Data Processing Agreement (DPA / AVV)

Last updated: 12 October 2026

1. Parties and conclusion of this agreement

Version 2026-10-12-v2. This Data Processing Agreement (DPA) governs personal data processed by Matikus, Lda. on behalf of a Responello customer under Article 28 of Regulation (EU) 2016/679 (GDPR). It forms part of and supplements the Responello Terms of Service (Service Agreement).

Processor: Matikus, Lda., sociedade por quotas, Startup Madeira – EV 289, Campus da Penteada, 9020-105 Funchal, Madeira, Portugal. NIPC 519 513 630; VAT ID PT519513630. Contract, instruction and data-protection contact: responello@matikus.com.

Customer: The holder of the Responello account or, where the account holder names an organisation on whose behalf it acts, that organisation. The Customer is identified by its account details and, where completed, by the legal name, business address, authorised representative and data-protection contact recorded in the optional account confirmation. The Customer acts as controller or, where expressly identified, as a processor authorised by its controller to appoint Matikus as a subprocessor.

This DPA is incorporated into the Terms of Service. It is concluded when the Customer accepts the Terms of Service incorporating it, in particular when creating its account; no separate signature is required. Matikus records the accepted Terms and DPA versions, a fingerprint of the agreed document and the acceptance time. For an account that has not accepted Terms incorporating this version, this version takes effect only when the Customer accepts the updated Terms incorporating it or otherwise agrees to it in writing, including electronically. Any previously concluded DPA remains effective until expressly replaced. Later acceptance does not retrospectively establish an agreement for earlier processing.

Optionally, the Customer can record its legal identity, address, authorised representative, role, privacy contact and notification destinations in the account (account confirmation). The account then provides a personalised copy of this DPA with those particulars, its version, a receipt timestamp and a document fingerprint for download, and a copy is sent by email. The account confirmation documents the Customer’s details and routing instructions; it is not a precondition for this DPA to apply. Accepting a personalised copy of this version also agrees this version where an earlier version applies to the account. Operational particulars may not remove the protections in this DPA.

2. Scope and allocation of roles

Customer Personal Data means personal data contained in the Customer’s button configuration, interactions, contact requests, notification destinations and associated delivery records that the Processor handles to provide the configured service on the Customer’s behalf. Annex I describes the processing. The GDPR definitions of controller, processor, personal data, processing, supervisory authority and personal data breach apply.

The Customer determines the purposes of its communications, the lawful basis, recipient information, content collected and permitted destinations. It shall give appropriate privacy information, collect only necessary data, lawfully issue instructions and maintain any required controller authorisation. If it acts as a processor, it shall pass through the controller’s instructions and obligations and arrange any additional requirements before processing. The Processor remains responsible for its own obligations under this DPA and applicable law.

This DPA does not cover processing for which Matikus independently determines the purposes, such as its own account administration, billing, legal compliance and service-security records. That processing is described in the Privacy Policy. A record is not excluded from this DPA merely because it has an account reference. Creem’s sale, payment and invoice processing is separate from the processing of Customer contact messages.

The Hostinger-hosted support mailbox is used for account, contract and general service correspondence. Do not send visitor names, contact messages, recipient lists or screenshots containing Customer Personal Data to that mailbox. For technical support, use an affected page, an internal record reference and a fully anonymised example. Authorised Matikus personnel may investigate the referenced record within the existing Responello infrastructure when needed under the Customer’s instruction, without copying its personal data into support email. Support requiring an additional provider or transfer must first be covered by the applicable arrangements. This restriction does not remove assistance or individual-rights obligations, and unexpected disclosures must be contained and handled appropriately.

3. Documented instructions

The Processor shall process Customer Personal Data only on documented instructions from the Customer, including for transfers to a third country, unless Union or Member State law requires otherwise. In that case it shall inform the Customer of the legal requirement before processing, unless that law prohibits the information on important grounds of public interest. This DPA, the agreed service configuration and authenticated requests from authorised Customer contacts constitute instructions. Additional instructions may be sent to responello@matikus.com and shall be documented.

The Processor shall immediately inform the Customer if an instruction, in its opinion, infringes the GDPR or other Union or Member State data-protection provisions. It may suspend the affected instruction while the parties resolve the issue. It shall not sell Customer Personal Data, use contact content for advertising or train general-purpose models on it.

4. Confidentiality and security

The Processor shall ensure that people authorised to access Customer Personal Data are bound by confidentiality commitments or an appropriate statutory duty and access it only as necessary for their assigned tasks. It shall maintain appropriate technical and organisational measures under Article 32 GDPR, taking account of the state of the art, implementation costs, processing circumstances and risks to individuals. Annex II specifies the measures. Annex III and the subprocessor list referred to there identify the providers.

