Data processing agreement

This is an English translation of the Romanian original. The Romanian version is the legally binding one; if the two differ, the Romanian version prevails.

This Data Processing Agreement (the “DPA”) forms part of the Agreement between DIMAX.RO S.R.L., registered office at Bld. Racoțeanu nr. 216, Camera 1, Et. 1, Oraș Filiași, Județ Dolj, Romania, J16/1920/2021, CUI 44650706 (“Manifolio”, the processor) and the Customer (the controller) and applies whenever Manifolio processes personal data on the Customer’s behalf, under article 28 of Regulation (EU) 2016/679 (the “GDPR”). It is accepted together with the Terms of Service by the Organisation owner, through a separate checkbox when accepting the invitation (or at the first sign-in after a new version); the acceptance is recorded. A copy for signature is available on request. For preparatory work done by our team before acceptance, the Customer signs a service order that refers to this DPA.

1. Definitions

The terms “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meaning given in article 4 GDPR. “Customer Data” means the personal data in Customer Content and Site Data, as defined in the Terms. A “Sub-processor” is another processor engaged by Manifolio to process Customer Data. Other capitalised terms have the meaning given in the Terms.

2. Roles of the parties

The Customer is the controller of Customer Data. If the Customer is an agency using Manifolio for its own clients, it acts as their processor and Manifolio as a sub-processor; the Customer warrants that it has its controller’s authorisation to use Manifolio and its sub-processors, relays its controller’s instructions and remains our sole point of contact.

For data we process for our own purposes (for example accounts, billing, security, technical and usage data), we are the controller, as set out in the Privacy Policy.

3. Details of the processing

The subject matter, duration, nature and purpose of the processing, the types of data and the categories of data subjects are described in Annex 1.

4. Customer obligations

The Customer:

• ensures it has a legal basis for Customer Data, including for the statistics and forms on its sites;
• informs visitors and other data subjects, as required by articles 13 and 14 GDPR;
• does not enter or request through forms special categories of data (article 9 GDPR) or data on criminal convictions without a legal basis and without need;
• configures the Service (fields, forms, retention periods, members and roles) in line with its own obligations and assesses whether the measures in Annex 2 are appropriate for the data it entrusts to us;
• is responsible for the lawfulness of its instructions.

5. Manifolio obligations

Manifolio:

• processes Customer Data only on the Customer’s documented instructions: the Agreement, the settings made in the admin and the requests sent through the API are the complete instructions at the time of acceptance; additional instructions are agreed in writing and may be charged for if they go beyond the standard Service. If the law requires other processing, we inform the Customer beforehand, unless the law prohibits it;
• through these instructions, the Customer also authorises us to process Customer Data as needed for the security, integrity and troubleshooting of the Service and to create aggregated or anonymised data that no longer allows data subjects to be identified, as set out in section 6 of the Terms; we do not attempt to re-identify data subjects;
• immediately informs the Customer if, in its opinion, an instruction infringes the GDPR or other data protection provisions;
• ensures that the people authorised to process Customer Data have committed to confidentiality or are under a statutory obligation of confidentiality;
• applies the technical and organisational measures in Annex 2, under article 32 GDPR; it may update and replace them over time, taking the state of the art into account, provided the overall level of protection is not reduced;
• complies with the conditions in section 6 for sub-processors;
• assists the Customer, through appropriate technical and organisational measures and taking into account the nature of the processing, in responding to data subject requests (articles 12-23 GDPR), mainly through the features of the admin and the API (section 9);
• assists the Customer in meeting its obligations under articles 32-36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of the processing and the information available to it; assistance beyond the documentation and the standard features of the Service may be charged at a reasonable rate, except where it results from a breach on our part;
• deletes or returns Customer Data when the services end, as set out in section 10;
• makes available to the Customer the information needed to demonstrate compliance with article 28 GDPR and allows the audits in section 11.

6. Sub-processors

The Customer gives a general written authorisation for the use of the sub-processors in Annex 3, published at Sub-processors, and for adding or replacing them as set out in this section.

• Changes. We announce any intended addition or replacement of a sub-processor with reasonable notice, as a rule at least 30 days, by email to organisation owners, in the admin or by updating the page, so that the Customer has the opportunity to object.
• Objection. The Customer may object in writing within that period on reasonable data protection grounds. We consider the objection and may propose a solution (for example a configuration that avoids the sub-processor). If no acceptable solution is reached, the Customer may end the Agreement for the affected services before the change takes effect, with a pro-rata refund of prepaid fees; this is its exclusive remedy. If no objection is made in time, the change is deemed accepted.
• Emergencies. If we need to change a sub-processor sooner, for example for security, for continuity of the Service or because a provider discontinues its service, we inform the Customer as soon as possible, and the right to object applies from the date of that notice.
• Same obligations. We impose on each sub-processor, by contract, data protection obligations that provide sufficient guarantees, essentially equivalent to those in this DPA, and we remain liable to the Customer for their performance, under article 28(4) GDPR. For providers offering standard contracts, accepting those contracts meets this requirement where they provide an equivalent level of protection.

7. International transfers

Customer Data is, as a rule, stored in the European Union. The Cloudflare network may process requests in transit in the data centre closest to the visitor, including outside the EEA, and some sub-processors may access data from outside the EEA to operate and support their services. Any transfer outside the EEA is made only with the safeguards in Chapter V GDPR, such as an adequacy decision (including the EU–US Data Privacy Framework, for certified providers) or the standard contractual clauses in Decision (EU) 2021/914 concluded with the sub-processor, with supplementary measures where appropriate. To the extent necessary, the Customer authorises us to enter into the standard contractual clauses with sub-processors on its behalf.

