Data Processing Agreement

When we process personal data on your behalf through the hosted service, we do so as a data processor under a Data Processing Agreement. This page summarises it; the full DPA is available for signature on request and forms part of your contract.

Roles

You are the data controller for the personal data in your workspace. Ollasync is the data processor, acting on your documented instructions. When you self-host, there is no processor relationship with us for your data — you operate everything.

What we process, and how

We process the account data, metadata and (for non-end-to-end-encrypted paths) content described in our Privacy Policy, solely to provide the service. End-to-end encrypted messaging content is not readable by us.

Sub-processors

We use a limited set of infrastructure sub-processors to run the hosted service. The current list — with each sub-processor’s role and location — is provided in the DPA, and we give notice of changes so you can object. Self-hosting removes sub-processors from your data path.

Data residency

The hosted service is operated in the EU (Frankfurt). Where any transfer outside the EEA is required, it is covered by appropriate safeguards such as the EU Standard Contractual Clauses. Self-host to pin residency entirely to your own jurisdiction.

Security measures

• Encryption in transit (TLS 1.3) everywhere; end-to-end encryption for messaging.
• Access control, role and NDA gating, and audit logging.
• Least-privilege service architecture and per-IP rate limiting.
• Continuous automated testing of security-relevant guarantees.

Full technical and organisational measures are described in the DPA and our security whitepaper.

Breach notification

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own notification obligations.

Your rights & assistance

We assist you in responding to data-subject requests and in meeting your GDPR obligations, taking into account the nature of the processing. On termination we delete or return personal data as instructed, subject to legal retention requirements.

Request the DPA

To receive the full DPA and current sub-processor list for your review: [email protected].

This is a plain-language summary for transparency. The signed DPA governs in case of any difference, and should be reviewed by your legal team.