Data Processing Agreement for Stringtale

Effective Date: 20 August 2026
Version: 1.0

This Data Processing Agreement (the “DPA”) forms part of the Stringtale Terms and Conditions (the “Terms”) and applies where De Monsters processes Customer Personal Data on behalf of a Customer. It is intended to satisfy Article 28(3) and (4) of the GDPR. Capitalised terms not defined in this DPA have the meaning given in the Terms.

1. Parties, incorporation and priority

1.1 Provider:

Stringtale is operated by De Monsters, registered in the Dutch Trade Register under Chamber of Commerce number 60227184, with its business address at KNSM-laan 137, 1019 LB Amsterdam, the Netherlands (“Provider”, “Stringtale”, “we”, “us” or “our”).

1.2 Customer:

“Customer” means the business, organisation or self-employed professional identified through the applicable Stringtale Account, order or checkout record and bound by the Terms.

1.3 Incorporation and application:

This DPA is incorporated into the Terms through Article 5.3. It becomes contractually binding when the Customer accepts the Terms and applies from the moment Provider begins processing Customer Personal Data as a Processor on behalf of that Customer. No separate signature or checkbox is required where electronic acceptance of the Terms validly binds the Customer.

1.4 Applicable version and evidence:

The applicable DPA version is the version incorporated through the Terms accepted by the Customer, as recorded by Provider. Provider may retain the Customer identity, Account identifier, accepting representative, acceptance timestamp, Terms version, DPA version and technical evidence of acceptance for contract administration and proof.

1.5 Priority:

For processing of Customer Personal Data, this DPA prevails over conflicting provisions of the Terms. The Terms otherwise continue to apply, including their liability, governing-law and dispute provisions, except where mandatory data-protection law requires otherwise.

2. Definitions

2.1:

“Applicable Data Protection Law” means the GDPR, the Dutch GDPR Implementation Act and any other data-protection law that applies to the processing covered by this DPA.

2.2:

“Customer Personal Data” means Personal Data contained in Customer Content or otherwise processed by Provider solely on the Customer’s documented instructions in providing the Service. It excludes processing for which Provider independently determines the purposes and means, as described in the Privacy Policy.

2.3:

“GDPR” means Regulation (EU) 2016/679. “Personal Data”, “Personal Data Breach”, “Process”, “Controller”, “Processor”, “Data Subject” and “Supervisory Authority” have the meanings given in the GDPR.

2.4:

“Subprocessor” means another Processor engaged by Provider to process Customer Personal Data on behalf of the Customer.

2.5:

“EEA” means the European Economic Area. “Restricted Transfer” means a transfer of Personal Data to a country outside the EEA that is not covered by an applicable adequacy decision and therefore requires an appropriate safeguard under Chapter V GDPR.

2.6:

“SCCs” means the standard contractual clauses for international transfers adopted by the European Commission in Implementing Decision (EU) 2021/914, as amended or replaced.

3. Scope and roles

3.1:

This DPA applies only to processing in which Provider acts as Processor or Subprocessor for the Customer. It does not govern Provider’s separate Controller processing for Account administration, billing, service security, legal compliance or other purposes described in the Privacy Policy.

3.2:

The Customer is Controller and Provider is Processor for Customer Personal Data. If the Customer acts as Processor for another Controller, Provider acts as the Customer’s Subprocessor.

3.3:

Where the Customer acts as Processor, the Customer confirms that the relevant Controller has authorised the Customer to appoint Provider and Provider’s Subprocessors and to issue the instructions contained in the Terms and this DPA.

3.4:

The processing details required by Article 28(3) GDPR are set out in Schedule 1.

4. Documented instructions

4.1:

Provider will process Customer Personal Data only on documented instructions from the Customer, unless Union or Member State law requires otherwise.

4.2:

The Terms, this DPA, the Customer’s configuration and authorised use of the Service, and written support or Account instructions constitute the Customer’s documented instructions.

4.3:

The Customer may issue additional written instructions that are consistent with the Terms, this DPA and the functionality of the Service. If an instruction requires material work outside the Service, the parties may agree a separate scope and reasonable charges before that work begins.

4.4:

Provider will promptly inform the Customer if, in Provider’s opinion, an instruction infringes Applicable Data Protection Law. Provider may suspend the affected processing until the instruction is amended, withdrawn or confirmed lawful.

