Data Processing Agreement

Article 28 GDPR — Version 2026-01

⚠️ DRAFT — DO NOT PUBLISH OR SIGN WITHOUT LEGAL REVIEW. This document was written from the actual behaviour of the system and has not been reviewed by a lawyer. It must be legally validated before going to production or being presented to customers.

Parties

Controller: the Officera customer office, identified in its office registration on the platform (the “Controller” or “Customer”).
Processor: [TO BE COMPLETED: full legal entity name], tax number [TO BE COMPLETED: NIF/NIPC], registered office at [TO BE COMPLETED: full registered address] (the “Processor” or “Officera”).

This agreement forms an integral part of the Terms of Service and applies whenever Officera processes personal data on the Customer’s behalf. In the event of conflict regarding the processing of personal data, this agreement prevails.

1. Subject matter and duration

The Customer uses Officera to manage its office’s activity and, in doing so, enters personal data about third parties into the platform, in particular about its own clients and contractual counterparties.
For that data, the Customer determines the purposes and means of processing and is the controller; Officera processes it solely on the Customer’s behalf and on its instructions, as processor.
This agreement lasts for as long as Officera processes personal data on the Customer’s behalf, that is, from creation of the office until deletion of the data under clause 11.

2. Nature and purpose of processing

Officera processes personal data only to deliver the platform’s features to the Customer, namely: hosting and storing the data; allowing the Customer’s users to create, read, update and delete records; generating contract documents and invoices from the data entered; calculating and displaying financial indicators; sending notifications inside the workspace; performing backups; and providing technical support when requested by the Customer.

Officera does not process this data for its own purposes, does not sell it, does not use it for advertising, and does not use it to train artificial intelligence models.

3. Categories of data subjects

The office’s clients (natural persons) and associated contacts;
Representatives, partners and staff of clients that are legal entities;
Counterparties and other parties to contracts recorded by the Customer;
Suppliers and payees of expenses recorded by the Customer;
Office users created by the Customer on the platform.

4. Categories of personal data

Depending on what the Customer chooses to enter:

Identity: name, date of birth, occupation, marital status;
Identification documents: type and number (for example tax number, citizen card, passport), issue and expiry dates;
Contact details: email addresses, phone numbers and other contact points;
Addresses: street, number, complement, city, region, postal code, country;
Contract data: contracts, parties and their roles, payment plans and terms, contracted services;
The Customer’s financial data about its clients: payments, invoices, expenses and related amounts;
Uploaded documents: files the Customer attaches to clients or contracts, whose content is determined exclusively by the Customer;
Usage and audit data: which user created or changed each record, and when;
Office user data: name, email, username, picture, roles and permissions.

Special categories of data (Art. 9 GDPR): the platform has no fields designed for sensitive data. The Customer may nonetheless upload documents that contain such data. If it does, the Customer is responsible for ensuring the Article 9 legal basis and appropriate additional safeguards, and should assess beforehand whether such processing is suitable for the platform.

5. Controller’s instructions

Officera processes personal data only on documented instructions from the Customer. The following constitute documented instructions: the Terms of Service, this agreement, normal use of the platform’s features by the Customer’s users, and support requests made by the Customer.
If Union or Member State law requires Officera to carry out processing not covered by the instructions, Officera will inform the Customer before processing, unless that law prohibits it on important grounds of public interest.
Officera will inform the Customer if, in its opinion, an instruction infringes the GDPR or another data protection provision.

6. Officera’s obligations as processor

Officera undertakes to:

Process data only on documented instructions from the Customer (clause 5);
Ensure that persons authorised to process the data are bound by a duty of confidentiality;
Apply the technical and organisational measures described in clause 8;
Comply with clause 7 regarding the engagement of sub-processors;
Provide the Customer with the assistance set out in clause 9;
Notify personal data breaches under clause 10;
Delete or return the data at the end of the service, under clause 11;
Make available to the Customer the information needed to demonstrate compliance with Article 28 GDPR and allow audits under clause 12.

7. Sub-processors

The Customer gives general authorisation for Officera to engage the sub-processors listed below, entering into data protection obligations with each of them equivalent to those in this agreement.
Officera remains liable to the Customer for its sub-processors’ performance.

Sub-processor	Role	Processing location
Amazon Web Services EMEA SARL	Application and database hosting, document storage (S3), content delivery (CloudFront), backups	European Union — eu-west-1 (Ireland)
Stripe	Payment processing for the Officera subscription and billing portal management	EU and US, with the safeguards in clause 13
Grafana Labs (Grafana Cloud)	Application error, performance and tracing monitoring	[TO BE COMPLETED: confirm the Grafana Cloud instance region]
Amazon SES (AWS)	Sending service emails	European Union — eu-west-1 (Ireland)

Note: Stripe processes billing data for the relationship between Officera and the Customer. It does not receive the data the Customer stores about its own clients.

Officera will inform the Customer with reasonable notice of any change to the list of sub-processors. The Customer may object on data protection grounds; if the objection cannot be accommodated, the Customer may terminate the subscription without penalty as to the period not yet provided.

Officera applies at least the following measures:

8.1 Isolation between offices

Each office corresponds to a tenant with its own identifier. Every table holding client data carries a tenant column and PostgreSQL row-level security policies, both enabled and enforced (ENABLE ROW LEVEL SECURITY and FORCE ROW LEVEL SECURITY).
The database role used by the application does not hold the BYPASSRLS privilege, so it cannot bypass the policies. The API refuses to start if it detects that the application role holds that privilege.
The tenant context is set on each database session from the authenticated identity, and authorisation is also checked at the application layer.

