trygga data processing agreement

Version 1.0 — effective from 1 September 2026

This data processing agreement forms part of trygga’s terms and conditions. It applies between the customer (the controller) and Simo BV, Merktweg 1, 9772 Kruisem, BE1016683031 (the processor, referred to as “we” or “us”). It complies with Article 28 of the General Data Protection Regulation (GDPR). Terms defined in the GDPR have the same meaning here.

1. Roles

1.1 The customer is the controller, and we are the processor, for personal data that users put into the workspace or that arises from its use.

1.2 We are the controller for data we need to perform our own agreement with the customer, such as contact and billing details, our own account administration, support enquiries and our own security logs. Our privacy notice applies to that data, rather than this agreement.

2. What we process

2.1 Purpose and nature. We store, display and transmit data to provide trygga: managing projects, tasks, messages, documents, files and time tracking, giving users access to their workspace and sending project notifications by email. Section 1.2 applies to our own account administration.

2.2 Data subjects. The customer’s team members, guests invited by the customer and people about whom users include information in the content.

2.3 Types of data.

• Identification and contact details: name, email address, profile photo, language and time zone.
• Role and membership in each workspace and project.
• User-created content: tasks, messages, replies, documents and their versions, and files.
• Time tracking: time worked with a description per person and day, and each person’s capacity.
• Usage data: who created or changed what, who viewed what and when, approvals, notifications and emails sent.
• Email preferences.

2.4 Special categories of data. trygga is not intended for special categories of personal data (Article 9 GDPR) or data about criminal convictions. The customer must not put such data into trygga unless it has its own lawful basis and the security measures in Annex A are sufficient for its risk.

2.5 Duration. This agreement continues for as long as we process data for the customer.

3. Instructions

3.1 We process data only on the customer’s written instructions. The agreement, settings chosen by the customer in trygga and users’ actions in the app constitute those instructions.

3.2 We do not use the data for our own purposes. We do not sell it, use it for advertising or train AI models with it.

3.3 If we consider that an instruction infringes the GDPR or other applicable EU or national data protection rules, we notify the customer immediately.

3.4 If EU or Belgian law requires us to process data, we notify the customer beforehand unless that law prohibits us from doing so.

4. Confidentiality

Anyone who has access to the data on our behalf is bound by confidentiality. We grant access only to people who need it for their work. We access a workspace only when needed to answer the customer’s support request, resolve an outage or security incident, or meet a legal obligation.

5. Security

5.1 We take appropriate technical and organisational measures under Article 32 GDPR. Annex A describes them.

5.2 We may adjust these measures provided the level of protection does not decrease.

6. Subprocessors

6.1 The customer gives us general authorisation to use subprocessors. The list is available at trygga.io/en/subprocessors/.

6.2 We give the workspace owner at least 30 days’ notice by email of a new subprocessor or a change to the list. The customer may object within that period, giving reasons. If we cannot find a solution, the customer may cancel the agreement without charge with effect from the date the change takes effect.

6.3 We impose the same obligations as this agreement on each subprocessor in writing. We remain liable to the customer for them.

7. Transfers outside the EEA

7.1 The database and app are configured for hosting in Ireland; files are stored in Cloudflare R2’s EU jurisdiction. This does not mean that all processing, such as network traffic, support or a provider’s administration, takes place exclusively within the EU.

7.2 Some subprocessors are US companies or use a global network. If this results in a transfer outside the European Economic Area, it takes place only with a safeguard under Chapter V GDPR, such as an adequacy decision or the European Commission’s standard contractual clauses. The subprocessor list specifies the safeguard for each provider.

8. Assistance to the customer

8.1 Data subjects’ rights. If we receive a request from a data subject, we forward it to the customer and do not respond ourselves. We help the customer respond insofar as it cannot do so itself in trygga.

8.2 Other assistance. Taking into account the nature of processing and the information available to us, we help the customer meet its obligations concerning security, personal data breaches, data protection impact assessments and prior consultation with the supervisory authority (Articles 32 to 36 GDPR).