4.5:

If Provider is legally required to process Customer Personal Data other than on the Customer’s instructions, Provider will inform the Customer before processing unless the law prohibits that information on important grounds of public interest.

5. Customer responsibilities

5.1:

The Customer is responsible for the lawfulness, fairness and transparency of its processing and instructions, including having an appropriate legal basis and providing required information to Data Subjects.

5.2:

The Customer is responsible for the accuracy, quality and legality of Customer Personal Data, the means by which it was obtained, the instructions it gives and the permissions of its Authorised Users.

5.3:

The Service is not intended for deliberate processing of special-category data under Article 9 GDPR or criminal-conviction data under Article 10 GDPR. The Customer must not deliberately submit such data unless the parties have first agreed in writing on the processing and any additional safeguards required by law.

6. Confidentiality and personnel

6.1:

Provider will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations or an appropriate statutory duty of confidentiality.

6.2:

Provider will limit access to Customer Personal Data to personnel and contractors who need that access to provide, secure, support or maintain the Service and will ensure that they process it only as authorised.

7. Security of processing

7.1:

Provider will implement and maintain appropriate technical and organisational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

7.2:

In determining appropriate security, Provider will take account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to Data Subjects. The current measures are described in Schedule 2.

7.3:

Provider may update its security measures to reflect technical or operational developments, provided that an update does not materially reduce the overall protection of Customer Personal Data.

7.4:

The Customer remains responsible for securely configuring and using the Service, managing Authorised Users and access rights, protecting credentials and tokens, and notifying Provider without undue delay of suspected unauthorised Account access.

8. Personal Data Breaches

8.1:

Provider will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

8.2:

To the extent available, the notification will describe the nature of the breach, affected categories of Data Subjects and data records, likely consequences, measures taken or proposed, and a contact point for further information. Information may be provided in phases where it is not available at the same time.

8.3:

Provider will take reasonable steps to contain, investigate and mitigate the breach and will reasonably assist the Customer with its obligations under Articles 33 and 34 GDPR, taking account of the nature of processing and the information available to Provider.

8.4:

The Customer is responsible for deciding whether to notify a Supervisory Authority or Data Subjects, unless Applicable Data Protection Law requires Provider to notify directly. A breach notification is not an admission of fault or liability.

9. Assistance to the Customer

9.1:

Taking account of the nature of processing, Provider will assist the Customer through appropriate technical and organisational measures, insofar as reasonably possible, with requests to exercise Data Subject rights under Applicable Data Protection Law.

9.2:

If Provider receives a request directly from a Data Subject concerning Customer Personal Data, Provider will forward it to the Customer without undue delay and will not respond substantively unless instructed by the Customer or required by law.

9.3:

Taking account of the nature of processing and the information available, Provider will reasonably assist the Customer with security obligations, breach assessment and notification, data-protection impact assessments and prior consultation with a Supervisory Authority.

9.4:

Standard assistance available through the Service and ordinary support is included. Material additional work outside normal support may be charged only where agreed in advance, except to the extent the work is required because Provider breached this DPA or Applicable Data Protection Law.

10. Subprocessors

10.1:

The Customer grants Provider general written authorisation to use the Subprocessors listed in Schedule 3 and to add or replace Subprocessors in accordance with this Article.

10.2:

Provider will maintain an up-to-date Subprocessor list in Schedule 3 of the current DPA. Before a new or replacement Subprocessor begins processing Customer Personal Data, Provider will notify the Account Owner by email or through a clear in-Service notice.

10.3:

The Customer may object to a proposed Subprocessor on reasonable data-protection grounds within 10 calendar days after notice. The objection must explain the relevant grounds.

10.4:

The parties will work in good faith to address a timely objection. Provider may choose not to use the proposed Subprocessor, take reasonable mitigating measures or offer a commercially reasonable alternative where available. If the objection cannot reasonably be resolved, the Customer may terminate the affected Service before the Subprocessor begins processing; any refund is governed by the Terms unless mandatory law requires otherwise.

10.5:

Provider will impose on each Subprocessor, by written contract, data-protection obligations that provide at least the protection required by Article 28(4) GDPR for the processing entrusted to that Subprocessor.

10.6:

Provider remains responsible to the Customer for the performance of its Subprocessors’ data-protection obligations to the extent required by Applicable Data Protection Law.

