Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Decretum and Customer, and applies automatically once Customer begins using the Cloud Service. No separate signature is required, though a Customer whose procurement process requires a separately countersigned copy may request one at support@decretum.app. This DPA covers the Cloud Service only. Where Customer deploys Decretum on its own infrastructure ("Self-Hosted"), Customer is its own controller and processor for that data, or engages its own processors. Decretum has no visibility into or access to that data, so there is nothing for this DPA to govern there.

1. Definitions

• "Agreement" means the Terms of Service between Decretum and Customer, of which this DPA forms part upon Customer's use of the Cloud Service.
• "Customer Personal Data" means personal data processed by Decretum on behalf of Customer as a processor in connection with the Cloud Service: principally, personal data that Customer's Users choose to include within Customer Content (decisions, posts, comments, tags, and file attachments), as distinct from Account Data, which Decretum processes as an independent controller under the Privacy Policy and which this DPA does not cover.
• "Data Protection Laws" means, to the extent applicable to the processing of Customer Personal Data under this Agreement: the EU General Data Protection Regulation (Regulation (EU) 2016/679) as it forms part of the law of the EEA by virtue of the EEA Agreement and as implemented in Norway by the Personal Data Act (personopplysningsloven); the UK GDPR and the UK Data Protection Act 2018 (as amended); the Swiss Federal Act on Data Protection; and any other data protection or privacy law applicable to the processing of Customer Personal Data under this Agreement, in each case as amended, replaced, or superseded from time to time.
• "Data Subject," "Personal Data," "Processing," "Controller," "Processor," "Sub-processor," "Personal Data Breach," and "Supervisory Authority" have the meanings given in the GDPR, and corresponding terms in other Data Protection Laws are construed accordingly.
• "Security Incident" means a Personal Data Breach affecting Customer Personal Data.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679, annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and, where relevant to a transfer subject to UK GDPR, the UK's International Data Transfer Addendum to those clauses.
• "Sub-processor" means any processor engaged by Decretum to process Customer Personal Data, listed at decretum.app/subprocessors.

2. Roles of the Parties

For Customer Personal Data, Customer is the Controller and Decretum is the Processor. Customer determines the purposes and means of processing Customer Personal Data by choosing what its Users submit to the Service and how it configures Organization visibility, roles, and notification settings; Decretum processes Customer Personal Data only to provide, secure, and support the Cloud Service, and only on Customer's documented instructions as set out in Section 3.

This division of roles is separate from, and does not affect, Decretum's role as an independent Controller for Account Data (name, email address, sign-in method, and technical/security logs such as session IP address), which remains governed by the Privacy Policy, not this DPA.

3. Customer's Instructions

Decretum will process Customer Personal Data only: (a) to provide, maintain, and support the Cloud Service in accordance with the Agreement; (b) as further specified by Customer's use of the Service's configurable features (Organization settings, decision visibility, notification preferences, and similar controls, each of which constitutes a documented instruction for the corresponding processing); (c) as necessary to comply with applicable law, in which case Decretum will inform Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest; or (d) as otherwise documented and agreed in writing between the parties. Decretum will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Confidentiality

Decretum will ensure that any person it authorizes to process Customer Personal Data (including employees, contractors, and Sub-processors) is subject to a binding written obligation of confidentiality, whether contractual or statutory.

5. Security of Processing (Article 32)

Decretum will implement and maintain the technical and organizational measures described in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to Data Subjects.

6. Sub-processors

6.1 General authorization. Customer provides Decretum with general written authorization to engage the Sub-processors listed at decretum.app/subprocessors, and to engage additional or replacement Sub-processors in accordance with this Section.

6.2 Flow-down obligations. Decretum will impose data protection terms on each Sub-processor that are at least as protective of Customer Personal Data as those set out in this DPA, and will remain liable to Customer for the acts and omissions of its Sub-processors to the same extent Decretum would be liable if performing their services directly.

6.3 Change notice and objection. Decretum will maintain an up-to-date list of Sub-processors at decretum.app/subprocessors and will give Customer at least 30 days' notice (by email to the Organization's Admins or a notice within the Service) before authorizing a new Sub-processor to process Customer Personal Data. If Customer objects on reasonable data-protection grounds within that notice period, the parties will work in good faith to resolve the objection; if unresolved, Customer's exclusive remedy is to terminate the affected part of the Service without penalty.

7. International Transfers

Where Decretum or a Sub-processor processes Customer Personal Data outside the EEA/UK/Switzerland (as applicable to the relevant Customer Personal Data), Decretum will ensure the transfer is subject to an appropriate safeguard under Data Protection Laws, in order of preference: (a) an applicable adequacy decision; (b) the Standard Contractual Clauses (Module Two: Controller to Processor), which are hereby incorporated by reference into this DPA with Customer as "data exporter" and Decretum as "data importer," completed as set out in Annex IV; or (c) another valid transfer mechanism recognized under Data Protection Laws (which may include a Sub-processor's own EU-U.S. Data Privacy Framework certification, where applicable; Decretum will not rely on DPF certification as the sole safeguard for a given transfer where the SCCs are readily available as a fallback).

