Data Processing Agreement (DPA)
Last updated: 17 October 2026
Contract basis: This framework is supplemented for each order with Customer details, processing description and agreed annexes, and is agreed before processing on behalf of the Customer begins.
1. Parties and Application
1.1 The processor is Yevgen Yeshchenko, Im Egerten 7/1, 74391 Erligheim, Germany; info@phasi.app. The Customer identified in the individual order is controller and the Provider processor. If the Customer itself acts as processor, the necessary authorization and instruction chain must be separately documented before processing.
1.2 This DPA with completed annexes is agreed in writing or electronically before processing starts. It also covers the free three-month pilot with real project data. It does not replace verification of actual measures.
2. Subject Matter, Scope and Duration
2.1 Processing concerns provision of PHASI for product structures, projects, tasks and work phases. Nature and purpose include storage, organization, display, transmission, technical administration, support, backup, recovery and final return or deletion.
2.2 Only data described in Annex 1 is processed for the agreed contract or pilot term and instructed wind-down afterward. This does not authorize general further use of all Customer Data for the Provider's purposes or legal defense. Statutory retention duties must be specifically identified.
3. Customer Responsibilities
3.1 The Customer is responsible for lawful collection and instructions, necessary notices to data subjects and user permissions. It identifies authorized instruction contacts and communicates changes.
3.2 Special-category data under Article 9 GDPR, criminal data under Article 10 and comparably sensitive data are outside scope without prior assessment and express agreement.
4. Instructions and Legal Requirements
4.1 The Provider processes only on documented instructions, including for third-country transfers. Instructions arise from the agreed order, this DPA and authorized Customer settings. Additional instructions are documented in text form; urgent instructions are documented without undue delay.
4.2 If legal concerns arise, the Provider immediately informs the Customer and suspends the affected instruction pending clarification. Technical difficulty or extra cost does not justify blanket exclusion of statutory assistance; the parties promptly establish a lawful solution.
4.3 Where Union or Member State law requires processing without instructions, the Provider informs the Customer of that requirement beforehand unless the law prohibits this on important public-interest grounds.
5. Confidentiality and Access
The Provider limits access to necessary authorized persons and binds them to confidentiality unless an appropriate statutory duty applies. Confidentiality continues after their engagement ends. Access and support access follow the documented permissions concept.
6. Security and Backups
6.1 The Provider implements risk-appropriate measures required by Article 32 GDPR, including appropriate availability, recoverability and regular assessment. Annex 2 describes the operational setup; customer-specific details are agreed before processing begins.
6.2 Changes must not reduce the agreed protection level. Material changes are documented and communicated. Customer backups do not replace Provider duties.
6.3 According to the Provider, STRATO VPS data is backed up daily to Cloudflare R2, European Union (EU) jurisdiction, and retained for one month. Archives including the database and configuration are encrypted before upload using age and a separate PHASI key. The Provider successfully tested encryption and recovery from an encrypted R2 archive. No local SaaS backup copies exist; the private key is kept locally with a backup on USB. According to the Provider, deletion after one month and targeted earlier deletion of individual customer backups are configured. Earlier statutory deletion duties remain controlling.
7. Subprocessors
7.1 General authorization concerns the specifically identified subprocessors in Annex 3. Additions or replacements are notified before use, including task and processing location, with reasonable time for substantiated privacy objections. Objections are resolved before affected processing; where necessary, an alternative or termination of the affected service must be agreed.
7.2 The Provider contractually imposes the same relevant data protection duties on subprocessors and verifies sufficient guarantees. It remains responsible to the Customer for their performance. General authorization does not replace a specific list.
8. Third-Country Processing
Processing outside the EU/EEA, including corresponding remote access, requires documented instructions and compliance with Articles 44 et seq. GDPR. Recipients, countries and safeguards actually used are documented and made available beforehand. The word “Europe” alone does not confirm exclusively EEA operation.
9. Assistance and Data Subject Rights
9.1 Taking account of the nature of processing and available information, the Provider assists with data subject rights and obligations under Articles 32 to 36 GDPR, including impact assessments and prior consultation.
9.2 Requests received directly from data subjects are forwarded without undue delay. Substantive responses are given only on instructions or a legal basis. Assistance takes applicable deadlines into account.
