Data Processing Agreement

Last updated: 29 October 2026

DRAFT — NOT YET IN FORCE. Prepared for David Curtin's review. A practising Irish solicitor must review this agreement before Grafkit relies on it or publishes it. Items in [square brackets] are placeholders; see review-checklist.md.

This Data Processing Agreement (DPA) forms part of the Grafkit Terms of Service (the Terms) between the client (the Controller, "you") and David Curtin, trading as Grafkit and Brainstorm Design (the Processor, "we"). It applies automatically when you accept the Terms. If you need a signed copy, email [email protected].

1. Definitions

1.1 "Data Protection Law" means the GDPR (Regulation (EU) 2016/679), the Irish Data Protection Act 2018, the ePrivacy Regulations (S.I. 336/2011), and any other data protection law that applies to the processing, including UK GDPR and Canadian and US privacy law where relevant.

1.2 "Client Personal Data" means personal data contained in the Client Materials (as defined in the Terms) or otherwise processed by us on your behalf in providing the Service.

1.3 Terms such as controller, processor, data subject, personal data, personal data breach, processing and supervisory authority have the meanings given in the GDPR.

2. Roles and scope

2.1 You are the controller (or a processor acting for another controller) of Client Personal Data, and we are your processor (or sub-processor).

2.2 We are a separate controller of the account, billing and usage data described in our Privacy Policy. This DPA does not apply to that data.

2.3 Details of the processing are set out in Annex 1.

3. Your obligations

3.1 You confirm you have a lawful basis for the processing, have given any notices and obtained any consents required, and that your instructions comply with Data Protection Law.

3.2 You will not give us special category data or data about criminal convictions unless we have agreed in writing how it will be handled.

4. Our obligations (Article 28(3) GDPR)

We will:

4.1 process Client Personal Data only on your documented instructions, which are the Terms, this DPA, and your use and configuration of the Service, including with regard to international transfers, unless required to do otherwise by EU or Irish law, in which case we will tell you first unless the law forbids it. We will tell you immediately if we think an instruction breaks Data Protection Law;

4.2 ensure everyone authorised to process Client Personal Data (staff, freelance designers and contractors) is bound by confidentiality;

4.3 take the technical and organisational measures in Annex 3, as required by Article 32 GDPR;

4.4 meet the conditions in clause 5 for engaging sub-processors;

4.5 help you, by appropriate measures and taking into account the nature of the processing, to respond to data subject requests. If we receive a request directly, we will pass it to you without undue delay and not respond ourselves except to direct the person to you;

4.6 help you meet your obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the information available to us;

4.7 when you close the account or ask us to, or after the inactivity period in clause 12.3B of the Terms, at your choice delete or return all Client Personal Data. Until then, a cancelled account stays open for you to view and download your files (Terms 12.3). Once closure is due, we delete Client Personal Data from live systems within 30 days, and it rolls off backups within 60 days after that, unless EU or Irish law requires us to keep it; and

4.8 make available all information reasonably necessary to show compliance with Article 28, and allow for and contribute to audits under clause 7;

4.9 keep a record of processing carried out on your behalf, as required by Article 30(2) GDPR; and

4.10 cooperate with the supervisory authority on request (Article 31 GDPR), telling you about any request concerning Client Personal Data unless the law forbids it.

4.11 Our help under clauses 4.5, 4.6 and 7 is free unless it is unusually large, in which case we may charge reasonable costs agreed in advance. We never charge for help needed because of our own breach.

5. Sub-processors

5.1 General authorisation. You give general authorisation for us to engage sub-processors. Our current sub-processors are listed in Annex 2 and at grafkit.com/subprocessors.

5.2 Changes. We will give you at least 30 days' notice before adding or replacing a sub-processor, by updating the public list and emailing the account owner.

5.3 Objection. You may object on reasonable data protection grounds within that notice period. We will discuss it in good faith. If we cannot resolve the objection, you may cancel your subscription with effect from the date the new sub-processor starts, and we will refund any prepaid Fees for the period after that date.

5.4 Flow-down. We impose on each sub-processor, by written contract, data protection obligations giving at least the same protection as this DPA. We remain liable to you for each sub-processor's performance.

