Data Processing Addendum

1. Parties and how this fits

This addendum is between the business that uses Pinok (“you”, the controller) and [Company legal name] (“we”, the processor). It is part of the Terms of Service. Where it conflicts with them on personal data, this addendum wins; where the Standard Contractual Clauses apply, they win over both.

2. Scope and roles

This addendum covers the personal data in your workspaces (“workspace data”): the content your people put in, and the people in it. We remain an independent controller of the data we need to run Pinok itself: accounts and sign-in, security and abuse prevention, billing once it opens, and analytics once turned on.

Pinok is designed so that a personal task (one outside any project) stays private to its creator, owner, approver and followers, even from the workspace owner, and is left out of the workspace backup. You accept this design as part of your instructions.

3. Your instructions

We process workspace data only to provide Pinok as described in the Terms, this addendum and the way your people use its features (for example, deleting a task, exporting a project, or the anonymisation that happens when someone deletes their account). We will tell you if we believe an instruction breaks data protection law.

4. Confidentiality

Everyone at Pinok who can access workspace data is bound to keep it confidential and accesses it only when needed to run, support or secure the service. [to confirm: who has production access]

5. Security

We keep the technical and organisational measures in Annex II, and may improve them, but never lower their overall level.

6. Subprocessors

You authorise the subprocessors in Annex III and on the Subprocessors page. We bind each one to data protection terms at least as protective as these. We will announce a new subprocessor at least [30] days before it starts; if you object on reasonable data protection grounds and we can’t address it, you may end the affected part of the service. We remain responsible for our subprocessors.

7. Helping with requests

Most requests from the people in your workspace can be handled in the product: they can export a project, the workspace owner can download a backup, and anyone can delete their account. Where that isn’t enough, we will help you answer requests to access, correct, delete, restrict or port data, and with data protection impact assessments, as far as reasonably possible. If someone writes to us directly about workspace data, we will pass the request to you.

8. Personal data breaches

If we become aware of a breach affecting workspace data, we will tell you without undue delay, and within [48] hours where we can, with what we know and what we are doing about it, so you can meet your own deadlines.

9. Deletion or return at the end

Before you leave, you can export your data (projects as CSV or JSON, a workspace backup as JSON; files are listed but must be downloaded from their tasks). When a workspace is deleted, its data is deleted from the live service at once and files within about a day; copies in backups expire on their own schedule [to confirm: backup retention].

10. Audits

We will give you the information you reasonably need to show compliance with Article 28, starting with written answers to a security questionnaire. If that isn’t enough, you may audit us, at your cost, with reasonable notice, once a year, in a way that protects other customers’ data. Pinok has no SOC 2 or ISO 27001 certification today.

11. International transfers

Our servers and database run in the Netherlands. Where workspace data is transferred outside the EU, the EEA, the UK or Switzerland (including to our US subprocessors, and to us if we are established outside the EU), the EU Standard Contractual Clauses (Module 2, and Module 3 for our subprocessors), the UK Addendum and the Swiss amendments apply. [to confirm: our own country of establishment and the transfer basis that follows]

12. Liability and law

Liability under this addendum is subject to the limits in the Terms, as far as the law allows. This addendum is governed by the law that governs the Terms ([Governing law]), except where the Standard Contractual Clauses require otherwise.

Annex I: Details of processing

• People: your workspace’s members, people you invite, and people named in your content.
• Data: names, email addresses, profile photos, away dates and time zones; tasks, notes, comments, reactions, files and their history; read markers.
• Special categories: not intended. Please don’t put them in Pinok.
• Purpose: providing Pinok: storing, syncing, showing, notifying, exporting.
• Frequency and duration: continuous, for as long as you use Pinok.

Annex II: Security measures

• Access rules enforced in the database (row-level security on every table), whatever the app sends.
• Sign-in by one-time email codes only, stored as keyed hashes, valid 10 minutes, with layered rate limits.
• 15-minute access tokens and rotating refresh tokens stored only as hashes; signing out ends the session everywhere.
• HTTPS everywhere; strict security headers and a content security policy on the web app.
• Files in a private bucket, reachable only through short-lived presigned links issued after an access check; risky file types served as downloads.
• Push notifications sent only to people who can open the task.
• An audit line on account deletion with the account id only.
• Encryption at rest, backups and restore testing: [to confirm].

More on the Security page.

Annex III: Subprocessors

Railway (hosting and database, the Netherlands), Tigris through Railway Storage Buckets (files, Amsterdam), Resend (email, US), Expo, Apple and Google (push notifications). The current list, with details, is on the Subprocessors page.