The Processor shall review the effectiveness of its measures and may improve them provided the level of protection is not reduced. It shall maintain appropriate access management, incident handling, recovery and review procedures. This DPA does not represent an ISO certification, an independent security audit or a guarantee that all storage or every customer-selected destination is end-to-end encrypted.

5. Subprocessors and change notices

The Customer gives general written authorisation for the subprocessors specifically identified in Annex III. Before adding or replacing a subprocessor, the Processor shall email the Customer’s designated contact at least 30 days in advance with its identity, processing purpose, locations and relevant safeguards. An update to this web page alone is not that notice. The Customer may object within that period on reasonable data-protection grounds.

The parties shall seek a reasonable solution to an objection before the new subprocessor processes the affected data. If no solution is available, the Customer may terminate the affected service before the change takes effect and receive a proportionate refund of unused prepaid service fees for it. The Processor shall not treat an unresolved objection as permission to begin the disputed processing.

The Processor shall impose materially equivalent data-protection obligations on each subprocessor in a binding written agreement before entrusting data to it, including sufficient security guarantees. It remains fully liable to the Customer for the subprocessor’s performance of those obligations. It shall provide relevant contractual and compliance information on request, with proportionate redactions to protect unrelated confidential information.

6. Customer destinations and international transfers

A configured channel can receive the visitor’s contact details and message content, not just a notification count. The Customer shall select authorised recipients and destinations, consider their access and retention settings and establish any agreements it requires with its own providers. The Processor shall follow the documented routing instruction. Selecting an integration does not by itself satisfy Article 28 or Chapter V GDPR.

The role of a destination depends on the actual arrangement: a recipient or service contracted directly by the Customer is not automatically the Processor’s subprocessor. If the Processor engages that provider to process Customer Personal Data on its behalf, Section 5 applies. All six supported routing methods are covered by this agreement when the Customer configures them in its account: email, Telegram, Slack, Discord, Pocket Alert and HTTPS webhooks. The Customer’s channel configuration is its documented routing instruction. Where the Customer records the recipient organisation or service account, processing countries and applicable contractual and transfer arrangements in the account confirmation, those details form part of that instruction. These routing instructions are separate from the list of subprocessors appointed by Matikus. A technical integration, a credential or a Customer declaration does not by itself establish a provider’s legal role or a valid transfer mechanism. Matikus retains its own verification and compliance obligations; Section 5 applies whenever Matikus actually engages an additional subprocessor.

The primary Responello server is in Helsinki, Finland. International access and onward transfers, including by providers or to selected destinations, require documented instructions and a valid Chapter V basis where applicable. Before such a transfer the Processor shall establish the applicable adequacy decision or appropriate safeguards, assess any required supplementary measures and provide the Customer with relevant information. This DPA is not itself an international-transfer standard contractual clause or blanket consent to transfers. The Processor shall inform the Customer if it can no longer lawfully fulfil these obligations and suspend the affected transfer.

7. Assistance and individual rights

Taking account of the nature of the processing, the Processor shall assist the Customer through appropriate technical and organisational measures in responding to individuals’ requests under Chapter III GDPR. It shall promptly forward requests concerning Customer Personal Data to the Customer and shall not decide or respond on the Customer’s behalf without authorisation, unless legally required. It may identify the responsible contact to the requester.

Taking account of the nature of the processing and information available to it, the Processor shall assist the Customer with security, breach assessment and notification, data-protection impact assessments and prior consultation under Articles 32 to 36 GDPR. The account export is a useful tool but is not a promise that it contains every record relevant to a rights request. Additional instructions and requests can be sent to the contact in Section 1.

8. Personal data breaches

The Processor shall notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notification shall use the designated data-protection contact, or the account email if that contact cannot be reached. The Processor shall provide the nature of the breach, the affected categories and approximate numbers of people and records where known, a contact for further information, likely consequences and measures taken or proposed to address and mitigate it.

Incomplete information shall not delay the initial notice. Further information shall follow as it becomes available without undue delay. The Processor shall investigate, contain and remediate the breach, preserve relevant evidence and cooperate with the Customer. The Customer determines its own notifications to authorities and individuals; this does not restrict the Processor’s independent legal duties.

9. Information, audits and cooperation

The Processor shall make available all information necessary to demonstrate compliance with Article 28 GDPR and this DPA and allow and contribute to audits, including inspections, by the Customer or an auditor mandated by it. Existing documentation or independent reports may be used first where they sufficiently answer the request; they do not eliminate the inspection right. Both parties shall cooperate with competent supervisory authorities.

