Data processing addendum

1. Parties and scope

This data processing addendum (“DPA”) forms part of the terms of service between the customer identified by its account or separate service agreement (“Customer”) and Rían Errity, trading as Paradaux (“Processor”). Contact: rian@paradaux.io. It applies when we process personal data on the Customer’s behalf to provide taskl.ie. The Customer is the controller, or a processor authorised by its controller; we act as processor or subprocessor accordingly.

“Personal data”, “processing”, “controller”, “processor”, and “personal data breach” have the meanings given in applicable data protection law, including the EU GDPR and UK GDPR where applicable. This DPA takes precedence for its subject matter. Our own controller activities are described in the privacy policy.

2. Processing details

• Subject matter and purpose: hosting and operating the Customer’s collaboration and issue-management workspace, including support, search, authorised integrations, and enabled AI features.
• Nature: collection, storage, organisation, retrieval, display, transmission, inference and embedding generation where enabled, backup, and deletion.
• Duration: the service agreement and the limited period required for return or deletion as described below.
• Data subjects: Customer personnel, contractors, collaborators, users, and other people whose information the Customer supplies.
• Data types: identifiers and contact information, workspace membership, issues, comments, documents, attachments, integration content, activity records, and related technical metadata.
• Sensitive data: special-category data, criminal-offence data, and other highly sensitive regulated information are not intended for the service unless separately agreed in writing with appropriate safeguards.

The Customer determines the purposes and lawful basis of processing, provides required notices, obtains necessary permissions, and controls which data, users, integrations, and AI workflows it enables.

3. Instructions and confidentiality

We process personal data only on documented Customer instructions, including this agreement, workspace configuration, and authorised support requests, unless applicable law requires otherwise. This includes instructions concerning international transfers. We inform the Customer of a legal requirement before processing unless the law prohibits notice. We promptly notify the Customer if we believe an instruction infringes applicable data protection law, and may pause the affected processing while it is resolved.

We restrict access to authorised persons who need it to provide the service and are subject to confidentiality duties. We do not sell Customer personal data, use it for advertising, or train AI models on it. We do not authorise AI subprocessors to use Customer data for training.

4. Security measures

We maintain technical and organisational measures appropriate to the nature of the data and risks, and review them as the service evolves. These include:

• HTTPS for public service connections and access controls for infrastructure.
• Authenticated sessions, workspace permissions, and controls intended to separate customers’ data.
• Restricted administrative access, managed secrets, and confidentiality obligations.
• Operational monitoring, security updates, and incident investigation procedures.
• Database and infrastructure backups, restricted backup access, and recovery procedures to restore availability.
• Procedures to handle access, correction, export, and deletion requests and to assess the effectiveness of safeguards.

The Customer is responsible for lawful content, user permissions, endpoint security, credential protection, and the settings of integrations it controls. Further information needed to assess security is available on request subject to confidentiality and protection of other customers.

5. Subprocessors

The Customer gives general authorisation to use the subprocessors below for the stated purposes. We bind subprocessors to written data protection obligations providing at least the protection required by this DPA for their processing, and remain responsible for their performance of those obligations.

• OVHcloud (OVH): infrastructure hosting in France; service data stored or processed on hosted infrastructure.
• netcup GmbH (netcup.de): infrastructure hosting in Germany; service data stored or processed on hosted infrastructure.
• Cloudflare: DNS and backup object storage; technical metadata and backed-up data. Database backup storage can use an EU jurisdiction, while other infrastructure backup storage is not necessarily EU-restricted. International processing is subject to the transfer requirements below.
• OpenAI: AI inference and embedding services for enabled features; relevant prompts, content, context, and outputs. Processing may take place outside the EEA, including the United States, subject to applicable contractual safeguards.

Umami and our authentication and database software are operated by us on our own infrastructure; their software authors are not subprocessors merely because we use their software. Services independently connected by the Customer, such as GitHub, Discord, Google sign-in, or an external AI client, are subject to the Customer’s instructions and the provider’s applicable terms.

We will notify the Customer at its account contact address at least 30 days before adding or replacing a subprocessor that will handle Customer personal data. The Customer may object within that period on reasonable data protection grounds. We will work to resolve the objection, offer a reasonable alternative where possible, or allow termination of the affected service before the new processing starts, with a pro-rata refund of unused prepaid fees for that service.

6. International transfers

Primary hosting is in France and Germany. Before transferring personal data to a country requiring additional safeguards under applicable law, we ensure a valid transfer mechanism is in place, such as an applicable adequacy decision or executed European Commission standard contractual clauses (Decision (EU) 2021/914, using the module appropriate to the parties’ roles). UK transfers require an applicable UK mechanism, such as the UK addendum or IDTA. We assess relevant transfer risks and apply supplementary measures where required.

This DPA does not itself substitute for completed transfer clauses or guarantee that every provider processes data exclusively within Europe. We provide information about applicable safeguards on request and do not make restricted transfers without a valid mechanism.

7. Assistance and incidents

Taking account of the nature of processing and information available to us, we assist the Customer with data subject requests, security obligations, breach notifications, data protection impact assessments, and consultation with regulators. We promptly pass on requests concerning Customer data and do not respond on the Customer’s behalf except as instructed or legally required.

We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer personal data. We provide available information about the nature of the breach, affected categories and approximate numbers of people and records, likely consequences, mitigation, and a contact point. Information may be provided in stages as the investigation progresses. We take reasonable steps to contain and remediate the breach and cooperate with the Customer; notification is not an admission of liability.

8. Return and deletion

At the end of the service, we will, at the Customer’s choice, return or delete Customer personal data and delete existing copies unless applicable law requires retention. The Customer should communicate its choice and export needs through its authorised administrator. We will agree a practical return format and completion timetable without undue delay.

Backup copies are isolated from ordinary use and removed through the applicable rotation schedule. If a backup is restored, relevant deletion instructions must be reapplied. Any legally retained data remains protected and is processed only for the required purpose. On request, we confirm completion and explain any remaining lawful retention.

9. Accountability and audits

We make available the information necessary to demonstrate compliance with this DPA and permit and contribute to audits, including inspections, by the Customer or its mandated independent auditor. Audits should use existing documentation where sufficient and otherwise take place on reasonable notice, with confidentiality and safeguards for other customers’ data. These arrangements do not restrict a regulator’s powers or prevent an audit needed after a breach or evidence of non-compliance.

10. US state privacy terms

Where applicable US state privacy law treats us as a service provider or contractor, we process Customer personal information only for the specific business purposes in this DPA. We do not sell or share it, retain, use, or disclose it outside those purposes or the direct business relationship except as law permits, or combine it with information from other customers or our own interactions except as law permits.

We provide the level of protection required by applicable law, notify the Customer if we can no longer meet these obligations, and allow reasonable steps to verify compliance and stop and remediate unauthorised processing. We certify that we understand and will comply with these restrictions.