8.2 Encryption

In transit: all access to the application, the backoffice and the API is over HTTPS/TLS, with automatically managed certificates.
In backups: backup archives are stored in Amazon S3 with server-side encryption (SSE-S3) and versioning enabled, in the eu-west-1 region.
For uploaded documents: files are stored in Amazon S3, which applies server-side encryption by default.
The database does not apply column-level encryption; passwords are the exception and are stored only as an argon2id cryptographic hash.

8.3 Access control

Authentication with short-lived signed tokens (JWT), with the refresh token in an HttpOnly, Secure, SameSite=Strict cookie scoped to a restricted path and domain;
Granular roles and permissions inside each office;
Temporary account lockout after a configured number of failed sign-in attempts;
API rate limiting.

8.4 Backups and recovery

Automatic daily backup, run by a timer on the server, combining a pg_dump of the database and the objects in document storage into a single compressed archive uploaded to Amazon S3 in the eu-west-1 region;
The archive includes a manifest with metadata and checksums;
The identity used for backups has write-only permissions: it cannot read or delete earlier backups, which limits the impact of a compromised server;
Older backups are expired automatically by an S3 lifecycle rule.

[TO BE COMPLETED: confirm the lifecycle rule and retention period actually applied to the production environment, and the frequency of restore testing.]

8.5 Logging and monitoring

Application and access logs with request and trace identifiers;
Every data record stores who created and who changed it, and when;
Error and performance monitoring (see clause 7).

8.6 Stated limitations

Officera does not currently hold ISO 27001, SOC 2 or equivalent certifications, makes no contractual service level (SLA) commitments, and commits to no specific response times beyond the applicable statutory deadlines. These measures may be revised and improved, provided the level of security is not reduced.

9. Assistance to the Controller

Taking into account the nature of the processing and the information available to it, Officera provides the Customer with reasonable assistance regarding:

Data subject requests. If Officera receives a data subject request relating to the Customer’s office data directly, it does not act on it on its own initiative: it forwards the request to the Customer without undue delay. The platform’s features let the Customer view, correct and delete records, and export contract documents. There is currently no self-service full export of all office data; Officera assists the Customer with extractions on request.
Security of processing (Art. 32), through the measures in clause 8 and information about them.
Breach notification to authorities and data subjects (Arts. 33 and 34), under clause 10.
Data protection impact assessments and prior consultations (Arts. 35 and 36), by providing the technical information available about the processing.

10. Personal data breaches

Officera notifies the Customer without undue delay after becoming aware of any personal data breach affecting data processed on the Customer’s behalf.
The notification includes, to the extent known at the time and with later updates: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point for further information.
It is for the Customer, as controller, to decide on and carry out notification to the supervisory authority and to data subjects.
Officera will not notify third parties about a breach affecting the Customer’s data without informing the Customer first, unless required by law.

11. Fate of the data at the end of the service

When provision of the service ends, Officera will, at the Customer’s choice, delete or return the personal data processed on its behalf.
Office data remains available for [TO BE COMPLETED: retention period after termination, e.g. 30 days] after termination, to allow export or reactivation. The Customer must state its choice within that period; absent any indication, the data is deleted from active systems at the end of that period.
Backups containing Customer data are not deleted selectively: they are removed in the normal course of backup rotation, by the storage lifecycle rule. Until then, they remain subject to the security measures in clause 8 and are not used for any other purpose.
Officera may retain data beyond these periods only to the extent that Union or Member State law requires it, and only for that purpose.

12. Audits

Officera makes available to the Customer the information needed to demonstrate compliance with Article 28 GDPR.
The Customer may carry out audits, including inspections, itself or through an auditor it mandates who is bound by confidentiality, on reasonable prior notice, during business hours, without disproportionate disruption to operations, and no more than once per calendar year, unless there has been a confirmed data breach or a supervisory authority order.
The costs of audits initiated by the Customer are borne by the Customer, unless the audit reveals non-compliance attributable to Officera.

13. International transfers

The main processing takes place in the European Union (AWS, eu-west-1, Ireland).
Where a sub-processor processes data outside the European Economic Area, the transfer relies on the safeguards in Chapter V of the GDPR, in particular the European Commission’s Standard Contractual Clauses and, where applicable, adequacy decisions, together with appropriate supplementary measures.

14. Liability

The parties’ liability under this agreement is governed by Article 82 GDPR and by the limitations of liability set out in the Terms of Service, to the extent permitted by law.

15. Governing law and jurisdiction

This agreement is governed by Portuguese law. Jurisdiction is as set out in the Terms of Service.

Annex I — Processing summary

Element	Content
Subject matter	Provision of the Officera office management platform
Duration	For the term of the subscription, plus the retention period in clause 11
Nature	Collection, recording, organisation, storage, retrieval, alteration, extraction, erasure and backup
Purpose	Delivering the platform’s features to the Customer
Types of data	See clause 4
Categories of data subjects	See clause 3
Sub-processors	See clause 7
Location	European Union — AWS eu-west-1 (Ireland), with the exceptions in clause 13

In the event of any discrepancy between this English version and the Portuguese version, the Portuguese version prevails.

Data Processing Agreement (DPA)