Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the agreement between ELIM GROUP LLC ("estype", "we", "us") and the customer ("you") for the estype service, made up of our Terms of Service and any order or plan you buy (together, the "Agreement"). By accepting the Agreement, creating a workspace or using the service, you accept this DPA on behalf of the organisation you represent, and you confirm you have authority to do so. No separate signature is needed.

1. How this DPA applies

1.1 This DPA applies only where we process Personal Data on your behalf in providing the service. It does not cover data we handle as a controller for our own purposes, such as account, billing and website data; our Privacy Policy describes that.

1.2 Except as this DPA changes it, the Agreement stays in full force. Terms used and not defined here have the meaning given in the Agreement.

1.3 If you need a countersigned copy for your records, write to legal@estype.com. A signed copy has the same terms as this page.

2. Definitions

• "Data Protection Law" means the laws on the protection of personal data that apply to the processing under the Agreement, including the UK GDPR and the Data Protection Act 2018, the EU GDPR, the Swiss Federal Act on Data Protection where it applies, and US state privacy laws that impose service provider obligations on us.
• "EU GDPR" means Regulation (EU) 2016/679.
• "UK GDPR" means the EU GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland under the European Union (Withdrawal) Act 2018.
• "Customer Data" means the data you or your users put into the service, or that the service receives from the sources you connect, including content, form submissions, applications, records and files.
• "Personal Data" means personal data (as defined by Data Protection Law) within Customer Data that we process on your behalf.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data in our systems or those of our Subprocessors. It does not include unsuccessful attempts that do not compromise Personal Data, such as blocked log-in attempts, pings, port scans or denial-of-service attacks.
• "Subprocessor" means a third party we engage that processes Personal Data on your behalf.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914 ("EU SCCs"), and "UK Addendum" means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, each as amended or replaced.
• "Controller", "processor", "data subject", "processing" and "supervisory authority" have the meanings given in the UK GDPR or EU GDPR.

3. Roles and scope

3.1 You are the controller of Personal Data and we are your processor. If you act as a processor for another controller, we are your subprocessor, and you confirm that controller has authorised your use of the service and of us.

3.2 The subject matter, duration, nature and purpose of the processing, and the types of Personal Data and categories of data subjects, are set out in Annex I.

3.3 We may process data about how the service is used, such as logs, performance and error data, and usage counts for billing, as a controller for running, securing, billing and improving the service, as our Privacy Policy describes. We do not use Customer Data to train AI models, we do not send it to AI providers, and we do not sell it or use it for advertising.

4. Processing on your instructions

4.1 We process Personal Data only on your documented instructions, unless the law we are subject to requires otherwise. In that case we will tell you of the legal requirement before processing, unless that law forbids it on important grounds of public interest.

4.2 Your instructions are the Agreement, this DPA, the way you configure and use the service (including the sources, destinations, forms, roles and API keys you set up), and any further written instructions we agree with you. Instructions outside the scope of the service, or that would require material changes to it, need our written agreement, which may include fees.

4.3 We will tell you promptly if, in our opinion, an instruction infringes Data Protection Law. We may then suspend that processing until you confirm or change the instruction.

5. Your responsibilities

5.1 You are responsible for:

• having a lawful basis for the Personal Data you put into the service or have it collect;
• giving data subjects the notices, and getting the consents, that Data Protection Law requires;
• the accuracy and quality of Personal Data, and that your instructions comply with the law;
• configuring the service appropriately: who has which role, which API keys exist and which origins they allow, which forms are public, and which systems are connected;
• keeping your users' passwords and your API keys and credentials secret.

5.2 The service is not designed for special category data, criminal offence data, payment card data or children's data. Do not put such data into the service unless we have agreed in writing that it is appropriate for your use.

6. Confidentiality and personnel

6.1 We give access to Personal Data only to personnel who need it to provide, secure or support the service, and only to the extent needed. Everyone with access is bound by a duty of confidentiality that continues after their engagement ends.

6.2 We do not access the content of your workspace except to provide, secure or support the service, to investigate a fault or incident, to comply with the law, or when you ask us to.

7. Security

7.1 We implement and maintain the technical and organisational measures in Annex II, designed to protect Personal Data against Personal Data Breaches and appropriate to the risk, as required by Article 32 UK GDPR and EU GDPR. Our Security page describes them in more detail.

7.2 We may change these measures as technology and threats evolve, but we will not reduce the overall level of protection of Personal Data during your subscription.

8. Subprocessors

8.1 General authorisation. You give us general authorisation to engage Subprocessors. The Subprocessors we use at the date of this DPA are listed on our Subprocessors page and in Annex III, and you approve them.

