreement (DPA) supplements the Terms of Service between the Customer ("Data Controller") and PennaSystems ("Data Processor") to ensure compliance with GDPR Article 28.
The Processor processes personal data solely on behalf of the Controller to provide the SaaS platform. Processing occurs only upon documented instructions via the Controller's use of the platform.
The Processor ensures appropriate technical measures, including TLS encryption in transit and encryption at rest. The database is encrypted at rest by our hosting provider. Uploaded files and off-site backups are held in object storage encrypted with AES-256, and backups are additionally encrypted before they leave our servers. Access tokens for third-party services you connect, such as bookkeeping systems and messaging channels, are additionally encrypted by the application before they are stored.
Notification: In the event of a personal data breach, the Processor shall notify the Controller without undue delay, where feasible within 36 hours and in any event no later than 48 hours after becoming aware of the breach, enabling the Controller to fulfill its regulatory obligations.
The Controller provides general authorization for the use of subprocessors (listed at pennasystems.com/legal/subprocessors). The Processor will notify registered users via email at least 30 days prior to adding a new subprocessor. If the Controller objects, they may terminate their subscription before the change takes effect.
The Processor commits to hosting the primary database and file storage within the EU/EEA. Transfers to third countries are strictly limited to necessary sub-processing operations and are safeguarded by GDPR Chapter V mechanisms, relying on EU Standard Contractual Clauses (SCCs) or adequacy decisions like the EU-US Data Privacy Framework (DPF).
The Controller has the right to verify compliance. The audit commitment is set by the Data Processing Agreement in our Terms of Service §7.1, which is the binding text. Under it, the Processor will “make available to you all information necessary to demonstrate compliance with this Data Processing Agreement and allow for and contribute to audits, including inspections, conducted by you or another auditor mandated by you. Audits will normally be satisfied by a written compliance statement issued once a year at our expense; physical inspections may be requested with 14 days' written notice and at your expense.” In those quoted words, “you” and “your” mean the Controller and “our” means the Processor. If this page and Terms of Service §7.1 ever differ, §7.1 applies.
Upon termination of the subscription, the Processor will delete all Controller data (including end-client data) from its systems within a reasonable timeframe, unless continued storage is legally required.