10. Personal Data Breaches
The Provider notifies the designated contact without undue delay after becoming aware of a breach affecting personal Customer Data. Initial notice is not postponed until investigation is complete. Available details include nature and scope, affected data and persons, contact point, consequences and measures; missing details follow without unreasonable delay. Incidents and remediation are documented. Notifications to authorities and data subjects generally remain the controller's responsibility, with Provider assistance.
11. Evidence and Audits
11.1 The Provider makes available all information necessary to demonstrate compliance with Article 28 GDPR, allows audits including inspections by the Customer or its mandated auditor, and contributes to them.
11.2 Confidentiality and security precautions protect other customers and trade secrets but must not prevent oversight. Scope, timing and procedure are coordinated where possible. Urgent incident-related reviews and authority powers are not restricted by rigid notice periods.
11.3 Any cost arrangement must be reasonable and must not effectively defeat statutory audit rights. Necessary oversight is not conditional on prior agreement of fees.
12. Return and Deletion
12.1 After services end, personal data is returned or deleted at the Customer's choice and documented instruction and existing copies deleted unless Union or Member State law requires retention. Outstanding fees do not justify refusing these duties.
12.2 Section 26 of the Terms describes wind-down. According to the Provider, customers can download a backup file through the interface and import it into PHASI. Return format, completeness and retrieval after access ends are recorded for the order. The file being unreadable without PHASI must not restrict statutory return and switching rights. Internal R2 backups are treated separately.
12.3 Productive access, secure handover, retrieval period and deletion are specified separately. Ending the free pilot does not end wind-down duties. Statutory switching and retrieval periods must be observed.
12.4 Deletion duties cover R2 backups and any other copies. One-month R2 retention does not justify blanket retention after a deletion instruction. According to the Provider, earlier customer-specific deletion is possible by specific intervention and must be arranged and documented. Lawfully remaining data stays blocked; deletions are reapplied upon restoration.
12.5 The Provider confirms completion in text form and documents lawfully remaining data with reason and deletion date. Its own contract and invoice records subject to legal retention are kept separately and purpose-limited.
13. Liability and Precedence
Liability follows the Terms without restricting mandatory GDPR rights and duties, particularly toward data subjects. This DPA takes precedence in conflicts concerning processing on behalf of the Customer.
Annex 1: Processing Description
- Subject and purpose: PHASI project planning, including a pilot with real project data and technical wind-down.
- Data: names, business contacts, accounts, roles, permissions, user assignments, personal project content, comments and necessary technical logs; actual fields require verification for each installation.
- Data subjects: users, employees, management, contractors and business contacts entered by the Customer.
- Duration: agreed term plus lawful documented return and deletion.
- To complete before agreement: Customer name and address, authorized instruction contacts, security contact, specific environment and start date.
Annex 2: Technical and Organizational Measures
Confirmed by the Provider:
- Separate STRATO VPS per customer company in Europe.
- HTTPS, firewall and operating system updates.
- Daily backup of STRATO VPS data to Cloudflare R2, European Union (EU) jurisdiction, one-month retention. No local backup copies.
- Successful recovery test confirmed. Earlier deletion of individual customer backups is possible through specific intervention. The local computer does not have disk encryption.
Additionally confirmed: age encryption of all R2 archives before upload, including database and configuration; successful recovery test from an encrypted R2 archive; key stored locally and on USB; sole administrative access on the PHASI side by the Provider; no two-factor authentication; Windows login password without disk encryption on the administration computer; one-month retention of its own technical logs; R2 deletion after one month and ability to delete individual customer backups earlier.
Order-specific annexes record key protection, access controls, recovery and deletion procedures, update procedures, processing locations, customer backup format and retrieval after termination. These are operator statements, not independent security certification.
Annex 3: Subprocessors
STRATO hosting: customer systems hosted in the EU according to the Provider. The contracting entity, address and location details used for the order are recorded in the Customer annex.
Cloudflare R2: storage of daily SaaS backups for one month, European Union (EU) jurisdiction. Archives are encrypted before upload using age and a separate PHASI key; recovery is tested according to the Provider. Cloudflare is a subprocessor for this task. Contracting entity, address, access locations and necessary transfer safeguards are recorded in the Customer annex. Storage jurisdiction is not a blanket assurance of exclusively European support and metadata processing.
According to the Provider, Cloudflare is not used as a proxy in front of SaaS customer environments. Its public website role and previously confirmed email forwarding are distinct from R2. Services processing further Customer Data on behalf of customers through support messages must also be recorded. Local SaaS backups and their synchronization to other clouds are not part of the confirmed backup chain.