Data Processing Agreement

(Auftragsverarbeitungsvertrag pursuant to Art. 28 GDPR)

1. Parties and scope of application

This Data Processing Agreement (“DPA”) is concluded between the provider of the Prismar application (“Service”):

(“Provider”, acting as processor within the meaning of Art. 4(8) GDPR) and the natural or legal person on whose behalf a Prismar workspace is operated in the course of a business activity (“Customer”, acting as controller within the meaning of Art. 4(7) GDPR).

The terms of this DPA are incorporated into the Terms of Service by reference and apply to the extent the Provider processes personal data subject to the GDPR on the Customer’s behalf in the course of the Customer’s business use of the Service. Purely private use of the Service within the meaning of Art. 2(2)(c) GDPR (household exemption) is not subject to this DPA.

2. Subject matter, duration, nature and purpose of processing

The subject matter of the processing is the provision of the Prismar project-management service. The nature and purpose of the processing, the categories of data subjects and the categories of personal data are set out in Annex 1. The duration of the processing corresponds to the term of the usage agreement between the Customer and the Provider under the Terms of Service.

3. Obligations of the Provider (Art. 28(3) GDPR)

3.1 Documented instructions. The Provider processes personal data only on documented instructions of the Customer, including with regard to transfers to a third country, unless required to do so by Union or Member State law; in such a case, the Provider informs the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Customer’s use of the Service’s functions (for example creating, editing, sharing or deleting content) constitutes the Customer’s instructions. The Provider informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions.

3.2 Confidentiality. The Provider ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

3.3 Security of processing. The Provider takes all measures required pursuant to Art. 32 GDPR. The technical and organisational measures in place are described in Annex 2. The Provider may update these measures, provided the level of protection is not reduced.

3.4 Sub-processors. The Customer grants the Provider general written authorisation to engage sub-processors. The sub-processors engaged at the time this DPA takes effect are listed in Annex 3. The Provider informs the Customer of any intended addition or replacement of sub-processors by updating the published list and noting the change on this page, thereby giving the Customer the opportunity to object to such changes on reasonable data-protection grounds. If the Customer objects and no mutually agreeable resolution is found, the Customer may terminate the affected use of the Service. The Provider imposes on each sub-processor, by way of a contract pursuant to Art. 28(4) GDPR, the same data protection obligations as set out in this DPA, and remains fully liable to the Customer for the performance of that sub-processor’s obligations.

3.5 Data-subject rights. Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Customer’s obligation to respond to requests for exercising the data subject’s rights under Chapter III of the GDPR (Art. 12–23 GDPR). If a data subject contacts the Provider directly with such a request relating to the Customer’s data, the Provider forwards the request to the Customer without undue delay.

3.6 Assistance with Art. 32–36 GDPR. Taking into account the nature of the processing and the information available to it, the Provider assists the Customer in ensuring compliance with the Customer’s obligations pursuant to Art. 32–36 GDPR (security of processing, notification of personal-data breaches, data protection impact assessments and prior consultation). In particular, the Provider notifies the Customer without undue delay after becoming aware of a personal-data breach affecting personal data processed on the Customer’s behalf.

3.7 Deletion and return. After the end of the provision of the services, the Provider, at the choice of the Customer, deletes or returns all personal data processed on the Customer’s behalf, and deletes existing copies, unless Union or Member State law requires storage of the personal data. The Service provides self-service deletion for this purpose: the Customer can delete individual items, projects and workspaces (deleting a workspace permanently removes its projects, tasks, bugs, comments, sheets, attachments, activity and notifications), and account holders can permanently delete their account, which also deletes workspaces they solely own. Upon deletion, the associated personal data is deleted or anonymized, unless statutory retention obligations require otherwise. Copies contained in backups of the managed database service are removed as those backups expire in the ordinary course of the backup cycle.

3.8 Demonstration of compliance and audits. The Provider makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. Audit requests are primarily satisfied through the provision of appropriate documentation (including this DPA, the description of technical and organisational measures in Annex 2, and available compliance documentation of the sub-processors). On-site inspections take place only where legally required, upon reasonable prior notice, during regular business hours and without disrupting the Provider’s operations.

