Data Processing Agreement

Annex to the Terms of Service · version 1.0 · effective 11 November 2026

This agreement is an integral part of the Terms of Service. It applies when a company using ZERPY (the customer, controller) enters personal data into the service and Giffi OÜ (registry code 12483222, Erna põik 12, 76907 Suurupi, Estonia; the processor) processes it on the customer's behalf. The agreement meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).

1. Subject matter and duration

Subject matter	Providing the ZERPY service: storing, displaying and processing data according to the customer's actions, creating and sending documents and e-mails, integrations.
Duration	While the service is used and afterwards until the data is deleted (see section 9).
Purpose	Only providing the service to the customer.
Data subjects	The customer's staff and users; the customer's customers, suppliers and their contact persons; partner portal users; website chat visitors; other persons whose data the customer enters into the service.
Types of data	Names, e-mail addresses, phone numbers, addresses, registry and VAT numbers, order, shipment, invoice and payment data, claim conversations and files, task comments and files, website chat messages, notes.

The customer must not enter special categories of personal data (e.g. health data) into the service unless strictly necessary for using it.

2. Processor's obligations

The processor:

1. processes personal data only on the customer's documented instructions. The instructions are the Terms of Service, this agreement and the actions of the customer and its users in the service (e.g. sending an e-mail, switching on an integration). If an instruction appears to infringe the law, the processor informs the customer;
2. ensures that persons processing the data are bound by confidentiality;
3. applies the security measures described in section 4;
4. uses sub-processors only in accordance with section 5;
5. assists the customer in responding to data subject requests (section 6);
6. assists the customer in meeting its obligations regarding security, breach notification, impact assessments and prior consultation, taking into account the nature of processing and the information available to the processor;
7. deletes or returns the data when the agreement ends (section 9);
8. makes available the information needed to demonstrate compliance with this agreement (section 8).

The processor does not use the customer's data for its own purposes, does not sell it and does not use it for advertising.

3. Customer's obligations

The customer is responsible for having a legal basis for the processing, for informing data subjects and for the accuracy of the data entered. The customer manages its users' access and roles.

4. Security measures

• All connections are encrypted (TLS/HTTPS). The application and the database are located in the EU (Frankfurt).
• Each customer's data is logically separated. Every request is checked on the server by company and role, and direct external access to the database tables is closed.
• Passwords are stored as hashes. Integration secrets and webhook signing secrets are encrypted (AES-GCM). Only a hash of API keys is stored.
• Private files are kept in closed storage and only served after a permission check. Uploaded images are re-encoded and their metadata (e.g. GPS) is removed.
• Role-based permissions, including cost prices hidden from some roles. Activity log, sign-in history and security alerts about new devices and important changes.
• Web security protections (e.g. CSRF protection, content security policy, input validation, rate limits).
• Regular database backups at the service provider.

The processor may update the measures provided that the level of security does not decrease.

5. Sub-processors

The customer gives general authorisation to use the following sub-processors:

Sub-processor	Service	Data location
DigitalOcean, LLC	Application servers	Frankfurt, Germany
Supabase, Inc.	Database, authentication, file storage	Frankfurt, Germany
Sendinblue SAS (Brevo)	Sending e-mails	EU

The processor concludes agreements with sub-processors that ensure the same level of protection as this agreement. The processor informs the customer of any new sub-processor at least 30 days in advance. In case of a reasoned objection, the customer may stop using the service.

Services chosen by the customer are not sub-processors. When the customer switches on an integration (e.g. Merit Aktiva, Montonio, a webshop via the API, webhooks, AI chat with the customer's own Anthropic or OpenAI key) or a user connects an AI assistant (e.g. Claude, ChatGPT), the processor transfers data there on the customer's instruction. The relationship between those services and the customer is governed by their providers' terms.

Where data is processed outside the European Economic Area, the processor ensures safeguards under Chapter V of the GDPR (e.g. Standard Contractual Clauses).

6. Data subject requests

The customer can fulfil most requests itself: data can be viewed, corrected, deleted and downloaded in the service. Where this is not possible, the processor assists within a reasonable time. If the processor receives a request directly from a data subject, it forwards it to the customer.

7. Personal data breaches

The processor notifies the customer of a personal data breach without undue delay, where possible within 48 hours of becoming aware of it. The notice describes the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken. The processor assists the customer in notifying the supervisory authority and data subjects.

8. Information and audits

On the customer's reasoned request, the processor provides information about compliance with this agreement. If written information is not sufficient, the customer may, with reasonable notice and at its own cost, carry out an audit up to once a year. An audit must not endanger the confidentiality of other customers' data.

9. Deletion and return of data

After the service ends, the customer can download its data within 30 days. After that the processor deletes the customer's personal data within 90 days at the latest, unless the law requires it to be kept. Data in backups is deleted as the backups are rotated.

10. Liability and term

The liability provisions of the Terms of Service apply to the parties, unless the GDPR provides otherwise. This agreement is in force as long as the processor processes the customer's personal data. In case of conflict with the Terms of Service, this agreement prevails regarding the processing of personal data.

Contact

Giffi OÜ · hi@giffi.ee

See also: Terms of Service · Privacy Notice