6. Personal data breaches

6.1 We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Client Personal Data. This leaves you at least 24 hours of the 72 hours you have to notify your supervisory authority. Notice goes to the account owner's email and any security contact you give us. We document every breach, whether or not it is notified, as Article 33(5) requires.

6.2 The notice will include, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records; likely consequences; the measures taken or proposed; and a contact point. Where information is not available at first, we will provide it in phases without further undue delay.

6.3 We will take reasonable steps to contain, investigate and remedy the breach and cooperate with you. Our notice is not an admission of fault.

6.4 You are responsible for notifying supervisory authorities and data subjects where required, unless we agree otherwise.

7. Audits

7.1 We will answer your reasonable written questions about our compliance, and provide relevant summaries of our security measures and our sub-processors' certifications (for example, ISO 27001 or SOC 2 reports, where available).

7.2 If that is not enough to show compliance, or a supervisory authority requires it, you may audit us once in any 12-month period, on at least 30 days' notice, during business hours, at your cost, by yourself or an independent auditor bound by confidentiality, in a way that does not disrupt our business or breach other clients' confidentiality.

8. International transfers

8.1 We store Client Personal Data in the EU (Germany). Some sub-processors in Annex 2 may access or process it outside the EEA.

8.2 We will transfer Client Personal Data outside the EEA only where there is an adequacy decision (including the EU–US Data Privacy Framework for certified recipients), or under the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3 between us and the sub-processor), with supplementary measures where needed.

8.3 Clients outside the EEA. (a) Your transfer of data to us in Ireland needs no extra safeguard under the GDPR. Under UK law, the UK recognises the EEA as adequate, and Canadian law (PIPEDA) allows it, subject to your own accountability duties. (b) When we return or make Client Personal Data available to you in a country without an EU adequacy decision (for example, a US client not certified under the Data Privacy Framework), the Standard Contractual Clauses, Module 4 (processor to controller), are incorporated into this DPA by reference, with us as data exporter and you as data importer. Clause 7 (docking) does not apply, the governing law is that of Ireland, and the courts are those of Ireland. Canada (commercial organisations) has an EU adequacy decision, so this does not apply to Canadian clients.

8.4 Nothing in this DPA limits either party's liability to data subjects under Article 82 GDPR.

9. Liability and term

9.1 Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law does not allow it to be limited.

9.2 This DPA lasts as long as we process Client Personal Data. If it conflicts with the Terms on data protection matters, this DPA wins.

9.3 This DPA is governed by the law of Ireland, and the courts of Ireland have jurisdiction.

---

Annex 1 — Details of processing

Annex 2 — Sub-processors

Stripe processes billing data for which Grafkit is controller, and VBOUT (planned) processes marketing data; neither processes Client Personal Data, so they are not listed here. They appear on the public sub-processor list.

Annex 3 — Technical and organisational security measures

1. Encryption: TLS for all data in transit; encryption at rest for object storage (R2) and for off-site backups.

2. Access control: passwordless sign-in with single-use links that expire in 15 minutes; step-up verification before sensitive account actions; role-based permissions (owner, member, guest, staff); row-level security in the database separating each client's data; staff access on a need-to-know basis; secrets held in managed environment configuration, not in code.

3. Logging: audit log of account, billing and permission events; server and access logs retained for a limited period.

4. Resilience and backup: daily encrypted backups to a separate EU location (Hetzner Storage Box) and an off-site copy, with periodic restore drills; ability to restore availability and access in a timely manner.

5. Network security: Cloudflare in front of the app, providing DDoS protection and a web application firewall; server firewall exposing only needed ports; regular operating system and dependency updates.

6. People: confidentiality obligations in all staff and freelancer contracts; data protection training on joining; access removed when someone leaves.

7. Supplier management: written Article 28 terms with each sub-processor; review of their security certifications.

8. Data minimisation: we ask only for data needed for the work; AI helpers receive only the text and brief material relevant to the task; AI providers do not train on that content under their commercial terms.

9. Testing: regular review of these measures, and after any significant change or incident.

10. Incident response: a documented process for detecting, containing, assessing and notifying personal data breaches within the 48-hour window in clause 6.

Terms · Privacy · Cookies · Sub-processors · Company details · Accessibility · Cookie settings