8.2 Our obligations. Before a Subprocessor processes Personal Data, we will put in place a written contract that requires it to protect Personal Data to a standard no lower in substance than this DPA. We remain responsible to you for each Subprocessor's performance of its data protection obligations.

8.3 Notice of changes. We will give at least 30 days' notice before a new or replacement Subprocessor starts processing Personal Data, by updating the Subprocessors page and emailing the owners of every workspace. Where an emergency replacement is needed to keep the service running or secure, we will give notice as soon as we can, and your objection rights still apply.

8.4 Objections. You may object to a new Subprocessor on reasonable data protection grounds by writing to privacy@elim.io within the 30-day notice period. We will discuss the objection with you in good faith and, where we reasonably can, offer a change that avoids the Subprocessor processing your Personal Data. If we cannot resolve it within 30 days of your objection, you may terminate the affected part of the service by written notice, and we will refund, through Paddle, any fees you prepaid for the period after termination.

9. Integrations and agents you connect

9.1 Third-party services you connect to your workspace, such as Webflow, Ashby, Notion, Slack, Quire, Esteem, your bank, or your own website and webhooks, are not our Subprocessors. You choose them, you hold the contract with them, and data flows to and from them on your instruction. We are not responsible for how they process data.

9.2 AI agents or scripts you run against the service through the CLI or API act with the credentials you give them, under your control and responsibility. What they do counts as your instruction.

10. Data subject requests and other assistance

10.1 Requests. If we receive a request from a data subject about Personal Data, we will not answer it ourselves except to direct the person to you, and we will pass it to you promptly where we can identify you. Taking into account the nature of the processing, we will help you answer requests to exercise data subject rights, mainly through the service itself: you can find, export, correct and delete records from the app, the CLI and the API.

10.2 Impact assessments and authorities. Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments and prior consultations with a supervisory authority, and we will cooperate with a supervisory authority's lawful requests about our processing of Personal Data.

10.3 Costs. Help that the service and our documentation already provide is free. For substantial further help we may charge reasonable costs, agreed with you in advance, unless the need for it arises from our breach of this DPA.

11. Personal data breaches

11.1 Notice. We will notify you without undue delay, and in any case within 48 hours of becoming aware of a Personal Data Breach affecting your Personal Data. We will send the notice to the owners of the affected workspace by email.

11.2 Content. As far as we know it at the time, the notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address it and reduce its effects, and a contact for further information. Where we cannot give everything at once, we will give it in phases as it becomes available.

11.3 Response. We will promptly take reasonable steps to contain, investigate and remedy the breach and to prevent it happening again, and we will give you the reasonable help you need to meet your own obligations to notify supervisory authorities and data subjects.

11.4 Deciding whether to notify authorities or data subjects is your responsibility as controller. Our notice of a breach is not an admission of fault or liability.

12. Return and deletion

12.1 During the subscription you can export and delete Customer Data yourself at any time, through the app (CSV or JSON exports), the CLI and the API.

12.2 After the subscription ends, you have 30 days to export Customer Data, and we will help with a full export of your workspace database on request during that time. We then delete Customer Data from the live service within the following 30 days.

12.3 Backups. Deleted data remains in our backups only until they rotate: 7 days for the continuous replica and nightly copies, 14 days for disk snapshots, and 8 weeks for the weekly off-site copy. Until then the data stays protected under this DPA and is not used for anything else.

12.4 We may keep Personal Data longer only where the law requires us to, and then only for that purpose. On request we will confirm deletion in writing.

13. Information and audits

13.1 Information first. On written request, we will give you the information reasonably necessary to show that we meet our obligations under Article 28 UK GDPR and EU GDPR and this DPA, including written answers to reasonable security questionnaires and a description of our measures. We do not currently hold third-party certifications or audit reports such as SOC 2 or ISO 27001, and we will tell you so rather than imply otherwise.

13.2 Audits. If that information is not enough to show compliance, or a supervisory authority requires it, or after a Personal Data Breach affecting your Personal Data, you may audit our compliance with this DPA, by yourself or through an independent auditor bound by confidentiality who is not our competitor. An audit needs at least 30 days' written notice (less where an authority requires it), takes place no more than once in any 12 months unless an authority requires more, is carried out during normal business hours and preferably remotely, and must not disrupt the service or give access to other customers' data or to information whose disclosure would compromise the security of the service.

13.3 Costs. You bear the costs of an audit. If an audit shows we have materially breached this DPA, we bear our own costs of supporting it and promptly fix the breach. Audit results are our confidential information.

