Data processing agreement for studios

1. Roles

The studio is the owner of the database (the controller) of the personal data it enters or that is entered into its projects. Garmushka (“Garmushka”) holds and processes that data on the studio’s behalf (the processor), under the Protection of Privacy Law, 5741-1981, and the Privacy Protection (Data Security) Regulations, 5777-2017, and, where it applies, Article 28 of the GDPR.

2. What is processed, and why

• Purpose: providing the service the studio uses — quoting, project tracking, the customer and supplier areas, notifications, storage and backups — and nothing else.
• People: the studio’s customers and the people they invite; residents in lobby projects; suppliers’ contacts; participants in imported WhatsApp chats; the studio’s own people.
• Data: names and contact details, project addresses and locations, project and payment details, documents and photos, chat contents, notes, and the activity log. The studio should not enter special categories of data (such as health details) unless it needs to and has the right to.
• Duration: for as long as the studio uses the service, and then as set out under deletion below.

3. Garmushka’s commitments

• To process the data only on the studio’s documented instructions, which are the service’s features and the studio’s settings, unless the law requires otherwise (in which case we will tell the studio, unless the law forbids it).
• To have everyone with access to the data bound by confidentiality.
• To keep appropriate security measures: separation of each studio’s data, encrypted connections, hashed sign-in codes, encrypted queued mail about people, access limited by role and project, logging, and backups.
• To give support access to the studio’s accounts only to authorised staff, only for support, investigating problems or security, and to record every such access in an internal log.
• To help the studio answer requests from the people the data is about, including through the export and deletion tools in the service.
• To tell the studio without undue delay, and within [سيُستكمل] hours of becoming aware of it, of a security incident affecting its data, and to help it meet its own duties to report.
• To make available the information needed to show that these commitments are met.

4. Sub-processors

The studio authorises Garmushka to use these sub-processors: Hetzner Online GmbH (Germany; hosting, database, file storage and backups), Postmark by ActiveCampaign, LLC (USA; email delivery), PostHog Inc. (EU cloud; usage analytics, only for people who consented), Laravel Nightwatch by Laravel Holdings Inc. (USA; error and performance monitoring), and Anthropic, PBC (USA; reading documents and writing suggestions for the AI features, only when the studio has them on and someone uses them; only what each action needs is sent, never commissions). Garmushka binds each one to data protection duties no weaker than these, will announce changes in advance, and the studio may object to a change on reasonable grounds.

5. Transfers abroad

The data is hosted in the European Union. Transfers to sub-processors in other countries are made only under suitable contractual safeguards, as the law requires.

6. Deletion at the end

The studio can download its data at any time. When a studio deletes its account, its data is kept for 30 days so it can be restored, and its customers are offered to keep their projects read-only; after that the data is deleted or anonymised, except the anonymised activity log. Backups are deleted on their regular cycle: [سيُستكمل].

7. The studio’s commitments

The studio confirms that it has a lawful basis to enter the data and share it through the service, that it gives the people concerned the information the law requires, and that its instructions comply with the law.

8. Precedence and contact

If this agreement and the terms of use conflict about personal data, this agreement prevails. Questions and requests: [email protected].