Data Processing Agreement

Parties and acceptance

This Data Processing Agreement (“DPA”) is made under Article 28 of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) between:

• the person or company that holds the Smoothfunnels account (the “Customer”, controller); and
• Smoothware OÜ (the “Processor”, “we”), operator of Smoothfunnels:

Processor: Smoothware OÜ, a private limited company registered in Estonia
Estonian Business Register (registry code): 17596037
VAT: not VAT-registered
Address: Sepapaja tn 6, 15551 Tallinn, Estonia
Management board: Joshia Jeff Paul Wollrabe
Contact: info@smoothfunnels.ai · info@smoothware.io · +31 85 060 5265

Terms written with a capital letter and not defined here have the meaning they have in the Terms. “Lead Data” means the personal data described in Annex 1 that is collected through the Customer’s landing pages and processed by us for the Customer. This DPA does not cover the personal data of our own customers (account, billing, support) for which we are the controller; see our Privacy Policy.

1. Subject matter and duration (Art. 28(3) GDPR, introductory part)

1.1 The subject matter of this DPA is our processing of Lead Data on behalf of the Customer when the Customer uses the Service to collect, store and manage leads.

1.2 This DPA starts when the Customer accepts the Terms and lasts for as long as we process Lead Data for the Customer, including the period in clause 10 in which Lead Data is deleted or returned.

2. Nature and purpose of the processing (Art. 28(3))

2.1 We process Lead Data only to provide the Service to the Customer. In practice this means: receiving form submissions from the Customer’s landing pages (hosted by us or published to the Customer’s own site); storing them; showing them to the Customer in the lead inbox; sending the Customer a notification email; letting the Customer search, filter, update, export and delete them; and keeping backups of the database that holds them.

2.2 We do not use Lead Data for our own purposes, do not sell it, and do not send it to the AI provider that powers content generation.

3. Type of personal data and categories of data subjects (Art. 28(3))

3.1 The types of personal data and the categories of data subjects are listed in Annex 1. The Customer decides which fields a form asks for and is responsible for not collecting more than it needs.

4. Processing only on documented instructions (Art. 28(3)(a))

4.1 We process Lead Data only on the Customer’s documented instructions. The Customer’s instructions are this DPA, the Terms, and the Customer’s use of the Service’s features and settings (for example the lead retention period, the consent checkbox, export and delete actions).

4.2 We do not transfer Lead Data to a third country or an international organisation except as these instructions allow (see clause 12) or where EU or Dutch law requires us to; in that case we tell the Customer before processing unless the law forbids it.

4.3 If we believe an instruction infringes the GDPR or other data-protection law, we tell the Customer immediately.

5. Confidentiality of personnel (Art. 28(3)(b))

5.1 We ensure that everyone we authorise to process Lead Data is bound by a duty of confidentiality, by contract or by law, and processes Lead Data only as far as their work requires.

6. Security of processing (Art. 28(3)(c), Art. 32)

6.1 We take appropriate technical and organisational measures to protect Lead Data. At the date of this version they include:

• Separation of customers (tenant isolation): lead records belong to a website, and a website belongs to one account. Every request in the dashboard is checked against the account’s own websites, and a record of another account is answered as not found.
• Access control: access to the dashboard needs sign-in with a hashed password and a verified email address; sign-in, registration and password-reset attempts are rate limited; panels are separated by role (customer, staff, administrator); the public lead endpoint is rate limited.
• Encryption in transit: the Service is served over HTTPS (TLS).
• Encryption of credentials: access tokens for accounts the Customer connects (such as Google) are stored encrypted. Lead fields themselves are protected by the access controls above and are not additionally encrypted at column level.
• Backups and recovery: the database is backed up daily to an offsite object-storage bucket, on a rolling retention schedule of up to 2 years; failed or missing backups raise an alert by email.
• Monitoring: errors and scheduled jobs are monitored; error reports are configured not to include default personal data (IP address, cookies, request body, user details).
• Data minimisation tools: the Customer can set a retention period for leads, delete leads at any time, and export them.
• No AI exposure: Lead Data is not part of any prompt sent to an AI provider.

6.2 We review these measures from time to time and may change them, as long as the overall level of protection does not drop.

7. Sub-processors (Art. 28(2) and 28(4))

7.1 General authorisation. The Customer gives us general written authorisation to engage the sub-processors listed in Annex 2 to process Lead Data.

