Data Processing Agreement

This Data Processing Agreement (“DPA”) is part of the Terms of Service between you, the customer (“Controller”), and AVOLIA S.R.L., which runs Churnahead (“Processor”). It applies whenever the Processor processes personal data in Customer Data on your behalf, and you accept it when you accept the Terms. Words such as personal data, processing, data subject and personal data breach have the meanings given in the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

1. Roles and instructions

1.1 You are the controller and we are the processor of the personal data described in Annex 1.

1.2 We process it only on your documented instructions. Those instructions are the Terms, this DPA, and what you set up and do in the Service, such as connecting Stripe, choosing where digests go, or asking for a draft. If the law requires us to process the data in another way, we’ll tell you first, unless the law forbids it. We’ll tell you if we think an instruction breaks data protection law.

1.3 You’re responsible for having a legal basis for the processing, and for giving your customers the information the law requires.

2. Confidentiality

Everyone who can access the personal data on our side is bound by confidentiality.

3. Security

We apply the technical and organisational measures in Annex 2, and keep them appropriate to the risk. We may improve them, but we won’t reduce the overall level of protection.

4. Subprocessors

4.1 You give a general authorisation for us to use subprocessors. The current ones are listed on the Subprocessors page.

4.2 We’ll give at least 30 days’ notice of a new subprocessor, by updating that page and emailing the address on your workspace. You can object on reasonable data protection grounds within that time. If we can’t resolve the objection, you can stop using the Service and cancel before the change applies, and we’ll refund any fees you prepaid for the period after it.

4.3 Each subprocessor is bound by a written contract with data protection obligations at least as protective as this DPA. We remain responsible to you for their performance.

5. Helping you

5.1 Data subject requests. If someone asks us directly to exercise their rights over Customer Data, we’ll pass the request to you and won’t answer it ourselves unless you tell us to. Taking into account the nature of the processing, we’ll help you answer such requests. You can also delete all Customer Data yourself from the Connect page.

5.2 Other obligations. Using the information available to us, we’ll help you with security, breach notification, data protection impact assessments and consultations with supervisory authorities.

6. Personal data breaches

We’ll notify you without undue delay, and within 48 hours at the latest, after we become aware of a personal data breach affecting Customer Data. The notice will include what we know about its nature, the data and people affected, its likely consequences, and the measures taken or proposed. We’ll add details as we learn more.

7. International transfers

We store Customer Data in the European Union. If a subprocessor processes it outside the European Economic Area, we make sure the transfer is covered by an adequacy decision, such as the EU-US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses.

8. Deletion at the end

When you delete your data from the Connect page, the Customer Data synced from Stripe is deleted. When your account closes, we delete the remaining Customer Data within 30 days, unless the law requires us to keep it. Customer Data is a copy of records you keep in Stripe, so the originals stay with you there.

9. Audits

We’ll make available the information needed to show compliance with this DPA. We’ll also allow and contribute to audits by you, or by an auditor you appoint who is bound by confidentiality. You must give reasonable notice, an audit may take place no more than once a year unless a breach or a supervisory authority requires it, and you pay its cost. We’ll first try to answer with written information.

10. Liability and term

The liability provisions of the Terms apply to this DPA, as far as the law allows. This DPA lasts as long as we process Customer Data for you. If it conflicts with the Terms on data protection, this DPA prevails.

Annex 1: Description of the processing

Item	Description
Subject matter	Providing Churnahead: syncing billing data from the Controller’s Stripe account, scoring churn risk, reporting, digests and alerts, and drafted messages
Duration	While the Controller uses the Service, plus up to 30 days for deletion
Nature and purpose	Collecting through Stripe’s API (read-only), storing, organising, analysing and scoring, and showing the results to the Controller by dashboard, email and Slack. When asked, sending account facts to an AI model to draft a message
Data subjects	The Controller’s customers and their contacts, and the Controller’s own users
Categories of personal data	Names, email addresses, Stripe customer IDs, subscription and plan details, invoices, payments, refunds and disputes, card brand and expiry month and year, cancellation reasons and feedback, and notes and example emails the Controller adds
Special categories	None intended. The Controller agrees not to add them in notes or example emails
Frequency	Continuous: a daily sync, plus webhooks when the Controller connects with one click

Annex 2: Technical and organisational measures

• Hosting. The servers and the database run in data centres in Germany (Hetzner).
• In transit. TLS on every connection between users, the Service and its providers.
• At rest. Stripe credentials are encrypted with an application key that is held apart from the database. Only hashes of sign-in links and session tokens are stored.
• Least privilege towards Stripe. Read-only scope or restricted keys with Read access only. Secret keys are refused.
• Isolation. Every record is scoped to its workspace, and every query is filtered by workspace.
• Access control. Production access is limited to the people who run the Service. The operator console is behind single-sign-on access control and a second check on the server.
• Signed links. The action links in emails are signed, expire after 30 days, and ask for confirmation before acting.
• Deletion. Customer Data can be deleted with one button, and is deleted within 30 days after an account closes.
• Data minimisation. No card numbers or bank details are read. Only the fields the Service uses are synced.

Annex 3: Subprocessors

See the Subprocessors page.