Data Processing Agreement

As used in this DPA:

2.1 Subject Matter

This DPA applies to Personal Data that the Controller uploads, enters, or generates through the Service, including client names, email addresses, phone numbers, company names, and any other contact details entered into the Duebira platform.

2.2 Nature and Purpose of Processing

Duebira processes Personal Data solely to provide the Service — specifically to generate, send, and track invoices and proposals on the Controller's behalf. Duebira does not use Personal Data for its own commercial purposes, advertising, or analytics beyond what is necessary to operate the Service.

2.3 Categories of Data Subjects

The Data Subjects are the Controller's clients and prospective clients whose contact information is entered into the platform.

2.4 Categories of Personal Data

• Contact identifiers: name, email address, phone number, company name
• Social and web profiles: LinkedIn URL, Instagram handle, X/Twitter handle, website URL
• Financial context: invoice amounts, payment status, project descriptions
• Communications metadata: email delivery timestamps, proposal view events

2.5 Duration

Processing continues for the duration of the Controller's active Duebira account, and is terminated as described in Section 12.

Duebira, as Processor, agrees to:

• Process Personal Data only on documented instructions from the Controller (which includes the Terms of Service and this DPA), unless required to do otherwise by applicable law.
• Ensure that persons authorised to process Personal Data are subject to confidentiality obligations.
• Implement appropriate technical and organisational security measures as described in Section 6.
• Assist the Controller in responding to Data Subject rights requests, to the extent technically feasible.
• Delete or return all Personal Data to the Controller upon request or upon termination of the Service, as described in Section 8.
• Make available all information necessary to demonstrate compliance with this DPA and cooperate with audits as described in Section 10.
• Immediately inform the Controller if Duebira believes any instruction infringes applicable data protection law.

4.1 Authorised Sub-processors

The Controller authorises Duebira to engage the following sub-processors, each of whom has agreed to data protection obligations consistent with this DPA:

4.2 Changes to Sub-processors

Duebira will notify the Controller of any intended addition or replacement of sub-processors by updating this DPA and, where feasible, by email notice. The Controller may object to a new sub-processor within 14 days of notification by contacting [email protected].

Duebira will assist the Controller in fulfilling its obligations to respond to Data Subject requests (including access, rectification, erasure, restriction, portability, and objection rights) under applicable law. The Controller, as the primary relationship holder with its clients, is responsible for receiving and triaging such requests.

If a Data Subject contacts Duebira directly regarding their rights, Duebira will forward the request to the Controller within 5 business days and will not respond to the Data Subject on the Controller's behalf without the Controller's authorisation.

For requests involving the Controller's own personal data (i.e., data about the Controller as an individual), please use the account deletion flow in Settings or email [email protected].

Duebira implements and maintains the following technical and organisational measures to protect Personal Data:

• Encryption in transit: All data is transmitted over HTTPS/TLS 1.2+.
• Encryption at rest: Data stored in Supabase (PostgreSQL) is encrypted at rest using AES-256 via AWS RDS encryption.
• Access control: Database access is restricted to service-role API keys; Supabase Row Level Security (RLS) enforces per-user data isolation for client-facing queries.
• Authentication: User authentication is handled by Clerk, which implements industry-standard session management, MFA support, and bot protection.
• Dependency management: Dependencies are reviewed and updated regularly to address known vulnerabilities.
• Minimal data principle: Only data necessary to provide the Service is collected and processed.
• Incident response: Security incidents are assessed and reported as described in Section 9.

Duebira continuously evaluates and improves its security posture. The specific measures described above reflect the state of the Service as of the effective date and may be updated to reflect improvements.

Duebira and its sub-processors operate primarily in the United States. Where Personal Data of EU/EEA residents is transferred to the United States, Duebira relies on one or more of the following transfer mechanisms:

• Standard Contractual Clauses (SCCs) adopted by the European Commission, incorporated into agreements with relevant sub-processors.
• Sub-processor participation in the EU-US Data Privacy Framework (DPF) or equivalent mechanism, where applicable.

A copy of applicable SCCs or transfer mechanism documentation is available upon request at [email protected].

8.1 Retention During Service

Duebira retains Personal Data for as long as the Controller's account is active or as necessary to provide the Service.

8.2 Deletion on Request

The Controller may delete individual client records at any time through the Clients section of the dashboard. Deletion removes the record from Duebira's database. Residual copies in backups are purged on the applicable backup rotation cycle (typically 7–30 days depending on the sub-processor).

8.3 Account Deletion

Upon account deletion (via Settings → Danger Zone or by request to [email protected]), Duebira will delete all Personal Data associated with the account within 30 days, except where retention is required by law (e.g., financial records for tax or audit purposes, which may be retained for up to 7 years).

8.4 Return of Data

The Controller may request an export of their data by contacting [email protected] prior to account deletion. Duebira will provide a machine-readable export within 30 days of request.

In the event of a Personal Data breach affecting data processed under this DPA, Duebira will notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Notification will include, to the extent known at the time:

• The nature of the breach, including categories and approximate number of Data Subjects and records affected.
• The likely consequences of the breach.
• Measures taken or proposed to address the breach and mitigate its effects.

The Controller is responsible for notifying relevant supervisory authorities and Data Subjects as required by applicable law. Duebira will cooperate in providing information needed for such notifications.

Breach notifications will be sent to the email address associated with the Controller's Duebira account.

Duebira will make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA. This includes:

• Copies of this DPA and applicable sub-processor agreements (with commercially sensitive terms redacted).
• Written responses to reasonable written questionnaires, submitted no more than once per year.
• Evidence of relevant third-party certifications or audit reports where available.

More extensive audits (e.g., on-site inspections) may be conducted by the Controller or an independent third party, subject to at least 30 days' prior written notice to [email protected], during normal business hours, and at the Controller's expense. Duebira may require the auditor to sign a confidentiality agreement before granting access.

Each party's liability under this DPA is subject to the limitations and exclusions set forth in the Duebira Terms of Service. Where applicable data protection law imposes liability that cannot be limited by contract, such mandatory provisions shall apply.

As between Duebira and the Controller, the Controller is responsible for ensuring it has a valid legal basis for processing the Personal Data of its clients and for providing any required notices to Data Subjects.

This DPA takes effect on the date the Controller accepts the Duebira Terms of Service and remains in force for the duration of the Service relationship.

This DPA automatically terminates when the Terms of Service terminate. Sections 5, 6, 8, 9, 10, and 11 survive termination to the extent necessary to give them effect.

Upon termination, Duebira will delete or return Personal Data as described in Section 8.3, unless applicable law requires otherwise.

This DPA is governed by the laws of the State of Delaware, USA, without regard to conflict-of-law principles. Where GDPR applies, the parties acknowledge that the DPA is intended to satisfy Article 28 GDPR requirements, and any conflict between this DPA and GDPR shall be resolved in favour of GDPR compliance.

Disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions of the Terms of Service.