This document is currently only available in English.
Data Processing Agreement
EntrepreJee Last updated: [date]
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the Terms of Service between you ("Controller", "you") and [Company Legal Name] ("Processor", "EntrepreJee", "we"). It applies whenever you enter personal data about your own customers or contacts ("Customer Personal Data") into the Service. It reflects the requirements of Article 28 of the EU General Data Protection Regulation (2016/679, "GDPR").
1. Definitions
Terms such as "personal data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in Article 4 GDPR. "Customer Personal Data" means personal data relating to your customers, contacts, or other third parties that you or your users submit to the Service, as distinct from your own account and business-profile data (which EntrepreJee processes as controller under the Privacy Policy).
2. Roles
You are the controller of Customer Personal Data. EntrepreJee is the processor, acting only on your documented instructions as set out in this DPA and as given by your use of the Service's ordinary functionality (e.g. creating a customer record, generating an invoice).
3. Subject matter, duration, and nature of processing
- Subject matter: hosting, storage, and processing of Customer Personal Data as necessary to provide the Service (customer relationship management, invoicing, quoting, time tracking, document generation, and related reporting).
- Duration: for as long as your subscription is active, and thereafter only as needed to comply with section 9 (data return and deletion) and any statutory retention obligations described in the Privacy Policy.
- Nature of processing: storage, retrieval, structuring, and display of Customer Personal Data within the Service; no processing occurs outside what is needed to provide the Service to you.
4. Categories of data subjects and personal data
- Data subjects: your customers, clients, and other contacts that you choose to record in the Service.
- Categories of personal data: name, email address, phone number, postal address, free-text notes, and any personal data contained in invoices, quotes, time entries, or documents you create (e.g. billing details, project descriptions).
We do not require or expect you to submit special categories of personal data (Article 9 GDPR, e.g. health or biometric data) into the Service, and you should not do so.
5. Processor obligations
EntrepreJee will:
- Process Customer Personal Data only on your documented instructions, including regarding international transfers, unless required to do otherwise by EU or Member State law (in which case we will inform you first, unless prohibited from doing so).
- Ensure that personnel authorised to process Customer Personal Data are bound by confidentiality obligations.
- Implement appropriate technical and organisational measures under Article 32 GDPR, including encryption of data at rest and in transit and database-level access control (row-level security) that restricts each customer's data to that customer's own account, as described in the Privacy Policy.
- Taking into account the nature of the processing, assist you by appropriate technical and organisational measures, insofar as reasonably possible, in fulfilling your obligation to respond to data subject rights requests. Where your customer contacts us directly about their data, we will redirect them to you and support you in responding.
- Assist you in ensuring compliance with your obligations under Articles 32–36 GDPR (security, breach notification, data protection impact assessments), taking into account the information available to us.
- Notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
- At your choice, delete or return all Customer Personal Data after the end of the provision of the Service, and delete existing copies, except where EU or Member State law (e.g. bookkeeping retention obligations) requires storage of that data.
- Make available to you the information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor mandated by you, on reasonable notice.
6. Technical and organisational measures
Under Article 32 GDPR and section 5.3 above, EntrepreJee implements the following technical and organisational measures ("TOMs") to protect Customer Personal Data. This is a factual snapshot as of this draft, not a certification — items marked "to be confirmed" are genuinely not yet decided or verified and must be resolved (or honestly narrowed) before this document is relied on or shown to a customer.
