Data Processing Agreement

For the purposes of this DPA, the following terms apply as defined in Article 4 GDPR unless otherwise stated:

• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data (collection, storage, retrieval, use, disclosure, deletion).
• Controller: the Customer — the entity that determines purposes and means of processing.
• Processor: APSOLU Pro / CGID Project Management LLC — the entity processing data on the Controller’s behalf.
• Sub-processor: any third party engaged by the Processor to process personal data.
• Data Breach: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
• EEA: European Economic Area.
• SCCs: EU Standard Contractual Clauses (Commission Decision 2021/914/EU).

This DPA governs the processing of personal data by APSOLU Pro in the context of providing its construction project management Software-as-a-Service (“Service”) to the Customer.

This DPA enters into force on the date the Customer first accepts APSOLU Pro’s Terms of Service and remains in force for the duration of the subscription. Upon termination, Section 11 (Data Retention & Deletion) applies.

The Customer grants general authorisation to engage the sub-processors listed below. APSOLU Pro will notify the Customer at least 30 days before adding or replacing a sub-processor, giving the Customer an opportunity to object on reasonable grounds.

Sub-processor DPAs and SCCs are maintained by each respective provider and available on their legal pages. APSOLU Pro has executed or relies on standard DPA agreements with each sub-processor listed above.

The Customer, as Data Controller, agrees to:

• Establish and maintain a lawful basis for processing personal data within the Service (e.g. legitimate interest, contract performance, consent where required).
• Ensure data subjects (employees, contacts) have been informed of the processing, in accordance with Articles 13–14 GDPR.
• Not upload special category data (Art. 9 GDPR) or data relating to children under 16 to the Service.
• Provide APSOLU Pro with timely and accurate instructions where processing deviates from this DPA.
• Designate a security contact in the APSOLU Pro account settings to receive breach notifications.

APSOLU Pro, as Data Processor, commits to:

1. Process only on instructions. Process personal data solely on the documented instructions of the Controller, unless required by applicable law (in which case APSOLU Pro will inform the Controller, to the extent permitted by law).
2. Confidentiality. Ensure all persons authorised to process personal data are bound by contractual or statutory confidentiality obligations.
3. Security. Implement appropriate technical and organisational measures per Article 32 GDPR (see Section 8).
4. Sub-processing. Not engage sub-processors without prior general or specific authorisation of the Controller (see Section 5). Impose equivalent data protection obligations on sub-processors by contract.
5. Data subject rights. Assist the Controller, by appropriate technical and organisational measures, to fulfil its obligation to respond to data subject requests (see Section 9).
6. Security assistance. Assist the Controller in ensuring compliance with Articles 32–36 GDPR (security, breach notification, DPIA).
7. Deletion / return.At the Controller’s choice, delete or return all personal data on termination of the service (see Section 11).
8. Audit cooperation. Make available all information necessary to demonstrate compliance and allow audits conducted by the Controller or their designated auditor (see Section 13).
9. Notification of conflicts.Immediately notify the Controller if, in APSOLU Pro’s opinion, an instruction infringes applicable data protection law.

APSOLU Pro implements the following technical and organisational security measures pursuant to Article 32 GDPR:

APSOLU Pro provides mechanisms to assist the Controller in responding to data subject requests under Articles 15–22 GDPR. Controllers may submit requests via privacy@apsolu.app.

APSOLU Pro will acknowledge all verified requests within 72 hours and complete the action within 30 days. Where technically complex or high volume, this period may be extended by a further two months, with notification to the Controller.

Where personal data is transferred outside the EEA (to Clerk, Vercel, OpenRouter, Google, Stripe — all US-based), APSOLU Pro relies on:

• EU Standard Contractual Clauses (Commission Implementing Decision 2021/914/EU, Module 2: Controller-to-Processor) executed with each sub-processor.
• Transfer Impact Assessments (TIA) conducted for US-based sub-processors — available on request.
• For AI inference (OpenRouter/Google Gemini): transfers are transient (request/response cycle only) and covered by SCCs. No personal data is retained by these providers post-inference.

Primary data storage remains in the EU (eu-central-1). International transfers are limited to the minimum necessary for the operation of the Service.

Ref: Audit TRUST-003 — Q15. In the event of a confirmed or suspected personal data breach, APSOLU Pro follows this notification procedure:

To report a suspected breach or security vulnerability: security@apsolu.app

The Controller has the right to audit APSOLU Pro’s data processing activities to verify compliance with this DPA. The following procedure applies:

• Written notice of at least 30 days prior to the audit.
• Audits conducted during business hours, at most once per 12-month period.
• Costs of the audit are borne by the Controller unless APSOLU Pro is found to be non-compliant.
• APSOLU Pro may satisfy audit requests by providing current third-party certifications, audit reports (SOC 2 Type II from sub-processors), or penetration test summaries in lieu of direct on-site access.
• Auditors must execute a confidentiality agreement before accessing any APSOLU Pro systems or documentation.

Each party’s liability under this DPA is subject to the limitations and exclusions set out in the APSOLU Pro Terms of Service. APSOLU Pro’s aggregate liability to the Controller for breaches of this DPA shall not exceed the total fees paid by the Controller in the 12 months preceding the incident.

APSOLU Pro is not liable for breaches caused by the Controller’s failure to comply with its obligations under Section 6, or by instructions provided by the Controller that conflict with applicable data protection law.

This DPA is governed by and construed in accordance with the data protection laws of the European Union(Regulation 2016/679 — GDPR). Where required by the Controller’s jurisdiction, additional local law requirements apply and are addressed in a supplementary schedule upon request.

Disputes arising from this DPA shall first be subject to good-faith negotiation between the parties. If unresolved within 30 days, disputes shall be referred to the competent courts of the Controller’s EEA member state, or — for non-EEA Controllers — to the courts of competent jurisdiction agreed in the Terms of Service.

For questions about this DPA, to request a signed copy, or to exercise Controller rights under GDPR, contact us at privacy@apsolu.app. We respond within 5 business days.