As of this drafting, Customer Personal Data is processed on the following infrastructure: application hosting on Vercel, database hosting on Neon (managed PostgreSQL running on AWS), file attachment storage on Amazon S3, and transactional email delivery via Zoho CPaaS (formerly ZeptoMail), Zoho's transactional email service. The database and object storage are both provisioned in AWS's eu-central-1 (Frankfurt, Germany) region, application compute runs in Vercel's Frankfurt (fra1) region, and Zoho's own DPA states that its EU account is processed by Zoho Corporation B.V. (Utrecht, Netherlands) with data stored in Zoho's EEA data centers. Data stored across this infrastructure stays within the EEA and does not itself involve a transfer outside it for that storage/processing leg.

Vercel Inc. and Neon, Inc., however, are both U.S. companies that may access or process Customer Personal Data from the United States in the ordinary course of operating their services (for example, for customer support, monitoring, or account administration), even where the data at rest sits in Frankfurt. For that access, Decretum relies on each Sub-processor's own certification under the EU-U.S. Data Privacy Framework, with the Standard Contractual Clauses incorporated into Decretum's own contract with each Sub-processor as a fallback if DPF coverage is unavailable or successfully challenged. Zoho's own DPA separately incorporates the SCCs for any processing its non-EEA group entities or sub-processors perform. See decretum.app/subprocessors for the current Sub-processor list, including exact contracting entities and transfer mechanisms.

8. Assistance with Data Subject Rights

Taking into account the nature of the processing, Decretum will provide reasonable assistance to Customer, by appropriate technical and organizational measures, to fulfil Customer's obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws. Because Decretum has no independent ability to identify or evaluate personal data embedded within Customer Content (only Customer knows what its Users have written), Decretum's assistance will principally consist of: (a) providing Customer with tools within the Service to locate, export, correct, or delete a Data Subject's own account and content (see Section 10's own description of these self-service export/deletion features); and (b) if Decretum itself receives a request directly from a Data Subject concerning Customer Personal Data, promptly forwarding that request to Customer without responding to it substantively, unless legally required to respond directly.

9. Assistance with Security, Breach Notification, and DPIAs (Articles 32 to 36)

Decretum will provide Customer with reasonable assistance necessary for Customer to comply with its obligations under Articles 32 to 36 of the GDPR (and equivalent provisions of other applicable Data Protection Laws), taking into account the nature of processing and the information available to Decretum, including:

• Security Incident notification. Decretum will notify Customer without undue delay after becoming aware of a Security Incident, providing (to the extent then known, updated as more information becomes available): the nature of the incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and mitigate its effects.
• DPIAs and prior consultation. Decretum will provide reasonably available information about its processing activities and security measures to support a data protection impact assessment or prior consultation with a Supervisory Authority that Customer reasonably determines is required.

10. Deletion or Return of Customer Personal Data

The Cloud Service gives Customer these tools directly, self-service, rather than requiring a request to Decretum: an Organization's Admin can export all Customer Personal Data at any time (including before requesting termination), except the underlying attachment file contents themselves, which the export lists by filename, size, and type rather than including as downloadable files. Closing the Organization's account deactivates every User's access immediately and permanently deletes all Customer Personal Data, including file attachments, 14 days later unless the closure is cancelled within that window, consistent with Terms of Service §9 and the Privacy Policy. Decretum does not retain a copy of Customer Personal Data beyond that point, except to the extent applicable law requires continued storage.

11. Audits

Decretum will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA, and will allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, subject to: (a) reasonable advance written notice (at least 30 days); (b) no more than once in any 12-month period, unless required by a Supervisory Authority or following a Security Incident; (c) reasonable scope, confidentiality, and business-hours conditions; and (d) Customer bearing its own costs, with Decretum's reasonable costs reimbursed by Customer unless the audit reveals a material breach of this DPA by Decretum. Once Decretum holds a relevant third-party certification or audit report, the parties agree that providing a current copy of that report will satisfy this Section in place of an on-site audit, except where a Supervisory Authority requires otherwise.

12. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement's Terms of Service, applied in aggregate across the Agreement and this DPA rather than as a separate, additional cap. [CONFIRM WITH COUNSEL: this single-aggregate-cap approach is drafted as the default, but some enterprise counterparties will push for an uncapped or separately-capped liability specifically for data protection breaches; anticipate this as a likely negotiating point rather than being surprised by it.]

13. Term, Order of Precedence, and Governing Law

This DPA takes effect when Customer begins using the Cloud Service and remains in effect for as long as Decretum processes Customer Personal Data under the Agreement. In the event of a conflict between this DPA and the Terms of Service concerning the processing of Customer Personal Data, this DPA controls. This DPA is governed by the same governing law and jurisdiction as the Terms of Service.

14. Assignment

This DPA follows the Agreement: it may not be assigned separately from the Terms of Service, and it transfers automatically, without further action, to any assignee that receives a valid assignment of the Agreement under the Terms of Service's Assignment clause. An assignee under that clause is bound by this DPA, including the Sub-processor list, from the effective date of the assignment, and Decretum will update that list and notify Customer if the assignment changes which entity acts as processor.

