Data processing agreement

1. Parties and roles

This Agreement is between each organisation that provides personal data for a proposal in EU Proposals (“the Customer”), as controller, and SIA "Plenty Group", registration No. 40203061230, Latvia (“we”), as processor. It forms part of the Terms of Service and is accepted with them, including by any user who accepts them for an organisation. Where a client's engagement agreement contains its own data-processing terms, those apply alongside this Agreement and prevail where the two differ.

Several organisations may work on the same proposal. Each is the controller of the personal data it provides and is bound by this Agreement separately; we do not assume joint controllership between them. Contact for notices, objections and audits: security@theplentygroup.eu.

2. Subject matter, duration, nature and purpose

We process the Customer's personal data only to provide the Platform and, under an engagement agreement, the proposal services it describes. This Agreement lasts as long as we process that data. Details are in Annex A.

3. Our obligations as processor

1. We process the data only on the Customer's documented instructions — these Terms, this Agreement, the engagement agreement and the Customer's normal use of the Platform — unless the law requires otherwise, in which case we tell the Customer first unless the law forbids it. We tell the Customer if we think an instruction breaks data-protection law.
2. People who process the data are bound to confidentiality.
3. We take the security measures required by GDPR Art 32, summarised in Annex B.
4. We engage sub-processors only as section 4 allows.
5. We help the Customer respond to requests from data subjects.
6. We help the Customer meet its obligations under GDPR Arts 32 to 36.
7. At the end, we delete or return the data as section 8 describes.
8. We make available the information needed to show compliance, and allow and contribute to audits.

4. Sub-processors

The Customer gives general authorisation for the sub-processors in Annex C. We bind each to data-protection obligations equivalent to ours and remain fully liable for them. We will tell the Customer's account holders by email at least 30 days before adding or replacing a sub-processor. If the Customer objects on reasonable data-protection grounds and we cannot resolve it, the Customer may stop using the affected service.

5. International transfers

Where a sub-processor is outside the EU/EEA, the transfer relies on the safeguard listed for it in Annex C.

6. Data subject requests

If a data subject contacts us about the Customer's data, we forward the request to the Customer without undue delay and do not answer it ourselves beyond acknowledging it.

7. Audits, information and personal-data breaches

On reasonable notice we answer the Customer's questions and allow audits, in a way that does not compromise other customers' data. We notify the Customer of a personal-data breach affecting its data without undue delay, with the information it needs under GDPR Arts 33 and 34.

8. Return or deletion

When the engagement or proposal ends, or when the Customer asks, we return or delete the Customer's personal data at its choice, except where the law requires us to keep it.

9. Order of precedence and liability

On personal data, this Agreement prevails over the rest of the Terms. Liability is as set out in the engagement agreement or, where there is none, in the Terms.

10. The Customer's obligations

The Customer is responsible for having a lawful basis for the data it provides, for informing the people concerned — in particular those named in a proposal — for giving lawful instructions, for deciding whom it asks us to invite, and for any AI provider key it connects. It should not enter special categories of personal data unless a proposal requires them.

Annex A — Details of the processing

Annex B — Security measures

• Invitation-only accounts with mandatory two-factor authentication.
• Least privilege: access granted proposal by proposal, at read, edit or manage level.
• Each proposal's content is visible only to the people invited to it and to the Platform's administrators.
• Encryption in transit; AI provider keys encrypted at rest.
• A record of every saved change, export, request to an AI feature and sign-in event, reviewed by the administrators.
• Nightly, checksum-verified backups, including a copy held off the server.

Further detail is available to a Customer under confidentiality on request.

Annex C — Sub-processors