14. International transfers

14.1 Where data is. We host Customer Data in the European Union, on Google Cloud in Belgium with a backup replica in Finland. Some processing takes place outside the EEA and the UK: ELIM GROUP LLC operates and supports the service from outside the EEA and the UK, and some Subprocessors operate globally, as the Subprocessors page shows.

14.2 EU SCCs. To the extent our processing involves a transfer of Personal Data that is subject to the EU GDPR to a country without an adequacy decision, the EU SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) where you are a processor;
• you are the data exporter and ELIM GROUP LLC is the data importer;
• Clause 7 (docking clause) applies;
• in Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 8.3 of this DPA;
• the optional wording in Clause 11(a) does not apply;
• in Clause 17, Option 1 applies and the EU SCCs are governed by the law of Ireland;
• in Clause 18(b), disputes are resolved by the courts of Ireland;
• Annex I.A and I.B of the EU SCCs are completed by Annex I of this DPA, Annex I.C by section C of Annex I, Annex II by Annex II, and Annex III by Annex III.

14.3 UK Addendum. To the extent our processing involves a transfer of Personal Data subject to the UK GDPR to a country without UK adequacy regulations, the UK Addendum is incorporated by reference and applies to the EU SCCs as completed in section 14.2. In Table 1 the parties are as set out in Annex I; in Table 2 the version of the approved EU SCCs is the one described in section 14.2, including the module; Table 3 is completed by Annexes I, II and III; and in Table 4 either party may end the UK Addendum as its Section 19 allows. The mandatory clauses in Part 2 of the UK Addendum apply.

14.4 Switzerland. For transfers subject to the Swiss Federal Act on Data Protection, the EU SCCs apply as in section 14.2, with references to the EU GDPR read as references to that Act, the Swiss Federal Data Protection and Information Commissioner as the competent authority, and "Member State" including Switzerland so that Swiss data subjects can enforce their rights in Switzerland.

14.5 Precedence and replacement. If this DPA conflicts with the SCCs or the UK Addendum, they prevail for the transfer concerned. If a transfer mechanism we rely on is invalidated or replaced, we will work with you to put a valid one in place, and may do so by updating this DPA under section 17.3.

14.6 Requests from public authorities. If a public authority asks us for Personal Data, we will refer it to you where we can, challenge requests we consider unlawful, disclose only the minimum the law requires, and tell you about the request unless the law forbids it.

15. US state privacy laws

Where US state privacy laws, such as the California Consumer Privacy Act, apply to Personal Data, we act as your service provider or processor. We will not sell or share Personal Data; retain, use or disclose it for any purpose other than providing the service under the Agreement, or outside our direct business relationship with you; or combine it with personal information we receive from others, except as those laws allow. We will tell you if we can no longer meet these obligations, and you may then take reasonable steps to stop and remedy any unauthorised use. We certify that we understand and will comply with these restrictions.

16. Liability

Each party's liability under or in connection with this DPA and the SCCs is subject to the limitations and exclusions of liability in the Agreement, to the extent Data Protection Law allows. Nothing in this DPA limits a data subject's rights under the SCCs, or either party's liability that cannot be limited by law.

17. Term, changes and order of precedence

17.1 Term. This DPA takes effect when you accept the Agreement or when we first process Personal Data for you, whichever is earlier, and lasts for as long as we process Personal Data for you, including the deletion period in section 12.

17.2 Order of precedence. If documents conflict, the order is: the SCCs and the UK Addendum (for the transfers they cover), then this DPA, then the rest of the Agreement. This DPA prevails over the Terms only for the processing of Personal Data.

17.3 Changes. We may update this DPA by publishing a new version on this page. Changes required by law, needed to keep a valid transfer mechanism, or that do not reduce the protection of Personal Data take effect when published. Any other material change takes effect 30 days after we email workspace owners about it; if it materially reduces your rights, you may terminate the affected service before it takes effect.

17.4 Governing law. Except where the SCCs require another law, this DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

17.5 Notices. Notices to us under this DPA go to privacy@elim.io, with legal notices copied to legal@estype.com. Notices to you go to the email of your workspace owners.

Annex I: Parties and description of processing

A. List of parties

B. Description of processing

C. Competent supervisory authority

For the EU SCCs, the supervisory authority competent under Clause 13: where you are established in the EU, the authority of your Member State; where you are not established in the EU but have appointed a representative under Article 27 EU GDPR, the authority of the Member State where the representative is established; otherwise, the authority of the Member State where the data subjects whose Personal Data is transferred are located. For the UK Addendum, the UK Information Commissioner.