4. Obligations of the Customer

The Customer is the controller of the personal data processed on its behalf and is responsible for the lawfulness of the processing, in particular for having a valid legal basis for the data it enters into the Service and for informing data subjects as required. The Customer ensures that the persons acting on its behalf within the Service are authorised to do so. The Customer issues instructions in accordance with clause 3.1 and addresses data-subject requests directed to it as controller.

5. Processing location

Personal data is processed within the EU/EEA; the processing locations of the individual sub-processors are stated in Annex 3. Some sub-processors belong to corporate groups with a US- or otherwise non-EU-domiciled parent. For the residual case of potential access by the parent company, appropriate safeguards are in place at the sub-processor level via the EU-US Data Privacy Framework (DPF) and/or EU Standard Contractual Clauses (SCC), together with the data processing agreements concluded with those sub-processors.

6. Liability

The liability of the parties is governed by the liability provisions of the Terms of Service and by Art. 82 GDPR. Nothing in this DPA limits either party’s liability towards data subjects under Art. 82 GDPR.

7. Final provisions

This DPA is governed by the law of the Federal Republic of Germany. Where this DPA conflicts with the Terms of Service with regard to the processing of personal data on the Customer’s behalf, this DPA prevails. Should individual provisions of this DPA be or become invalid, the validity of the remaining provisions remains unaffected. Customers who require an individually executed (signed) copy of this DPA may contact legal@prismar.app.

Annex 1 — Details of processing

Subject matter and purpose: provision of the Prismar project-management service (workspaces, projects, task planning, bug tracking, sheets, comments, attachments and related collaboration features) to the Customer.

Nature of the processing: collection, storage, organisation, display, transmission to authorised users, and deletion of the data entered into the Service.

Categories of data subjects: the Customer’s employees, contractors and other persons who use the Service on the Customer’s behalf, as well as other persons whose personal data is entered into the Service by the Customer’s users.

Categories of personal data (corresponding to section 2 of the Privacy Policy):

• Account data— email address, display name and username of the Customer’s users.
• Authentication data — sign-in is passwordless: email addresses are used to send one-time sign-in codes and, where a user signs in with Google, the identifier of that Google account is processed.
• User-generated content— workspaces, projects, tasks, bugs, comments, sheets and uploaded attachments, which may themselves contain personal data the Customer’s users choose to include.
• Usage and log data — technically necessary server and connection data generated when the application is accessed (e.g. IP address, time of access).

Special categories of data (Art. 9 GDPR): the Service is not intended for the processing of special categories of personal data; the Customer does not use the Service to process such data.

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

The Service is operated entirely on managed infrastructure of the sub-processors listed in Annex 3. Measures marked as provided by the managed infrastructure are implemented and operated by the respective sub-processor.

• Processing location— all application data is hosted in the EU/EEA: database, authentication and file storage in Ireland (Supabase, region eu-west-1), application hosting in Ireland (Vercel, Dublin), transactional email in Ireland (Resend, region eu-west-1), contact mailboxes in Zoho’s EU data center, and the PDF-import extraction service in France (Scaleway, Paris, region fr-par).
• Encryption in transit — all connections to the Service are encrypted via TLS (HTTPS), provided by the managed infrastructure.
• Encryption at rest — database and file storage are encrypted at rest, provided by the managed infrastructure.
• Authentication — sign-in is passwordless (one-time email codes or Google OAuth); no passwords are stored, eliminating password-database breach risk. Sessions are managed via secure cookies and verified server-side on each request.
• Access control and tenant separation — every workspace is logically separated; database row-level security policies enforce that users can only access data of workspaces they are members of. Access within a workspace is governed by a role-based, capability-checked permission model (Owner / Admin / Developer / Tester) following the principle of least privilege, enforced server-side.
• Upload restrictions — file uploads are restricted by an allowlist of file types and a maximum file size, enforced at the application and storage level.
• Availability and recoverability — backups of the database are provided by the managed database service.
• Deletion capability — self-service deletion of items, projects, workspaces and accounts as described in clause 3.7.
• Data minimisation — the Service collects no analytics or tracking data and uses only strictly necessary cookies and browser storage (see the Cookie Policy).

Annex 3 — Approved sub-processors

The following sub-processors are engaged at the time this DPA takes effect. The current list is also published in section 4 of the Privacy Policy.

Version 1.0 — Last updated: 18.07.2026