Data Processing Agreement

When we process personal data on your behalf through the hosted service, we do so as a data processor under a Data Processing Agreement. This page summarises it; the full DPA is available for signature on request and forms part of your contract.

Roles

You are the data controller for the personal data in your workspace. Ollasync is the data processor, acting on your documented instructions.

What we process, and how

We process the account data, metadata and (for non-end-to-end-encrypted paths) content described in our Privacy Policy, solely to provide the service. End-to-end encrypted messaging content is not readable by us.

Sub-processors

We use a limited set of infrastructure sub-processors to run the hosted service. The current list — with each sub-processor’s role and location — is provided in the DPA, and we give notice of changes so you can object.

Data residency

Application data (accounts, workspaces, messages, deal-room documents) is processed on servers in the United States (Detroit). Live meeting media and recordings are processed and stored on servers in Germany (Frankfurt). Encrypted backups are held with our backup storage provider. The managed service is not offered as EU-only hosting; self-hosting keeps all data on infrastructure you control. Where a transfer outside the EEA is required, it is covered by appropriate safeguards such as the EU Standard Contractual Clauses.

Security measures

• Encryption in transit (TLS 1.3) everywhere; end-to-end encryption for messaging.
• Access control, role and NDA gating, and audit logging.
• Least-privilege service architecture and per-IP rate limiting.
• Continuous automated testing of security-relevant guarantees.

Full technical and organisational measures are described in the DPA and our security whitepaper.

Breach notification

We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, with the information you need to meet your own notification obligations.

Your rights & assistance

We assist you in responding to data-subject requests and in meeting your GDPR obligations, taking into account the nature of the processing. On termination we delete or return personal data as instructed, subject to legal retention requirements.

Request the DPA

To receive the full DPA and current sub-processor list for your review: [email protected].

This is a plain-language summary for transparency. The signed DPA governs in case of any difference, and should be reviewed by your legal team.