| Category | Measure | Status |
|---|---|---|
| Physical security | Data-centre physical security | Inherited from our cloud sub-processors (Supabase, [hosting provider]) — to be confirmed: their physical/facility certifications haven't been independently reviewed yet. |
| Cloud hosting | Application and database hosting | Application hosted on [Vercel Inc.]; database, authentication, and file storage hosted on Supabase (managed PostgreSQL). See section 7 (Sub-processors) and the Privacy Policy for the current provider list. |
| Restricted access | Who can access production data | Currently limited to the business owner via the cloud providers' own dashboards/credentials — to be confirmed: no formal multi-person access policy exists yet, and (see TODO.md's "Production database" item) a dedicated production project separate from the development/test project has not been created yet either. |
| Network security | HTTPS | Enforced for all application traffic by our hosting provider. |
| TLS | Enforced for all connections to the database (Supabase). | |
| Firewalls | Provided by our cloud sub-processors' infrastructure — to be confirmed: no additional custom firewall or web-application firewall is configured by EntrepreJee itself beyond what the providers include by default. | |
| Database | Row-level security | In place and enforced at the database level: PostgreSQL row-level security policies scope every business's data (customers, invoices, quotes, products, expenses, documents, etc.) to that business's own members, keyed off the authenticated user — not just application-level filtering. |
| Encryption at rest | Provided by Supabase's underlying infrastructure by default — not implemented separately in EntrepreJee's own application code. | |
| Encryption in transit | Enforced via TLS on all connections between the Service and the database. | |
| Authentication | Secure authentication | User authentication is handled by Supabase Auth (session management, email verification, password reset flows) rather than custom-built authentication code. |
| Password hashing | Passwords are hashed (bcrypt) by Supabase Auth; EntrepreJee never stores or has access to plaintext passwords. | |
| Access control | Least privilege | Enforced at the application/data level via row-level security plus a three-tier role model (owner / user / viewer) that limits what each team member of a business can view, edit, or delete. Least-privilege access to production infrastructure itself (as opposed to within the app) is covered under "Restricted access" above — to be confirmed. |
| Admin access logging | Implemented. Every successful sign-in is recorded (user, business, IP address, browser/device information, timestamp) in a dedicated login_events table, readable only by the business owner (enforced at the database level via row-level security) and automatically deleted after 60 days. See ACCESS_LOGGING.md for the design and TODO.md's "User access / IP logging" entry for status. This does not cover per-record data-access auditing (e.g. who viewed a specific invoice) — only authentication events, matching the scope of the original gap. |
|
| Monitoring | Error logging | Minimal — currently limited to our hosting provider's default runtime/function logs; no dedicated error-tracking service is integrated — to be confirmed whether this is sufficient before going live. |
| Intrusion monitoring | Not yet implemented. No intrusion detection/monitoring tooling is in place — to be confirmed. | |
| Backup | Daily backups | To be confirmed — depends on which Supabase project tier the production project uses; automatic backup frequency and retention vary by plan and have not yet been selected/verified for the production project (see TODO.md's "Production database" item). |
| Disaster recovery | Not yet implemented. No documented disaster-recovery plan (e.g. restore-time objectives, tested recovery procedure) exists yet. |
Do not represent any "to be confirmed" or "not yet implemented" item above as an existing safeguard to a customer or auditor until it is genuinely in place — this table should be updated in the same change that resolves each gap, the same way the rest of this document must stay accurate to reality (see the note at the end of this document).
7. Sub-processors
You provide general authorisation for EntrepreJee to engage the sub-processors listed in section 6 of the Privacy Policy for the purposes described there. We will keep that list up to date and will inform you of any intended addition or replacement of a sub-processor, giving you the opportunity to object on reasonable data-protection grounds. Any sub-processor we engage will be bound by data protection obligations no less protective than those in this DPA.
8. International transfers
Where a sub-processor is located outside the European Economic Area, transfers of Customer Personal Data to it will be governed by the European Commission's Standard Contractual Clauses or another valid transfer mechanism under Chapter V GDPR, as described in the Privacy Policy.
9. Data return and deletion on termination
On termination of your subscription, and subject to statutory retention obligations described in the Privacy Policy, we will delete Customer Personal Data within a reasonable period. You can export your customer, invoice, and document data from within the Service before terminating your account.
10. Liability
Liability under this DPA is subject to the limitation of liability set out in section 15 of the Terms of Service.
11. Governing law
This DPA is governed by the laws of Finland, consistent with section 18 of the Terms of Service.
12. Contact
Questions about this DPA can be sent to [privacy@entreprejee.com].
This is a generic starting template, not legal advice. A real Art. 28 DPA is a binding contract with specific obligations (audit rights, breach notification timelines, sub-processor lists) that should match what you can actually operationally deliver — don't publish promises (e.g. audit cooperation, breach notice timing) you can't keep. Have a qualified Finnish/EU lawyer review this before publishing, especially sections 5–9 — and note that section 6 (Technical and organisational measures) has several items still marked "to be confirmed" or "not yet implemented" that must be resolved, not just reworded, before this document can be relied on.