Data Processing Agreement

This Data Processing Agreement ("DPA") is between the customer that owns a Planra workspace or account ("Customer", the controller) and Planra, postal address available on request at legal@planra.co ("Planra", the processor). It applies when Planra processes personal data on the Customer's behalf while providing the service ("Customer Personal Data"). Where the Customer is itself a processor for someone else, Planra acts as its subprocessor and this DPA applies in the same way.

This DPA is designed to meet Article 28 of the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the Swiss Federal Act on Data Protection, and the service-provider requirements of the California Consumer Privacy Act ("CCPA"). Personal data Planra processes as a controller (for example your own account and billing details) is covered by our Privacy Policy instead.

"Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR. "Subprocessor" means a third party Planra engages to process Customer Personal Data. "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.

Planra will:

• process Customer Personal Data only on the Customer's documented instructions — this DPA, the Terms, and the Customer's use and configuration of the service — unless the law requires otherwise, in which case we will tell the Customer first unless the law forbids it;
• tell the Customer if we believe an instruction breaks data-protection law;
• make sure everyone authorised to process Customer Personal Data is bound by confidentiality;
• apply the security measures in Annex II (section 11);
• help the Customer answer data-subject requests, taking into account the self-service tools (edit, export, delete) the service already provides;
• help the Customer with security, breach notification, data-protection impact assessments and prior consultation, as far as the information available to us allows;
• not sell Customer Personal Data, not retain, use or disclose it for any purpose other than providing the service, and not combine it with personal data from other sources except as needed to provide the service (CCPA service-provider terms);
• make available the information reasonably needed to show compliance with this DPA (section 10).

The Customer gives Planra general written authorisation to use subprocessors. The current list, with what each one does and where, is on our Subprocessors page, which is Annex III of this DPA. Planra will:

• update that page at least 30 days before a new subprocessor starts processing Customer Personal Data (and email customers who asked to be told), except where faster action is needed to keep the service running or secure;
• let the Customer object on reasonable data-protection grounds within that period; if we cannot resolve the objection, the Customer may stop using the affected feature or end its subscription and receive a refund of prepaid fees for the unused period;
• put data-protection terms in place with each subprocessor that are no less protective than this DPA; and
• remain responsible to the Customer for its subprocessors' performance.

Services the Customer connects itself (for example Google Workspace, Slack, GitHub, its own AI provider or an MCP client) are not Planra's subprocessors. They process data under the Customer's own agreement with them.

AI features are optional; the Customer and its users decide whether to use them, and every feature has a manual alternative. When used, Planra AI features send the content they need to Google's Gemini API. Planra currently uses Google's unpaid Gemini API service, under which Google may use submitted content and responses to provide, improve and develop its products and services, human reviewers may read them, and Google keeps them for a limited time to detect abuse. The Customer instructs Planra to process Customer Personal Data in this way when its users use Planra AI features, and should tell its users not to put confidential or sensitive personal data into them. Agents configured to use the Customer's own AI provider send data to that provider instead, under the Customer's agreement with it.

Planra will notify the Customer without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known at the time: what happened; the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed; and a contact point (privacy@planra.co). We will send further information as it becomes available.

Planra and most of its subprocessors are in the United States; the main database is hosted in the United States (US East). To the extent Customer Personal Data subject to the GDPR is transferred to a country without an adequacy decision, the parties agree that the SCCs are incorporated into this DPA by reference, as follows:

• Module Two (controller to processor) applies where the Customer is a controller, and Module Three (processor to processor) where the Customer is a processor;
• Clause 7 (docking clause) applies;
• Clause 9: option 2 (general written authorisation) applies, with the notice period in section 5 of this DPA;
• Clause 11: the optional language does not apply;
• Clause 17: the SCCs are governed by the law of Ireland; Clause 18: disputes are resolved by the courts of Ireland;
• Annex I is section 3 of this DPA, Annex II is section 11, and Annex III is the Subprocessors page.

For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0) applies, with Table 1 to 3 completed by the information in this DPA and either party able to end it as allowed by its Section 19. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority, and the term "member state" read to include Switzerland so that data subjects there can enforce their rights. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

The Customer can export its data at any time (see the Privacy Policy, section 8) and can delete content, workspaces or its account itself. When a workspace is deleted, Planra deletes its content and files from the live database and storage at that time. Logs that refer to it are deleted on the schedule in our Privacy Policy, and any backups held by our database provider are overwritten in their normal cycle. If the Customer's account is closed by us, the Customer has 30 days to export its data before it is deleted, unless the law requires us to keep it.

On request, Planra will provide the information reasonably needed to show compliance with this DPA, such as answers to security questionnaires and a description of our measures. If that is not enough, or a supervisory authority requires it, the Customer may carry out an audit on at least 30 days' notice, no more than once a year, during business hours, at its own cost, and in a way that does not compromise other customers' data or our security.

Access and isolation

• Sign-in through Clerk, with managed sessions; we never handle passwords.
• Every request is checked against the caller's active workspace membership; viewers have read-only access.
• Owner or admin role required for workspace-wide settings, Labs and the audit (provenance) export.
• API keys are stored as hashes and can be bound to a single agent with its own budget and approval rules.

Encryption

• All traffic uses HTTPS (TLS).
• Data is encrypted at rest by our database and storage provider.
• AI provider keys and some integration tokens are additionally encrypted by Planra before they are stored.

Monitoring and resilience

• Audit logs of significant actions, kept for 365 days.
• Agent actions recorded in a provenance timeline; high-risk agent actions wait for human approval by default.
• Rate limiting on API routes and public pages.
• Public pages pass user content through an allowlist sanitiser.
• Security reviews of the code, and a published vulnerability-reporting channel (Security).

This DPA forms part of the Terms of Service and lasts as long as Planra processes Customer Personal Data. Liability under this DPA is subject to the limits in the Terms, except where the law or the SCCs do not allow that. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. Apart from the SCCs (governed as set out in section 8), this DPA is governed by the same law as the Terms.

Questions: privacy@planra.co