Data Processing Agreement

Who this is between

This Data Processing Agreement ("DPA") is between Systems For Business LLC, 312 W 2nd St, Unit A2299, Casper, WY 82601, USA ("we", "us", the "Processor") and the business that holds a Systems for Business account ("you", the "Controller").

It forms part of the Systems for Business Terms of Service at usesfb.ai/terms (the "Terms"). Words defined in the Terms mean the same here.

For personal data you put into the Service about your clients, prospects, applicants, members, team and contacts, you are the controller and we are your processor. Where your own clients are controllers, we act as your sub-processor on the same terms.

How it applies

This DPA applies automatically whenever we process personal data for you that is covered by the EU GDPR, the UK GDPR, the Swiss data protection law or a similar law. You accept it by using the Service. You don't need to sign it.

If you need a countersigned copy for your records, email admin@systemsforbusiness.xyz.

Your instructions

We process personal data only to provide the Service as described in the Terms, the Privacy Policy and Annex 1, and on your documented instructions.

Your use of the Service, your settings, and the actions you or your connected AI take in your account are your instructions. If we believe an instruction breaks data protection law, we will tell you, and we may decline to follow it.

Your responsibilities

You are responsible for having a lawful basis, and any notices or consents needed, for the personal data you put into the Service and for the instructions you give.

You are responsible for the accuracy of that data and for not adding special-category data (for example, health data) without your own lawful basis.

The AI you connect and the accounts you link (for example your own AI provider, Google, Meta or Stripe) are your own providers. They work under your agreements with them, they are not our sub-processors, and we are not responsible for how they handle data.

You are responsible for who you give access to your account, and for using the security settings available to you, such as two-step sign-in.

Confidentiality

Everyone we allow to process your personal data is bound by confidentiality.

Our team does not look at your records except where you share them with us, where needed to keep the Service secure and working, or where the law requires it.

Security

We keep appropriate technical and organisational measures to protect your personal data. They are described in Annex 2 and on our security page at usesfb.ai/security.

We may change those measures over time, as long as the overall level of protection is not materially reduced. No online service can be made completely secure, and we can't promise that unauthorised access will never happen.

Sub-processors

You give general authorisation for us to use the sub-processors listed in Annex 3.

Before we add or replace one, we update the list on this page at least 14 days in advance. If you want an email when it changes, ask us.

You may object on reasonable data protection grounds within those 14 days. If we can't resolve it, your remedy is to cancel the Service, and we refund any fees you prepaid for the period after the change.

We put written data protection terms in place with each sub-processor, as Article 28(4) GDPR requires, and we remain responsible for them to the extent that law requires, subject to section 13.

Where data is kept, and transfers

Your account's main database and files are hosted in the European Union (France and Germany).

Where personal data is transferred outside the EEA, the UK or Switzerland, including to us as a United States company or to a sub-processor, the transfer relies on an adequacy decision or on the EU Standard Contractual Clauses (Module 2 or 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated into this DPA by reference.

Helping you

Most requests from people exercising their rights (access, correction, deletion, portability) you can handle yourself in the app: export, edit and delete.

Where you can't, we help you as far as is reasonable and the Service allows. We also give reasonable help with data protection impact assessments and with regulators. Where that help goes beyond what the Service lets you do yourself, we may charge a reasonable fee.

Personal data breaches

If we become aware of a personal data breach affecting your personal data, we will tell you without undue delay, and where feasible within 72 hours.

We will tell you what we know as it becomes available: what happened, the data and people likely affected, the likely consequences and what we are doing about it.

Telling you about a breach is not an admission of fault or liability.

Deletion and return

You can export your data at any time from your account settings.

When your account ends, we delete your personal data within 30 days, unless the law requires us to keep it. Deleted data can remain in our encrypted backups for up to 14 more days, and is then gone from those too.

Records and audits

We make available the information reasonably needed to show we meet this DPA: our security page, written answers to a reasonable security questionnaire up to once a year, and any independent audit reports we hold.

If those aren't enough, or a regulator requires it, you may audit us, at your own cost, with 30 days' written notice, during business hours, under confidentiality, no more than once a year, and in a way that doesn't put other customers' data at risk. We may charge reasonable costs for our time.

Liability

Each party's liability arising out of or related to this DPA, whether in contract, tort or otherwise, is subject to the limits and exclusions in the Terms, and counts towards them.

In particular, our total liability under this DPA and the Terms together is limited to the amount you paid us for the Service in the 12 months before the claim arose (or 100 USD if you paid nothing), and we are not liable for indirect, special or consequential losses, or for lost profits, revenue, data or business.

Your indemnity in the Terms covers claims arising from your data, your instructions and any breach of data protection law by you.

Nothing in this DPA limits liability that the law does not allow to be limited, or any rights that individuals have directly under the Standard Contractual Clauses.

Changes to this DPA

We may update this DPA to reflect changes in the law, in our sub-processors or in the Service. The date at the top of this page shows the current version.

If a change materially reduces your protection, we will post it here at least 30 days before it applies. If you keep using the Service after that, you accept the updated DPA.

Term, order of precedence and law

This DPA applies for as long as we process personal data for you.

If it conflicts with the Terms, this DPA wins on data protection matters. If it conflicts with the Standard Contractual Clauses, the Clauses win.

This DPA is governed by the same law as the Terms, except where the Standard Contractual Clauses or data protection law require otherwise.

Contact

Email admin@systemsforbusiness.xyz, from the email address you sign in with.

By mail: Systems For Business LLC, 312 W 2nd St, Unit A2299, Casper, WY 82601, USA.

What is processed and why

Security measures

A summary. The current description is at usesfb.ai/security, and the measures may change as set out in section 6.

• Hosting: Database and files with Supabase on AWS in Paris; app server with Hetzner in Germany; backup copies kept apart from the live app.
• Separation: Database rules that keep each account's records inside that account, checked by automated tests.
• Encryption: Encrypted connections (TLS, with HSTS). Data and files encrypted at rest. Keys and connected sign-ins stored encrypted, apart from records.
• Access: Email one-time codes, optional authenticator-app two-step sign-in, a list of signed-in sessions, and sign out everywhere. Your AI acts with your permissions, and its tool calls are logged.
• Payments: Card data handled by Stripe. We don't store card numbers.
• Backups: Nightly database backups, kept for 14 nights, with regular restore checks.
• Engineering: Automated access tests, periodic security reviews, secret scanning, a delay before adopting new third-party package versions, and a firewall that limits what can reach our servers.
• People: Confidentiality, and access to records only as described in section 5.

Sub-processors

Locations are as each provider describes them. Each provider's own data protection terms apply to its processing.