7.2 Notice of changes. We inform the Customer of any intended addition or replacement of a sub-processor at least 14 days before it starts processing Lead Data, by email to the account owner and by updating Annex 2 on this page.

7.3 Right to object. The Customer may object to the change on reasonable data-protection grounds within that period, by emailing info@smoothfunnels.ai. We then discuss an alternative with the Customer. If none is reasonably available, the Customer may stop using the Service and delete its account (clause 10) before the change takes effect.

7.4 We impose on each sub-processor, by contract, data-protection obligations that are no less protective than those in this DPA. We remain fully liable to the Customer for the performance of our sub-processors.

8. Assistance with data-subject requests (Art. 28(3)(e))

8.1 Taking into account the nature of the processing, we help the Customer to answer requests from data subjects who exercise their rights under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection). The lead inbox lets the Customer find, correct, export and delete a person’s lead record without our involvement; where that is not enough we provide reasonable help on request.

8.2 If a data subject contacts us about Lead Data, we do not answer on the merits; we refer them to the Customer and, where the Customer can be identified, pass the request on without undue delay.

9. Assistance with Articles 32 to 36 and personal data breaches (Art. 28(3)(f), Art. 33)

9.1 We notify the Customer without undue delay after becoming aware of a personal data breach that affects Lead Data. The notice goes to the account owner’s email address (the Customer must keep it up to date) and contains, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed, so that the Customer can meet its own duty under Articles 33 and 34. We add information as it becomes available.

9.2 We also help the Customer, taking into account the nature of the processing and the information we have, with its obligations on security of processing (Article 32), data protection impact assessments (Article 35) and prior consultation of the supervisory authority (Article 36).

10. Deletion or return of data (Art. 28(3)(g))

10.1 At any time, and in particular before the Service ends, the Customer can export its leads (CSV from the lead inbox; a full JSON export under Account privacy) and can delete leads individually, in bulk, or automatically through the retention period it sets per website.

10.2 When the Customer deletes its account, its websites and their leads are deleted from our live systems straight away (while other members remain on the account, the account’s websites stay until the last member is deleted).

10.3 Copies of the database held in backups are not deleted individually. They expire on the rolling schedule in clause 6.1 (up to 2 years), are used only to restore the Service after a failure, and are not otherwise processed. We keep Lead Data longer only where EU or Dutch law requires it.

11. Audits and information (Art. 28(3)(h))

11.1 We make available to the Customer the information necessary to demonstrate our compliance with Article 28 GDPR: this DPA, the sub-processor list and written answers to reasonable questions.

11.2 We allow for and contribute to audits, including inspections, by the Customer or an auditor it mandates, if the information under 11.1 is not sufficient or a supervisory authority or a breach requires it. The Customer gives at least 30 days’ written notice (shorter where a breach requires it), the audit takes place during business hours without unreasonably disrupting our business, is subject to confidentiality, does not give access to other customers’ data, and is normally limited to once a year. The Customer bears its own costs and ours for the time spent.

12. Transfers outside the EEA

12.1 Some sub-processors in Annex 2 may process Lead Data outside the European Economic Area. Where they do, we ensure appropriate safeguards under Chapter V GDPR, such as the EU-US Data Privacy Framework or Standard Contractual Clauses, as applicable to that sub-processor.

13. The Customer’s responsibilities

13.1 The Customer is the controller of Lead Data. It is responsible for having a lawful basis for collecting it, for informing the people who fill in its forms (for example through the privacy-policy link and the consent checkbox that the Service lets it show on each website), for the lawfulness of its instructions, and for how it uses Lead Data after export.

14. Liability

14.1 Liability under or in connection with this DPA follows the limitation-of-liability clause of the Terms of Service. This does not limit any liability that cannot be limited by law, nor the rights of data subjects under Article 82 GDPR.

15. Term, precedence and governing law

15.1 If this DPA and the Terms conflict on the processing of Lead Data, this DPA prevails. Changes to this DPA are made in the way the Terms provide for changes, and the version and date at the top of this page show the current text.

15.2 Dutch law governs this DPA and the Dutch courts have jurisdiction, as set out in the Terms.

Annex 1 — Details of the processing

Annex 2 — Sub-processors that can process Lead Data

The following sub-processors are authorised under clause 7. Anthropic (AI), Stripe (payments) and Google (sign-in and statistics) are used by the Service too, but do not receive Lead Data; they are listed in our Privacy Policy.

Contact

Questions about this DPA, or notices under it, go to info@smoothfunnels.ai.