8.3 We may charge for assistance exceeding a few hours per year at a rate agreed in advance. Arrangements about costs do not prevent us from meeting our statutory duties to assist.

9. Personal data breaches

9.1 If we identify a breach of the security of the customer’s data, we notify the workspace owner without undue delay and within 48 hours at the latest.

9.2 We include what we know at that point: what happened, the data and number of data subjects affected, the likely consequences and what we are doing or proposing. We provide further information as we learn more.

9.3 The customer decides whether to notify the supervisory authority or the data subjects. We do not make notifications on the customer’s behalf without its agreement, unless the law requires us to do so.

10. Audits

10.1 On request, we give the customer the information needed to demonstrate compliance with this agreement.

10.2 The customer may carry out an audit or appoint an independent auditor bound by confidentiality. We normally schedule no more than one audit per year with at least 30 days’ notice. Additional audits or shorter notice are possible if required by an incident, a reasonable suspicion of non-compliance or a request from a supervisory authority. We cooperate and agree appropriate measures to protect other customers’ operations and data. The customer bears the reasonable costs of an ordinary audit; cost arrangements must not prevent a necessary audit.

11. Ending the agreement

11.1 After the agreement ends, the customer chooses whether we return or delete its personal data. The workspace owner may request an export at hello@trygga.io during the agreement and for up to 30 days after it ends. We provide the export within 7 calendar days of the request, as described in section 12 of the terms and conditions.

11.2 We delete the customer’s data on request or no later than 30 days after the agreement ends. For an export requested in time, we keep the data needed until delivery, no later than 7 calendar days after the request. We keep data that EU or Belgian law requires us to retain for as long as necessary. Backup copies disappear within 7 days of deletion from active systems. On request, we confirm deletion in writing.

12. Liability

Section 10 of the terms and conditions applies to liability under this agreement. This does not affect data subjects’ rights under Article 82 GDPR.

13. Precedence

If this agreement conflicts with the terms and conditions, this agreement takes precedence in relation to the processing of personal data.

---

Annex A — Security measures

Access in the app

• Every database table has row-level security: the database itself determines who may read or change each row, based on workspace, project and role.
• Two levels of visibility: internal and guest. A guest sees only what is shared on projects they have been invited to.
• Four roles: owner, workspace administrator, team member and guest.
• Users cannot register themselves. Access is by invitation only.

Signing in

• Sign in with a password of at least 8 characters or a personal sign-in link sent by email.
• A session token is valid for one hour and is then renewed. Used refresh tokens are invalidated.
• Attempts to send sign-in links, invitations and address changes are limited per hour and per day.
• Unsubscribe links in emails are signed (HMAC-SHA256) and give access only to email preferences.

Storage and transmission

• All traffic uses HTTPS.
• The database and app run in Ireland; files are stored in an EU bucket at Cloudflare R2.
• File links are signed and valid for 15 minutes.
• Supabase encrypts the stored database and database backups with AES-256. Cloudflare R2 encrypts stored files with AES-256. This encryption is provided by the suppliers.
• Secret keys are kept in the hosting providers’ environment settings and the database vault, rather than in source code.

Retention and deletion

• In-app notifications and the record of sent emails are deleted after 30 days.
• A deleted project is permanently erased after 7 days, together with its files.
• Files without a reference are automatically removed from storage.
• Supabase backs up the database daily and keeps backups for 7 days.
• There is no separate backup for files in Cloudflare R2.
• A workspace export is supplied on request within 7 calendar days.
• The app has no feature for making or restoring your own workspace backup.

Organisation

• Only people at Simo BV have access to the suppliers’ administration environments. They receive only the access needed for their work.
• Two-step verification is enabled on administration accounts at all suppliers.
• We monitor security updates for the software we use on a regular maintenance schedule.
• Database changes are tested against access rules before going live.