Data Processing Agreement

1) Roles

For Customer Personal Data (personal data you or your team put into your workspace about other people, such as your customers, clients, suppliers or teammates) you are the controller and Sjo is your processor. For your own account and billing data Sjo is a controller, as described in the Privacy Policy.

2) Details of the processing

• Subject matter and purpose: providing the Sjo Service: storing your company context, generating AI replies and briefs, running team decisions, and syncing connected tools.
• Duration: for as long as you use the Service, then until deletion under section 9.
• Data subjects: your customers and clients, teammates and invited users, and other people you mention.
• Categories of data: names, email addresses, business contact details, invoice and subscription details (amounts, dates, statuses), Stripe customer IDs, and any personal data contained in messages or files you provide.
• Special categories: none intended. You agree not to submit them.

3) Processing only on your instructions

Sjo processes Customer Personal Data only to provide the Service according to the Terms, your use of the product and your other documented instructions, unless EU or Member State law requires otherwise (in which case we will tell you first, unless the law forbids it). We will tell you if we believe an instruction breaks data protection law. We do not use Customer Personal Data to train AI models.

4) Confidentiality and security

Everyone at Sjo with access to Customer Personal Data is bound by confidentiality. We maintain the technical and organisational measures described in section 8 of the Privacy Policy, including encryption in transit and at rest, separately encrypted connected-service keys, access limited to what is needed, and logging of administrative access. We may improve these measures but will not reduce overall protection.

5) Sub-processors

You authorize Sjo to use the sub-processors listed in Privacy Policy section 5. Each is bound by data protection terms at least as protective as this DPA, and Sjo remains responsible for them. We will announce new sub-processors at least 30 days in advance by updating that list and notifying workspace owners by email. You may object on reasonable data protection grounds; if we cannot address the objection, you may terminate the affected Service and receive a refund of prepaid fees for the unused period.

6) International transfers

Where Customer Personal Data is transferred outside the EU/EEA, Sjo ensures a valid transfer mechanism: an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses with supplementary measures.

7) Helping you meet your obligations

• Data subject requests: the product lets you correct, export and delete data. If a person contacts us directly about Customer Personal Data, we will refer them to you and help you respond.
• Other assistance: we will reasonably help with security, impact assessments and consultations with supervisory authorities, taking into account the information available to us.

8) Personal data breaches

We will notify the workspace owner without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting Customer Personal Data. We will share what we know, what we are doing about it, and update you as we learn more.

9) Deletion and return

You can export your data at any time. When you delete your workspace or account, we delete Customer Personal Data from live systems right away and from backups within 35 days, unless the law requires us to keep it.

10) Audits

We will provide information reasonably needed to demonstrate compliance with this DPA, including our sub-processors' security certifications. If that is not enough, you may request an audit with 30 days' notice, at your cost, no more than once a year, under confidentiality and without disrupting the Service.

11) Liability and law

The liability terms and governing law in the Terms of Service apply to this DPA, except where the GDPR requires otherwise.

12) Contact

Questions about this DPA or a signed copy:

Operated by

[Your full name] (private individual, not yet a registered company)

Email

[privacy@your-domain]