10.7:

On reasonable request, Provider will make available information necessary to demonstrate the relevant Subprocessor protections. Provider may redact commercial terms, security-sensitive information, Personal Data and other confidential information from copies of Subprocessor agreements.

11. International transfers

11.1:

Provider will not transfer Customer Personal Data outside the EEA except on documented instructions, as required to provide the Service using an authorised Subprocessor, or where required by law, and only in accordance with Chapter V GDPR.

11.2:

Where a Restricted Transfer occurs, Provider will ensure that an applicable transfer mechanism is in place, such as the SCCs using the module appropriate to the parties’ roles, together with supplementary measures where required.

11.3:

Where an adequacy decision or another lawful transfer mechanism applies, Provider may rely on that mechanism for as long as it remains valid and applicable.

11.4:

On reasonable request, Provider will provide the Customer with relevant information about the applicable transfer mechanism and supplementary safeguards, subject to appropriate confidentiality and security restrictions.

12. Return and deletion

12.1:

During the Subscription and applicable retrieval period, the Customer may retrieve Customer Personal Data using the normal Stringtale retrieval workflow and the Account export described in the Terms and Data Export & Switching information.

12.2:

At the end of the processing services, Provider will, at the Customer’s choice, return Customer Personal Data through the available export mechanism and delete remaining copies, or delete it without return, unless Union or Member State law requires continued storage.

12.3:

Deletion from backups and Subprocessor systems may occur through documented retention and deletion cycles. Until deletion is completed, retained copies will remain protected under this DPA and will not be actively processed except for restoration, security or legal purposes.

12.4:

If the Customer does not communicate a choice within the applicable retrieval period, Provider may delete Customer Personal Data in accordance with the Terms and its documented retention periods.

12.5:

Provider will confirm completion of deletion on reasonable written request, subject to legally required retention and normal backup cycles.

13. Information and audits

13.1:

Provider will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.

13.2:

The Customer should first use available documentation, security information, certifications and independent audit reports where these reasonably provide the assurance required.

13.3:

The Customer may audit the processing covered by this DPA. An inspection of Provider’s premises, systems or processing environment may be requested only where reasonably necessary to demonstrate compliance and the information available under Articles 13.1 and 13.2 is insufficient, or where there are substantiated indications of material non-compliance.

13.4:

The Customer may conduct no more than one routine audit in any 12-month period. This frequency limit does not apply where a Personal Data Breach or other material security incident affects Customer Personal Data, there are substantiated indications of material non-compliance, an audit is required by Applicable Data Protection Law or a competent Supervisory Authority.

13.5:

Any audit or inspection must be conducted by the Customer or an independent qualified auditor bound by confidentiality, on reasonable advance notice, during normal business hours and in a manner that avoids unreasonable disruption and does not expose data or confidential information belonging to other customers.

13.6:

The Customer bears its audit costs and Provider’s reasonable costs of material assistance, unless the audit identifies a material breach by Provider, in which case Provider bears its own reasonable assistance costs.

13.7:

Nothing in this Article limits the powers of a competent Supervisory Authority. Provider will cooperate with such an authority as required by law.

14. Duration, suspension and termination

14.1:

This DPA remains in force for as long as Provider processes Customer Personal Data.

14.2:

If Provider cannot comply with this DPA, it will promptly inform the Customer. The Customer may instruct Provider to suspend the affected processing until compliance is restored or terminate the affected processing where permitted by the Terms and Applicable Data Protection Law.

14.3:

Provider may suspend affected processing or terminate the relevant processing services if the Customer insists on an instruction that Provider has informed the Customer infringes Applicable Data Protection Law.

14.4:

Termination does not affect obligations that by their nature continue, including confidentiality, deletion, audit cooperation concerning prior processing and liability.

15. Liability and mandatory rights

15.1:

The exclusions, limitations and allocation of liability in the Terms apply to this DPA and the processing covered by it, except where Applicable Data Protection Law does not permit them.

15.2:

This DPA does not limit any mandatory rights of Data Subjects or powers of Supervisory Authorities.

16. General

16.1:

The governing law and competent courts stated in the Terms apply to this DPA, without limiting mandatory rights under Applicable Data Protection Law.

16.2:

Contractual notices under this DPA may be sent using the notice methods in the Terms. Operational privacy and security communications may be sent to the Account Owner or another contact designated by the Customer.

16.3:

Additions or replacements of Subprocessors are governed by Article 10, including its notification and objection procedure. Other changes to this DPA are governed by the change mechanism in the Terms. The applicable version and its effective date are identified at the top of this page.

