Data Processing Agreement

between the Controller— the partner agency identified in the signature block ("Agency") — and the Processor: Freelopers OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia ("Freelopers"), together "the Parties". It supplements the service relationship under which the Agency uses the freehub platform.

1. Subject matter, duration, nature and purpose

Freelopers processes personal data on the Agency's behalf to provide the freehub project-reporting platform: consolidating the Agency's project content (cards, notes, documents, meeting transcripts, items pulled from tools the Agency connects), team time entries and derived AI summaries on one screen. Duration: as long as the Agency uses freehub, plus the wind-down in §9.

2. Data types and data subjects (Annex A)

Data subjects: the Agency's staff, its clients' staff, and other persons appearing in project communication. Data types: names, business contact details, work content (tasks, notes, transcripts, e-mail excerpts from consented connectors), time entries (person · project · hours), and technical logs. No special-category data is intended for the platform; the Agency instructs its users accordingly.

3. Documented instructions

Freelopers processes only per this DPA, the platform's documented functionality, and the Agency's additional documented instructions, unless EU/Member-State law requires otherwise (in which case Freelopers informs the Agency before processing, where permitted). Freelopers informs the Agency if an instruction, in its opinion, infringes the GDPR.

4. Confidentiality and personnel

Persons authorised to process the data are bound to confidentiality and access data strictly need-to-know (see the platform's role model, documented in-app).

5. Security (Art. 32) — Annex B

The technical and organisational measures are published and maintained at hub.freelopers.com/trust (EU data location, tested tenant isolation, encryption at rest for credentials, hashed passwords/tokens with expiry, rate limiting, audit logging, least-visibility access). That page constitutes Annex B; material reductions of the protection level require notice per §7.

6. Subprocessors

The Agency grants general authorisation for the subprocessors listed at /trust#subprocessors (Annex C). Freelopers informs the Agency of intended additions or replacements at least 14 days in advance (e-mail suffices); the Agency may object on reasonable data-protection grounds. Equivalent Art. 28 obligations are imposed on every subprocessor. Transfers outside the EEA rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses as per each subprocessor's DPA.

7. Assistance and notifications

Freelopers assists the Agency with data-subject requests (Art. 12–23) and, taking the nature of processing into account, with Art. 32–36 obligations. Personal-data breaches are notified to the Agency without undue delay after becoming aware, with the information required by Art. 33(3) as it becomes available.

8. Audits

Freelopers makes available the information necessary to demonstrate Art. 28 compliance (documentation, the /trust page, self-assessments and — once available — third-party attestations) and allows audits by the Agency or a mandated auditor with reasonable notice, during business hours, at most annually unless a breach gives cause.

9. Deletion and return

Upon termination, Freelopers deletes or returns (JSON export) the Agency's personal data at the Agency's choice within 30 days, and deletes remaining copies from backups on their rotation schedule, unless EU/Member-State law requires storage.

10. Miscellaneous

Liability follows the main service relationship and Art. 82 GDPR. This DPA prevails over conflicting terms for data protection. Governing law: the law governing the service relationship; place of jurisdiction likewise. If a provision is invalid, the remainder stands.