Annex II: Technical and organisational measures

These are the measures in place at the date of this DPA. We do not hold SOC 2, ISO 27001 or any other certification.

1. Hosting and isolation

• The service runs on Google Cloud in Belgium (europe-west1). Its data disk is replicated synchronously across two zones in that region.
• Each customer's data is held in its own separate database. A session or API key for one workspace has no meaning in another.
• The server accepts web traffic (HTTPS and HTTP/3) only; administrative SSH is allowed only through Google's Identity-Aware Proxy, never from the open internet.
• Cloud storage buckets use uniform access control and block all public access.

2. Encryption

• All traffic to the service and its websites is encrypted with TLS.
• Google Cloud encrypts disks, snapshots and storage buckets at rest.
• Credentials for your connected systems are encrypted with XChaCha20-Poly1305 authenticated encryption. The key is held outside the database and outside every backup, so a backup on its own does not reveal them. Credentials are never shown back, exported, or written to logs.

3. Access control for your users

• Passwords are stored only as argon2id hashes.
• Sessions use HttpOnly, Secure, SameSite cookies limited to the workspace address, and are accepted only on same-origin requests.
• Roles (owner, editor, viewer, restricted share), with create, read, update, delete and publish rules per collection and role, and grants per dataset for analytics.
• API keys are stored only as SHA-256 hashes and shown once. There are four key classes (public, private, write, and 15-minute preview), each key can be limited to allowed origins, keys can be rotated with a 24-hour overlap, and every response is rate limited.

4. Access by our personnel

• Access to production is limited to the few people who operate it, on a need-to-know basis.
• Our operator console has its own separate sign-in and a 12-hour session; administrative tokens are stored only as hashes.
• Every remote administrative command is logged with credentials removed from the log, and stored service credentials cannot be revealed through the remote administration path.
• Production secrets are kept in Google Secret Manager, in the same EU region.

5. Integrity and audit trail

• Every content change is recorded in the same transaction as the change, with who made it (user, API key, scheduler or pipeline), and any earlier version can be restored.
• Schema changes that would lose data are reported and never run silently.
• Records pulled from your sources are deduplicated by the source's own identifiers.

6. Backups and recovery

• Continuous replication of every database to a second EU region (Finland, europe-north1), with point-in-time restore for 7 days.
• Nightly per-customer copies, each opened and integrity-checked, kept 7 days.
• Daily snapshots of the whole data disk, kept 14 days, in the same EU region.
• A weekly off-site copy outside Google Cloud, encrypted in Cloudflare R2 under its EU jurisdiction, with access limited to our operators, checked against its checksums and kept 8 weeks.
• Uploaded files are versioned: an overwritten or deleted file can be recovered for 30 days, and a removed version stays recoverable for a further 7 days.
• Restores are rehearsed. Restores from the replica and from a disk snapshot were tested on 1 October 2026, with every restored database passing an integrity check.

7. Monitoring and incident response

• External uptime checks every 3 minutes, and heartbeats that raise an incident if the scheduler, the nightly backup, the replication or the weekly off-site copy stops.
• Host alerts for availability, CPU, memory and disk, and alerts when an integration keeps failing or a delivery cannot be completed.
• Alert messages carry identifiers and error codes, not the content of your records, wherever possible.
• A documented response: contain, investigate, restore from backup where needed, notify you under section 11, and fix the cause.

8. Secure development

• The service is written in Rust, a memory-safe language.
• Every change must pass formatting, strict linting with warnings treated as errors, and the full automated test suite before it is deployed.
• Deployments are built from committed, versioned source and can be rolled back to the previous version automatically if the new one fails its health check.
• Dependencies are pinned by exact version and lock file; binaries fetched during the build are pinned by checksum.

9. Data minimisation

• Files uploaded through job application forms go straight from the applicant's browser to private storage, never through our servers, and are deleted once delivered to your applicant tracking system; anything left behind is removed automatically after one day.
• Job application forms rate limit submitters by a one-way hash of their IP address rather than by storing the address for that purpose.
• Card data never reaches us; Paddle handles payments.

10. People and organisation

• Personnel with access to Personal Data are bound by confidentiality.
• Subprocessors are chosen for their security and bound by written data protection terms (section 8).
• Security reports are received at security@estype.com and handled under our responsible disclosure policy.

Annex III: Subprocessors

The current list, with the purpose, the data each receives and where it is processed, is kept on our Subprocessors page and forms part of this Annex. At the date of this DPA it is: