This Data Processing Agreement (“DPA”) forms part of the agreement (the “Agreement”) between: 

 
Controller: [Full legal entity name], [address], [registration number], [EU VAT ID]  

and  

Processor: e2grow d.o.o., Tehnološki park 20, SI-1000 Ljubljana, Slovenia, registration no. 7141564000, EU VAT ID SI59365668 including any other company which, directly or indirectly, controls or is controlled by e2grow or is under control of any company controlling e2grow (and control of a company shall mean the possession, directly or indirectly, of the power to direct or cause the direction of the management or decisions of such entity, whether through the ownership of voting securities, by contract or otherwise. 

 

Effective date: 12.11.2025 
Version: v2025-11a  

 

1. Preamble and Purpose 

1.1. This DPA sets out the rights and obligations of the parties in relation to the processing of personal data by the Processor on behalf of the Controller, in compliance with the GDPR, in particular Article 28, and in alignment with ISO 27001 and ISO 27701 best practices. 

1.2. This DPA is an integral part of the main agreement between the parties (the "Agreement"). In case of any inconsistency between this DPA and the Agreement, this DPA shall prevail regarding the protection of personal data. 

1.3. This DPA includes the following annexes: 

• Annex A: Details of Processing 

• Annex B: Controller’s Instructions and Audits 

• Annex C: Technical and Organizational Measures (TOMs) 

• Annex D: Special Terms including Liability and Reimbursement 

• Annex E: International Transfers, SCC 2021/914 and Supplementary Measures 

• Annex F: List of Sub-Processors 

1.4. This Data Processing Agreement shall take priority over any similar provisions contained in other agreements between the Parties.  

2. Roles and Definitions 

2.1. The Controller determines the purposes and means of processing. 

2.2. The Processor processes personal data only on documented instructions from the Controller, unless required to do so by Union or Member State law applicable to the Processor. In such a case, the Processor shall inform the Controller prior to processing, unless prohibited by important public interest. 

2.3. “Data” means personal data processed by the Processor on behalf of the Controller. Other terms have the meaning defined in the GDPR. 

3. Scope and Purpose of Processing 

3.1. The Processor processes Data to provide and maintain the e2grow platform, including its core SaaS system, API integrations, Microsoft add-ins, mobile applications, administration portal, customer support, and related professional services. 

3.2. The permitted purposes are defined in Annex A. The Processor may not use Data for its own marketing or profiling. Aggregated and anonymized analytics are permitted where anonymity is irreversible. 

4. Processor Obligations 

The Processor shall: 

4.1. Process Data only on documented instructions of the Controller, including regarding transfers to third countries or disclosures to third parties; 

4.2. Ensure that all persons authorized to process Data are bound by confidentiality agreements or statutory confidentiality obligations and are regularly trained; 

4.3. Implement appropriate TOMs as set out in Annex C, consistent with ISO 27001 principles; 

4.4. Maintain records of processing activities under Article 30 GDPR; 

4.5. Assist the Controller in fulfilling obligations regarding data subjects’ rights and GDPR Articles 32–36, including DPIAs and prior consultations; 

4.6. Notify the Controller without undue delay, and no later than 24 hours after becoming aware of a personal data breach, providing all information required under Article 33(3) GDPR; 

4.7. Allow and contribute to audits as defined in Section 9 and Annex B; 

4.8. Cooperate with supervisory authorities; 

4.9. Not engage sub-processors without prior written consent from the Controller, except as per Annex F; 

4.10. Upon termination of services, delete or return all Data and confirm secure deletion in writing as set out in Section 10. 

5. Data Subject Rights and Requests 

5.1. If a data subject contacts the Processor directly, the Processor shall promptly forward the request to the Controller and not respond directly unless instructed otherwise. 

5.2. The Processor shall provide the Controller with timely access to relevant Data and system logs necessary to respond to such requests. 

6. Sub-Processors 

6.1. The Controller grants a general authorization for the Processor to engage sub-processors listed in Annex F. The Processor shall ensure that sub-processors are bound by obligations equivalent to those set out in this DPA, including third-party beneficiary rights. 

6.2. The Processor shall notify the Controller in advance of any intended changes to sub-processors, allowing a 30-day objection period. In case of a justified objection, both parties shall seek a reasonable alternative. 

6.3. The Processor remains fully liable for sub-processor performance. 

7. International Data Transfers 

7.1. Where processing involves transfers of Data from the EEA or the UK to third countries, the Processor shall implement appropriate safeguards, particularly the European Commission’s Standard Contractual Clauses (2021/914), Module Two or Three as applicable. 

7.2. Supplementary technical and organizational measures, including encryption, pseudonymization, and strict access control, are described in Annex E. 

8. Security of Processing and Incidents 

8.1. The Processor implements TOMs appropriate to the risk, in line with Article 32 GDPR and Annex C. 

8.2. The Processor maintains an incident management program covering detection, response, notification, and remediation. 

8.3. Breach notifications shall include at least: the nature of the breach, categories and approximate number of affected individuals and records, likely consequences, remedial actions, and a contact point. 

9. Audits and Inspections 

9.1. The Processor shall make available to the Controller all information necessary to demonstrate compliance with this DPA and Article 28 GDPR, and shall allow and contribute to audits, including inspections, conducted by the Controller or its appointed independent auditor. 

9.2. Audits shall first be satisfied by valid third-party certifications or reports (e.g., ISO 27001, penetration test reports). Where insufficient, an on-site audit may be conducted per Annex B. 

9.3. The parties shall agree in advance on the scope, duration, timing, and reasonable costs of audits. 

9.4. Audits do not limit the Processor’s responsibilities. 

10. Data Retention, Deletion and Return 

10.1. The Processor retains Data only as long as necessary to fulfill contractual obligations or in accordance with documented Controller instructions.  
Error and security logs are retained for up to three months, unless a longer period is required for investigating incidents or ensuring system integrity. Backups are retained for 180 days on a rolling basis and securely overwritten thereafter, unless otherwise instructed by the Controller. User-generated content and associated metadata are retained for the duration of the contractual relationship and deleted or anonymized within 90 days after termination, unless legal retention obligations apply. Data retained for audit, compliance, or dispute resolution purposes is stored separately and subject to restricted access and periodic review. 
 

10.2. Upon termination of services, the Processor shall securely delete or return all Data and erase existing copies unless retention is required by law. Written confirmation shall be provided upon request. 

10.3. Backup retention and overwrite schedules are detailed in Annex C.  

11. Confidentiality and Information Protection 

11.1. The Processor, its employees, and sub-processors shall protect all confidential information of the Controller, including Data and all security information. 

11.2. Confidentiality obligations remain indefinitely in effect. 

12. Indemnity and Liability 

12.1. Each party is liable for direct damages caused to the other by any breach of this DPA or applicable data protection law. 

12.2. Limitation of liability: The total aggregate liability of the Processor under this DPA shall be limited to an amount equal to twelve (12) months of subscription fees paid by the Controller under the Agreement, except where liability arises from willful misconduct, gross negligence, breach of confidentiality, or failure to implement appropriate security measures under Article 32 GDPR. 

12.3. Nothing in this clause limits data subjects’ rights to compensation under GDPR or obligations to supervisory authorities. 

13. Term and Termination 

13.1. This DPA becomes effective upon signature by both parties or on the effective date stated above. 

13.2. It remains valid for the duration of processing and until final deletion of all Data. 

14. Governing Law and Jurisdiction

14.1. Governing law: Slovenian. 

14.2. Jurisdiction: Ljubljana District Court or agreed EU jurisdiction. 

14.3. This does not affect the application of SCCs for international transfers. 

15. Contacts

Controller 

Contact:  [name, position, email, phone] 

DPO: [DPO contact, if any] 

Processor 

Contact: e2grow d.o.o., privacy@e2grow.com 

DPO or Privacy Officer: dr. Jaka Lindič, jaka@e2grow.com 

 

16. Signatures

For the Controller: 

Name:  

Title:  

Date:  

Signature: _____________________ 

For the Processor: 

Name: dr. Jaka Lindič 

Title: CEO 

Date:  

Signature: _____________________ 

 

Annex A – Processing Details 

A.1 Purpose of Processing 

• Provision and maintenance of e2grow services 

• Enabling functionalities and integrations (Microsoft 365, Outlook, Teams, Graph API, SSO) 

• User support and incident resolution 

• Security, compliance monitoring, and abuse prevention 

• Product analytics and improvement using aggregated and anonymized data 

• Compliance with legal obligations 

A.2 Nature of Processing 
Collection, organization, storage, access, use, limited disclosure, restriction, deletion or destruction, logging, telemetry, testing, and validation with non-production data. Use of production data for development is prohibited. 

A.3 Categories of Data 

• Identification data: name, surname, business email, role, organizational unit 

• Profile data: language, location, timezone, avatar 

• Usage data: logins, technical identifiers, device IDs, IP, application events 

• Collaboration data: feedback, clicks, in-app interactions 

• CliftonStrengths profile: Top 5 or full 34 if enabled by the Controller 

• User-generated content: notes, reflections, questionnaire responses, micro-activities 

• Special categories: not anticipated. If processed, additional safeguards and lawful bases apply.  

A.4 Data Subjects 

Employees, contractors, and end users to whom the Controller provides access. 

A.5 Duration 

For the term of the Agreement and any additional period required for data return or deletion per Section 10.  

Annex B – Instructions and Audits 

B.1 Controller Instructions 

The Processor shall process Data solely for purposes defined in Annex A and according to documented Controller instructions, including configurations in the admin portal, SSO, and integrations. 

B.2 Retention and Deletion 

• End-user data: default retention and deletion logic upon request 

• Telemetry and logs: 90 days operational logs, 365 days security logs 

• Backup copies: rotation and overwrite within 180 days, encrypted and access-controlled 

B.3 Processing Locations 

Primarily within the EU. Locations are listed in Annex F. Processing outside listed locations requires prior written approval from the Controller. 

B.4 Third-Country Transfers 

Executed only under mechanisms defined in Annex E, including SCC 2021/914 and supplementary measures. 

B.5 Audit Process 

• Initially through third-party evidence: valid ISO 27001, penetration test reports, or summaries of audit findings 

• Where insufficient, on-site or virtual audit by prior agreement on scope, schedule, and cost 

• Audits conducted at reasonable intervals or upon justified indication of non-compliance 

B.6 Sub-Processor Audits 

The Controller may request third-party reports or indirect audits via the Processor. In justified cases, a limited on-site review may occur, with the Processor remaining fully responsible for sub-processor compliance. 

Annex C – Technical and Organisational Measures (TOMs) 

Measures are based on risk assessment and ISO 27001 standards, including: 

C.1 Access and Confidentiality Management 

• RBAC and least privilege principle 

• MFA for privileged access 

• Strong password policies and secret rotation 

• Regular security training and contractual confidentiality obligations 

• Access logging and analysis 

C.2 Integrity and Environment Separation 

• Separation of production and development environments 

• No production data in development 

• Change control, code review, CI/CD security controls 

• Key management with HSM where applicable 

C.3 Encryption and Transmission 

• TLS for data in transit 

• Encryption of data at rest (disk or database level) 

• Encrypted backups 

• Key management and separate storage for pseudonymization keys 

C.4 Availability and Business Continuity 

• Backup and recovery strategy 

• Regular recovery drills 

• BCP and DR plans 

• Timely patching and vulnerability remediation 

C.5 Monitoring and Detection 

• Centralized logging and event correlation 

• IDS/IPS or equivalent monitoring by hosting provider 

• Regular privileged activity review 

C.6 Vulnerability Management and Testing 

• Periodic vulnerability scans 

• Annual independent penetration testing 

• Remediation processes according to risk level 

C.7 Incident Response 

• Documented response procedures and trained team 

• Internal notification timelines 

• Documented mitigation and recurrence prevention actions 

C.8 Privacy by Design and Default 

• Data minimization 

• Privacy by design and default 

• DPIA support 

• Regular internal compliance reviews and Article 30 records 

C.9 Physical Security and Infrastructure 

• EU-based hosting providers with certifications 

• Standards: ISO 27001 

• Physical access control and redundancy 

Annex D – Additional Terms, Liability and Costs 

D.1 Non-Compliance 

The Processor shall reimburse the Controller for proven direct costs, losses, or fines arising from breaches of this DPA caused by the Processor or its sub-processors. Additional liability limitations may be agreed as per Section 12.  

D.2 Assistance and Audit Costs 

• Assistance under Section 7 is included, except for extensive or extraordinary tasks (e.g., complex DPIA or regulatory investigations), billed at pre-agreed hourly rate of 130€.  

• On-site audits may be conducted subject to prior agreement and reasonable cost reimbursement. 

Annex E – International Transfers and SCC 

E.1 SCC 

The parties agree that transfers to third countries shall be governed by the European Commission’s Standard Contractual Clauses (2021/914). Module Two (Controller to Processor) and, where applicable, Module Three (Processor to Processor) are incorporated by reference and form part of this DPA. In case of conflict, SCCs prevail. 

E.2 Supplementary Measures (Schrems II) 

• Pseudonymization and encryption prior to transfer, where feasible 

• Key separation and strict access controls 

• Policy for government access requests and legal challenge of disproportionate demands 
   

Annex F – Approved Sub-Processors 

List each sub-processor with jurisdiction, processing location, purpose, legal basis, and DPA link. Example: 

Sub-Processor	Domicile	Processing Location	Purpose	Transfer Mechanism	DPA Link
Microsoft Ireland Operations Ltd.	IE	EU	Integrations, communication, identity	No transfer outside EU or SCC if applicable	https://aka.ms/dpa
Scaleway	FR	EU	Encrypted database backups	Primarily no transfers outside EU; if data is transferred to a third country, this is based on EU Standard Contractual Clauses as set out in Scaleway’s DPA.	https://www-uploads.scaleway.com/DPA_2024_ENG_b0abb5cc26.pdf
Hetzner	DE	EU	Infrastructure services	Processing in EU data centres; any transfers to third countries only under GDPR safeguards such as SCCs, as described in Hetzner’s Data Processing Agreement.	https://www.hetzner.com/AV/DPA_en.pdf
Sentry (Functional Software, Inc.)	US	EU & US	Application error & performance monitoring	Transfers of EU personal data outside EEA based on SCCs and participation in the EU–U.S. Data Privacy Framework, as set out in Sentry’s DPA	https://sentry.io/legal/dpa/
Smartlook.com, s.r.o.	CZ	EU	Product analytics, session replay and usage analytics for web/app	Personal data of EU data subjects processed in the EU; any non-EU sub-processors use SCCs according to Smartlook’s DPA	https://www.smartlook.com/dpa
Google Analytics	IE	EU & US	Web analytics – traffic and usage statistics	Google Ads / Analytics Data Processing Terms, including SCCs and EU–U.S. Data Privacy Framework for transfers outside EEA	https://support.google.com/analytics/answer/3379636
Firebase Crashlytics	IE	EU & US	Mobile app crash reporting and diagnostics	International transfers based on Firebase Data Processing and Security Terms, incl. SCCs and Google’s participation in the EU–U.S. Data Privacy Framework for transfers outside the EEA	https://firebase.google.com/terms/data-processing-terms

The Processor maintains an up-to-date list of sub-processors available upon request and notifies the Controller at least 30 days in advance of any changes.