Audits shall use reasonable notice and confidentiality arrangements and protect other customers’ data. Urgent incidents, credible indications of non-compliance and authority requirements shall not be delayed by ordinary scheduling. Any agreed charges for exceptional additional assistance must be reasonable, disclosed in advance and must not prevent the exercise of mandatory rights or the Processor’s compliance with its duties.

10. Duration, return and deletion

This DPA applies for the duration of processing under the Service Agreement and continues for any period in which the Processor or its subprocessors retain Customer Personal Data. Detailed click events and associated contact requests are subject to the service’s six-month retention cycle, unless a lawful earlier deletion instruction applies. Account-linked daily totals may remain after detailed events expire; they are not automatically treated as anonymous. Archiving a button is not deletion of its related data.

At the Customer’s choice, on termination of the covered processing the Processor shall return Customer Personal Data in an available commonly used electronic format and delete remaining copies, or delete the data without return, unless Union or Member State law requires storage. It shall provide confirmation on request. If law requires retention, it shall identify the requirement where permitted, restrict use to that purpose and delete the data when the requirement ends.

The Customer should request return before account deletion. Billing or unfinished-checkout safeguards in the self-service interface do not remove the right to send a lawful instruction by email. The Processor shall arrange the necessary return or deletion without undue delay and coordinate deletion with its subprocessors. Automatic Hetzner Cloud Backups are stored in Helsinki, Finland and use a rolling set of seven daily restore points, normally covering approximately the preceding seven days. The oldest backup is replaced when the next daily backup is created; no separate long-term backup archive is maintained. The Processor shall monitor the rotation and remedy failures without undue delay. Pending expiry, deleted data in backups shall be protected from ordinary use, and deletion instructions shall be reapplied after any recovery. Backup storage locations are stated in Annex II.

Copies already delivered to the Customer or to its independently contracted recipients are subject to their own controls. This does not excuse the Processor from deletion duties for providers it engages as subprocessors.

11. Suspension, precedence and changes

If the Processor cannot comply with this DPA, it shall promptly notify the Customer and take appropriate steps to restore compliance. The Customer may suspend the affected processing and terminate the affected service for a substantial or persistent breach. Return, deletion, confidentiality and cooperation duties continue as required. Neither a service limitation nor a liability clause may remove an obligation imposed by the GDPR or an individual’s rights, including under Article 82.

This DPA prevails over conflicting Service Agreement provisions concerning the processing covered here. Portuguese law governs the contractual relationship subject to applicable Union law and mandatory rights. Publication of a revised DPA does not amend an existing agreed version. Material amendments require written agreement; subprocessor changes and security improvements follow Sections 4 and 5. The annexes and, where completed, the account confirmation form part of this DPA.

Annex I — Description of the processing

Subject matter and purpose: Hosting and operating Customer-configured contact and confirmation buttons; receiving and storing permitted interactions and messages; routing notifications; providing related reports, export, deletion and technical support.

Nature and frequency: Ongoing service provision; collection, recording, organisation, storage, retrieval, consultation, transmission to instructed destinations, aggregation, restriction and deletion as users interact or the Customer issues instructions.

Data subjects: The Customer’s customers, prospects and other correspondents; people who visit or interact with its buttons or submit contact requests; Customer personnel and authorised notification recipients whose details are included in the configured service.

Data categories: Names and email addresses; message text, subject and urgency; button labels and configured content where personal; recipient and destination identifiers; interaction identifiers, timestamps, status, browser user-agent, transient IP addresses and stored keyed IP hashes; delivery status and technical references; channel credentials and webhook addresses where they relate to individuals.

Restricted content: The service is not intended to collect special-category data under Article 9 GDPR, criminal-offence data under Article 10, payment-card details or third-party passwords in contact messages. The Customer shall not intentionally request them. Unexpected sensitive content shall be handled under protective instructions, including restriction or deletion as appropriate.

Duration: The service relationship and the return/deletion period in Section 10. Detailed interactions and associated contact requests: six months by default. Account-linked configuration and daily totals: until deletion under the service controls or an applicable instruction. Backup duration: seven daily restore points in a rolling rotation, normally covering approximately seven days, with the oldest replaced by the next daily backup. No separate long-term backup archive.