Annex I: Details of Processing

Subject matter: Decretum's provision of the Cloud Service to Customer.

Duration: For the term of the Agreement, plus the post-termination deletion/return period in Section 10.

Nature and purpose of processing: Hosting, storage, transmission, display, and organization of Customer Content; user authentication and access control; search and notification delivery; and technical operations reasonably necessary to provide, secure, and support the Service.

Categories of Data Subjects: Customer's Users (employees, contractors, or other individuals Customer authorizes to access the Service) and any other individuals whose personal data a User includes within Customer Content (for example, a named individual referenced in a decision or its discussion).

Categories of Customer Personal Data: Names, email addresses, and any other personal data Users choose to include within decision titles/summaries, posts/comments, tags, and file attachments. Decretum, as processor, does not control or inspect the substance of Customer Content and cannot itself enumerate what personal data a given Customer's Users have chosen to include. This describes the categories the Service is capable of carrying, not a guarantee about what any specific Customer actually submits.

Special categories of data: The Service is not designed or intended to process special category data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR). Customer represents and warrants that it will not submit, and will not permit its Users to submit, any such data to the Service, and Customer is solely responsible for any such data submitted in breach of this representation, including any resulting liability.

Annex II: Technical and Organizational Measures

• Access control and tenant isolation. Access to an Organization's data is governed by role-based permissions (member/approver/admin) and, for restricted-visibility decisions, explicit collaborator and approver lists, enforced at the application layer. This is backed by a database-enforced control: every Organization-scoped table is protected by PostgreSQL Row-Level Security policies bound to a dedicated, non-superuser database role used for all application queries (distinct from the administrative role used only for schema migrations and authentication lookups), so that even a query missing its own organization filter cannot return another Organization's data.
• Encryption in transit. All traffic between a browser and the Service is served over TLS.
• Encryption at rest. Amazon S3 encrypts objects at rest by default (server-side encryption), and Neon encrypts its underlying storage at rest as part of its managed PostgreSQL service. [PLACEHOLDER: confirm these defaults are actually enabled for the specific S3 bucket and Neon project used in production, rather than assuming the provider default applies unmodified.]
• Attachment access. File attachments are stored in S3-compatible object storage and accessed only via short-lived, individually-signed URLs (5-minute expiry), rather than public or long-lived links.
• Authentication. Password-based authentication uses industry-standard hashing (via the Service's authentication library); optional single sign-on is available via Google and Microsoft Entra ID, or any OpenID Connect-compliant identity provider for a Self-Hosted deployment. Multi-factor authentication is not currently implemented.
• Audit logging. Material actions on a decision (creation, status changes, approvals/rejections, tagging, edits, deletions, and restorations) are recorded in an append-only event log used to drive the Service's own audit-trail and notification features.
• Deletion and retention. Three deletion mechanics, each a two-stage deactivate-then-permanently-delete pattern with the same 14-day recoverable window: (a) a User's own account, deactivated immediately (sign-in blocked) and recoverable for 14 days via an emailed cancellation link, after which their name and email are permanently anonymized (content they authored remains part of the Organization's record, attributed to a generic label); (b) a decision, soft-deleted immediately and recoverable for 14 days, after which it and everything under it (posts, attachments, approvals) are permanently deleted, including the underlying file attachment objects in object storage; (c) an Organization's entire account, closed immediately (every User's access deactivated, sessions terminated) and recoverable for 14 days via a link emailed to every Admin, after which the Organization and all Customer Personal Data within it, attachments included, are permanently deleted.
• Environment separation. The database role used for ordinary application queries is separate from, and has fewer privileges than, the role used for schema migrations, and cannot bypass the Row-Level Security policies described above.
• Backups. Neon provides automated backups and point-in-time recovery for the managed PostgreSQL database as part of its service. [PLACEHOLDER: confirm the actual backup retention window, and that backups/replicas stay within the EEA, not just primary data; confirm whether S3 bucket versioning, cross-region replication, or a separate backup process is configured for file attachments.]
• Sub-processor security. Decretum requires Sub-processors to maintain security measures appropriate to the risk of the personal data they process, as described in Section 6.2.

Annex III: Sub-processors

The current list of Sub-processors, their purpose, location, and applicable transfer mechanism is published at decretum.app/subprocessors and forms part of this Annex by reference. It is kept current there without requiring this document to be republished every time a Sub-processor changes.

Annex IV: Standard Contractual Clauses (if applicable)

Where Section 7(b) applies, the Standard Contractual Clauses (Module Two: Controller to Processor) are incorporated with the following selections: [PLACEHOLDER: complete Clause 7 (docking clause), Clause 9 (Sub-processor authorization: general written authorization, matching Section 6 above, with the notice period from Section 6.3), Clause 11(a) (independent dispute resolution), Clause 13 (competent Supervisory Authority), Clause 17 (governing law), Clause 18 (choice of forum), and the technical/organizational measures in Annex II above. Confirm each with counsel.]

Contact

Questions about this Data Processing Agreement can be sent to support@decretum.app.