8. Personal data breaches

Manifolio notifies the Customer without undue delay, as a rule within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice includes, to the extent available, the information in article 33(3) GDPR, and information not available at once is provided in phases without undue delay. Notice is given to the email address of the Organisation’s owners or by other reasonable means.

Manifolio takes reasonable steps to contain the effects and cooperates with the Customer. Notifying or responding to a breach is not an acknowledgement of fault or liability. Unsuccessful attempts that do not compromise data security (for example scans, rejected sign-in attempts or DDoS attacks without access to data) are not notified.

9. Requests from data subjects and authorities

If a data subject sends us a request about Customer Data directly, we forward it to the Customer without delay and do not respond ourselves, other than to refer them to the Customer.

The Service gives the Customer the means to respond to requests itself, such as searching, exporting, correcting and deleting content and media files, and a tool for visitor requests that finds form submissions by email address across the Organisation’s sites, exports them and deletes them, including the copies in the webhook history. Pseudonymised statistics cannot be linked to a person. If an authority asks us for Customer Data, we inform the Customer before disclosing it, where the law allows, and disclose only what we are required to.

10. Deletion and return of data

Export. During the Agreement and in the grace period below, owners can request from the admin an export of the Organisation in a structured electronic format, which may include the content, the content model, media files (or their addresses, above a certain size), form submissions, statistics, members and the audit log. The archive stays available for a limited period (currently 7 days). The export constitutes the return of data within the meaning of article 28(3)(g) GDPR.

Deleting the Organisation. An owner can delete the Organisation from the admin. From that moment, the Service stops for the Organisation. For 30 days the Organisation can be restored on request. After that, Manifolio automatically deletes Customer Data from active systems (database, file storage, cache); the audit log keeps only pseudonymised rows.

End of the Agreement. If the Agreement ends in another way, the Customer can export its data in the 30 days after it ends, after which the Organisation is deleted as above, within a reasonable time, as a rule within at most 30 days. Backups, where they exist, are deleted in line with their rotation cycle and until then remain protected under this DPA and are not actively used. We keep data only where Union or Romanian law requires it, in which case we protect it under this DPA.

During the Agreement, data deleted by the Customer (for example media files, imports, form submissions) is removed for good after the technical periods applied by the Service, as a rule within at most 30 days.

11. Audits

The Customer exercises its audit right primarily through the information we make available on request: an up-to-date description of the measures in Annex 2, answers to reasonable security questionnaires and, where they exist, the sub-processors’ certification or audit reports (for example SOC 2 or ISO/IEC 27001). If these are not sufficient to demonstrate compliance with article 28 GDPR, the Customer or an independent auditor that is not our competitor and is bound by confidentiality may carry out an audit, at most once every 12 months (or more often if a supervisory authority requires it or after a breach affecting Customer Data), with at least 30 days’ notice, under an agreed plan, during business hours, without disrupting the Service, and without access to other customers’ data or to information that would put the security of the Service at risk. The costs of the audit, including our team’s reasonable time, are borne by the Customer, unless the audit finds a material breach of this DPA by us.

12. Liability and term

The parties’ liability under this DPA is as set out in the Terms, including the limits there, without limiting data subjects’ rights under article 82 GDPR or any liability that cannot be limited by law. This DPA applies for as long as Manifolio processes Customer Data. We may change this DPA under the conditions in section 21 of the Terms, without reducing the guarantees required by article 28 GDPR. If this DPA and the Terms differ, this DPA prevails on data protection matters.

Annex 1. Details of the processing

Annex 2. Technical and organisational measures

Manifolio applies technical and organisational measures appropriate to the risk, which include, without being limited to them and with the possibility of replacing them with measures at least equivalent:

Access control. Password authentication with passwords stored only as salted cryptographic hashes; protected sessions (secure cookies, idle and absolute expiry); two-factor authentication, mandatory for the Manifolio team; limits on sign-in and reset attempts; single-use, short-lived reset links; roles and permissions per organisation and per project.

Customer isolation. Logical separation of each customer’s data, checked at several levels (in the application and in the database, through row-level security), and automated isolation tests.

API keys. Secret keys stored only in derived form and shown once, with separate permissions and environments, domain restrictions for public keys and immediate revocation.

Traceability. An audit log protected against modification, marking the Manifolio team’s actions; API request logs for limited periods.

Encryption. Encryption in transit (TLS) for connections; encryption at rest provided by infrastructure providers; additional protection for sensitive secrets.

Data minimisation. Statistics without cookies and without storing IP addresses; honouring Do Not Track and Global Privacy Control signals; removing metadata embedded in images; AI features off by default, with no retention on our side of the content sent.

Application security. Input validation, security headers, signed webhooks and other secure development practices.

Availability and recovery. Distributed infrastructure with protection against DDoS attacks; a database managed by a specialist provider, in the EU; the Customer’s ability to export its data at any time; monitoring of the state of the Service. Whether the provider keeps backups, and for how long, depends on the plan used and is stated at Sub-processors.

Deletion and portability. Export and deletion features, the visitor-requests tool, a grace period when deleting the Organisation and automatic clean-up afterwards, with a pseudonymised trace in the audit log.

Organisational. Least-privilege access; confidentiality obligations for the team; an incident handling and notification procedure; assessment of providers; vulnerability reporting at security@manifolio.com.

Annex 3. Sub-processors

The up-to-date list, with each provider’s seat, purpose and place of processing, is at Sub-processors and forms part of this DPA.