Annex II — Technical and organisational measures

- Access control: authenticated application sessions, server-side resource ownership checks and restricted administrative access. Passwords are stored as hashes. Production authentication cookies use Secure, HttpOnly and SameSite protections. Access permissions must be reviewed and removed when no longer needed.
- Transport and secrets: HTTPS for the public service and supported outbound provider requests; sensitive channel configuration encrypted at rest using authenticated encryption. Encryption keys and application secrets must be access-restricted and kept out of source control and ordinary logs. This does not assert encryption of all stored database fields.
- Minimisation: click-related IP addresses are stored as keyed hashes rather than plain IP addresses in the event records. Such hashes and browser metadata can remain personal data. Authentication-session IP storage is disabled. Application error logs avoid raw request bodies, passwords and arbitrary exception contents.
- Integrity and delivery: input validation, request limits, authenticated customer actions, signed form submissions and background notification jobs with delivery state, controlled retries and duplicate protection. These controls do not guarantee that an external recipient accepts every notification.
- Lifecycle and assistance: a retention worker removes detailed click and contact records after six months; account export and deletion controls support return and erasure. Authorised staff must handle lawful instructions that are not fully supported by self-service controls and verify the outcome.
- Availability and recovery: the primary server is hosted in Helsinki, Finland; automatic Hetzner Cloud Backups of the server disk are stored in Helsinki, Finland, with seven daily restore points in a rolling rotation, normally covering approximately seven days. Each new daily backup replaces the oldest; no separate long-term backup archive is maintained. Any additional backup service and its storage countries are notified under Section 5. The Processor shall restrict backup access, protect backup transfers and storage, test restoration at appropriate intervals and prevent restored data from undoing completed deletion instructions.
- Operational organisation: confidentiality obligations for authorised staff, least-privilege access, security updates, incident assessment and escalation, documented subprocessor checks, and periodic review of the measures. Hosting providers supply physical facility controls under their applicable security arrangements; no certification of Matikus is asserted.

On request, the Processor shall supply the Customer with confirmation of the stated backup arrangements, relevant provider security information and any additional measures required for the agreed processing. The Customer may request further evidence under Section 9. A processing location or retention period is not inferred from a provider’s registered address.

Annex III — Providers and authorised destinations

Hetzner Online GmbH — infrastructure: Hosting of the application and database containing the data described in Annex I. Primary server and automatic Hetzner Cloud Backup location: Helsinki, Finland. Any additional backup service, its storage countries and applicable provider arrangements are notified under Section 5. Provider contact and current security information are linked below.

Brevo — transactional email delivery: Processes the recipient address and notification content, which can include submitted contact details and messages, when the service sends email notifications. Contracting entity: Sendinblue SAS (Brevo), France, under the Brevo terms and Data Processing Agreement linked below, which govern its processing locations and onward-transfer safeguards. Further particulars are published on the subprocessor list referred to below. The brand name alone does not authorise every company in the provider’s group.

Customer-selected destinations: The six routing methods below are available for the Customer’s documented instructions. The Customer’s channel configuration and, where completed, its account confirmation identify the actual recipients, their role and relevant countries/safeguards; it does not authorise every entity operating under a service’s brand. A newly selected destination remains subject to Section 6; if it is an additional subprocessor, Section 5 applies.

Routing method — email: Delivery through the Processor’s Brevo email service to the mailbox selected by the Customer. Brevo is a Processor-appointed subprocessor; the receiving mailbox and its provider are identified by the Customer.

Routing method — telegram: Delivery through the Telegram Bot API using the Customer-supplied bot token and chat ID. The Customer identifies the bot, intended chat or recipient organisation and its applicable Telegram arrangements. Responello does not supply a shared Telegram bot.

Routing method — slack: Delivery to the Customer-selected Slack workspace and channel through its incoming webhook. The Customer identifies the workspace operator and its Slack service arrangements.

Routing method — discord: Delivery to the Customer-selected Discord server and channel through its incoming webhook. The Customer identifies the server operator and its Discord service arrangements.

Routing method — pocket_alert: Delivery to the Customer-selected Pocket Alert webhook and receiving devices. The Customer identifies the account holder and its Pocket Alert service arrangements.

Routing method — webhook: Delivery by HTTPS POST to the endpoint selected by the Customer. The Customer identifies the endpoint operator, receiving application and any hosting or onward-processing providers it uses.

Creem: Handles subscription sales, payment and invoice administration separately. It is not listed as a subprocessor for Customer contact-message content under this DPA.

The Processor publishes the current list of its subprocessors, with identity, purpose, processing locations and transfer safeguards, at /legal/subprocessors, independently of any account confirmation. The authorised provider list is the list in this Annex and on that page, as changed under Section 5. Publishing an updated list does not by itself authorise a new subprocessor or replace the advance notice and objection right under Section 5. No processing covered by this DPA may be entrusted to an unidentified provider or take place without required processor contracts and transfer safeguards. The Processor shall provide relevant supporting details on request.

Current subprocessor list: /legal/subprocessors
Hetzner company and contact information: https://www.hetzner.com/legal/legal-notice/
Hetzner data protection, DPA and security information: https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner/
Hetzner Cloud Backup storage and retention information: https://docs.hetzner.com/cloud/servers/backups-snapshots/faq/
Brevo terms and Data Processing Agreement: https://www.brevo.com/legal/termsofuse/