Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is between the Customer that holds an ExpirationPilot account (the "controller", "you") and Conrado Maggi (hereinafter ExpirationPilot), who operates the ExpirationPilot.com service (the "processor", "we"). It forms part of the Terms of Service and is accepted with them when the account is created. Where this DPA and the Terms conflict on the protection of personal data, this DPA prevails.

It applies to the personal data we process on your behalf when providing the Service ("Customer Personal Data"). It does not cover the data we control ourselves (account and billing details, our website, support emails), which is described in the Privacy Policy. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meaning given in the EU General Data Protection Regulation 2016/679 ("GDPR").

2. Details of the processing

• Subject matter: providing the ExpirationPilot service: tracking expiration dates, sending reminders, and requesting, collecting and storing renewed documents.
• Duration: for as long as the account exists, and then until the data is deleted as described in section 9.
• Nature and purpose: storing, organizing, displaying and sending data as instructed through the Service: hosting the account's records and files, sending reminder and document-request emails, receiving uploads through private links, recording email delivery status, keeping the activity history, and making backups.
• Categories of data subjects: the Customer's team members (users of the account); the Customer's contacts (employees, suppliers, subcontractors, clients and other people who are sent document requests); and people named in the expirations and documents the Customer tracks.
• Categories of personal data: names and email addresses of team members; contacts' names, email addresses, phone numbers, company and type (employee or outside contact); details of the expirations tracked (titles, dates, notes, who is responsible); uploaded documents and the answers given with them, which may contain any information the documents hold; email log (recipient, status, delivery or bounce), when an upload link was first opened, and the account's activity history.
• Special categories: the Service is not designed for special categories of data (art. 9 GDPR) or data about criminal convictions. If you upload documents containing such data (for example a medical certificate), you are responsible for having a legal basis for it and for deciding whether the Service's measures are appropriate.

3. Processing on your instructions

We process Customer Personal Data only on your documented instructions, unless EU or Spanish law requires otherwise (in which case we will tell you first, unless the law forbids it). Your instructions are this DPA, the Terms, and what you and your team members do and set in the Service (for example, adding a contact, sending a request, or setting how long replaced documents are kept). We will tell you if we believe an instruction breaks the GDPR or other data protection law.

We do not sell Customer Personal Data, use it for our own purposes, use it for advertising, or use it to train artificial intelligence models.

You are responsible for the lawfulness of the processing you instruct, including having a legal basis for it and giving the people concerned the information the GDPR requires (for example, telling your contacts that you use ExpirationPilot to collect their documents).

4. Confidentiality

Access to Customer Personal Data is limited to the operator and to anyone who needs it to provide or support the Service, each bound by a duty of confidentiality. We look at the content of an account only when needed to provide the Service, to fix a problem you reported, to keep the Service secure, or when the law requires it.

5. Security measures

Taking into account the state of the art, the costs and the risks, we apply the following technical and organizational measures (art. 32 GDPR):

• Encryption in transit: all traffic to the Service uses TLS (HTTPS), with HTTP Strict Transport Security; backups are sent encrypted to their storage.
• Hosting in the EU (Frankfurt, Germany), on infrastructure with physical security and access controls provided by the hosting provider.
• Account isolation: every record belongs to one account and the application limits every query and file to the signed-in user's account.
• Private file storage: uploaded documents are stored outside the public web folder and are served only through the application, to signed-in users of the account they belong to.
• Passwords stored only as bcrypt hashes. Team invitation links are random, single-use, expire after 7 days and are stored only as hashes.
• Upload links for contacts are random (32 random bytes), looked up by their hash, and stop working when the request is closed (document approved, request cancelled or a new link sent).
• Session data encrypted on the server; the session cookie cannot be read by scripts on the page.
• Rate limiting on sign-in, password reset, invitation and public upload pages; strict browser security headers (including a Content Security Policy) on every page.
• Signed delivery webhooks: email delivery events are accepted only with a valid signature from the email provider.
• Automatic deletion of replaced and rejected documents after the retention periods the Customer sets, and of import spreadsheets within two hours.
• Nightly backups kept for 30 days, to restore the Service after a failure.
• Administrative access to the servers limited to the operator.
• Software and dependencies kept up to date with security fixes.

We may update these measures as long as the overall level of protection is not reduced.

6. Sub-processors

You give us general authorization to use sub-processors to provide the Service. The current sub-processors are listed below. We impose on each of them, by contract, data protection obligations equivalent to those in this DPA, and we remain responsible to you for their work.

We will update this list when sub-processors change. Before a new sub-processor starts processing Customer Personal Data, we will tell the account by email, at least 30 days in advance where possible. If you have a reasonable objection on data protection grounds, tell us within that period. We will try to address it; if we cannot, you may end the Agreement and delete your account before the change applies, without penalty, and we will refund any prepaid fees for the period after termination.

7. International transfers

Customer Personal Data is stored in the EU. Where a sub-processor processes it outside the European Economic Area, or is a US company that may access it, the transfer is covered by the EU–US Data Privacy Framework, where the sub-processor is certified, and/or the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), together with any additional measures required.

8. Assistance to you

• Data-subject requests. Most requests can be handled directly in the Service: you can view, correct and export (to Excel) contacts, expirations and documents, remove a document from an expiration, delete contacts that are no longer used on an expiration, and remove team members. If something cannot be done in the Service (for example, deleting an expiration and its history entirely), email us and we will do it for you. If a data subject contacts us about Customer Personal Data, we will pass the request on to you without undue delay and will not answer it ourselves unless you ask us to. We will help you, as far as reasonably possible, to answer requests you cannot handle in the Service.
• Personal data breaches. We will notify you without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Personal Data. We will tell you what happened, the data and people likely affected, the likely consequences and the measures taken or proposed, and keep you updated as we learn more, so that you can meet your own obligations to notify the supervisory authority and the people concerned.
• Other obligations. We will give you the information you reasonably need for data protection impact assessments and prior consultations with a supervisory authority that concern the Service.

9. Deletion at the end

When the last user of an account deletes their login (Profile → Delete account), the account is deleted at once with all Customer Personal Data in it: team members, contacts, expirations, document requests, uploaded documents, the logo, email templates, the email log and the activity history. Copies in our backups are overwritten within 30 days. Before deleting, you can export your expirations, contacts and documents list to Excel and download the files you want to keep. We do not keep Customer Personal Data after that, unless EU or Spanish law requires us to.

During the account's life, removing a team member or contact deletes their record immediately; the activity history keeps a note of the removal (name and email address) until the account is deleted. Replaced and rejected documents are deleted automatically after the periods set in Settings → Data retention (by default 365 days for replaced and 30 days for rejected documents).

10. Information and audits

On reasonable written request, we will make available the information needed to show that we comply with this DPA, for example by answering security questionnaires and describing our measures and sub-processors. If that information is not enough to show compliance, or a supervisory authority requires it, you (or an independent auditor you appoint, bound by confidentiality) may carry out an audit, with at least 30 days' notice, during business hours, not more than once a year, and in a way that does not disrupt the Service or expose other customers' data. Each party bears its own costs.

11. Liability and term

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where the GDPR does not allow it to be limited. This DPA lasts as long as we process Customer Personal Data for you. It is governed by Spanish law, and the courts of Málaga, Spain, have jurisdiction, as set out in the Terms.

We may update this DPA when the law or our sub-processors change, with notice as set out in section 6 and the Terms. Questions: [email protected].