Client data processing and confidentiality (DPA / NDA)

1. Subject and scope

The Processor processes Controller data (exports from CRM, ad platforms, GA4, databases, spreadsheets, etc.) solely to deliver the Services — data modelling, dashboards, reports and support — and only on the Controller’s documented instructions (Art. 28 GDPR).

2. Access principles

Least privilege: read-only access, dedicated service accounts or scoped API keys wherever possible.

Access is granted and revoked by the Controller; stored credentials are deleted when the engagement ends.

End-customer personal data is aggregated or pseudonymised before it reaches the workspace wherever possible.

3. Confidentiality (NDA)

The Processor keeps all non-public Controller information (data, metrics, financials, business plans) confidential during the engagement and for 3 years after, and does not disclose it without written consent unless required by law.

Demos and portfolio materials use fictional data only; Controller data is never used in them.

4. Sub-processors

Workspace hosting: Railway; CDN and security: Cloudflare; where enabled, AI model providers for the AI assistant (aggregated metrics only, no personal data). The list is available on request; the Controller is notified in advance of changes.

On request the workspace can be deployed in the Controller’s own infrastructure so data never leaves its perimeter.

5. Security measures

Encryption in transit (TLS), role- and page-level access control, two-factor authentication (TOTP), audit log, Cloudflare Access or corporate VPN in front of the workspace, regular dependency updates.

6. Incidents

The Processor notifies the Controller of any personal data breach without undue delay and no later than 48 hours after discovery, and assists with remediation.

7. End of processing

At the end of the Services the Processor returns or deletes Controller data and copies within 30 days, at the Controller’s choice, and confirms this in writing.