Schedule 1: Details of processing

Parties and roles:

Controller: the Customer identified in the applicable Account, order or checkout record. Processor: De Monsters, operating Stringtale. If the Customer acts as Processor for another Controller, De Monsters acts as Subprocessor.

Subject matter:

Processing Customer Personal Data as necessary to provide, operate, secure, support, maintain and enable export or retrieval from the Stringtale Service.

Duration:

For the period during which Provider provides the Service and any applicable retrieval, retention, deletion and backup cycle described in the Terms, this DPA and the Privacy Policy.

Nature and purpose:

Collection, receipt, organisation, structuring, storage, access, retrieval, consultation, modification, transmission, backup, restoration, export, restriction and deletion, solely to provide and support Stringtale’s static-copy management, collaboration, project workflow, retrieval and Account take-out functionality.

Frequency:

Continuous or recurring during the Customer’s use of the Service, depending on the Customer’s configuration and activity.

Categories of Personal Data:

Personal Data deliberately or incidentally included by the Customer or its Authorised Users in copy keys, copy values, previous values, comments, notes, project content and related history or update records.

Identity, business-contact, Account membership, workspace/project access, role and permission data relating to Authorised Users, to the extent processed on the Customer’s behalf rather than for Provider’s independent Account-administration or security purposes.

Identifiers and metadata linking content, edits, update batches, projects or workspaces to an Authorised User or another identifiable person.

Technical identifiers and support information, including IP addresses, request data or diagnostic context, only to the extent processed on the Customer’s behalf as part of the Service.

Categories of Data Subjects:

Customer employees, contractors, representatives and Authorised Users.

Employees, contractors, users, clients, client personnel or other individuals whose Personal Data the Customer places in Customer Content.

Other identifiable persons referred to in Customer Content, comments, notes or project data.

Sensitive data:

No special-category data under Article 9 GDPR or criminal-conviction data under Article 10 GDPR is intended. Deliberate processing requires prior written agreement and appropriate additional safeguards.

Customer rights and obligations:

The Customer retains all Controller rights and obligations under Applicable Data Protection Law, including determining lawful purposes and instructions, responding to Data Subjects, maintaining required records and supervising Provider’s compliance.

Schedule 2: Technical and organisational measures

Provider maintains measures appropriate to the Service and the risks of the processing. Current measures include:

Access to production systems and Customer Personal Data is restricted to authorised personnel with a business need.

Personnel with access are subject to confidentiality obligations and internal access expectations.

Account, role and permission controls are used to restrict Customer and Authorised User access.

Application-to-database and outbound network traffic is protected using encrypted transport such as TLS/HTTPS.

The primary production environment and database are hosted in Amsterdam, the Netherlands.

Database backups are stored in Cloudflare R2 using an EU jurisdiction restriction and a documented 30-day retention cycle.

Operational logs are retained for a limited period, currently 30 days, subject to security and legal requirements.

Provider uses deployment, dependency-maintenance and change-management practices appropriate to the size and nature of the Service.

Provider maintains processes for detecting, assessing, containing and communicating security incidents.

Subprocessors are selected and contracted subject to data-protection and security requirements appropriate to their processing.

Customer Personal Data is deleted or restricted following termination in accordance with Article 12 and applicable retention cycles.

Schedule 3: Approved Subprocessors

The following providers are authorised only to the extent they process Customer Personal Data on Provider’s behalf. Providers used solely for Provider’s independent Controller activities are not listed.

TransIP B.V.:

Purpose: managed Kubernetes hosting, primary production environment and database infrastructure. Processing location: Amsterdam, the Netherlands. Data: Customer Personal Data processed or stored in the production environment, including associated technical data.

Cloudflare, Inc.:

Purpose: network traffic management, security, DDoS protection and Cloudflare R2 object storage for database backups. Processing: Cloudflare’s network may process request and security data globally; R2 backup objects are stored and processed using an EU jurisdiction restriction. Data: IP addresses, request/security data and encrypted or otherwise protected backup content, as applicable.

Twilio Ireland Limited (Twilio SendGrid):

Purpose: delivery of transactional and service-related email. Stringtale currently uses SendGrid without its EU Data Residency configuration. Processing may therefore take place in the EEA and in other locations, including outside the EEA. Where Customer Personal Data is transferred outside the EEA, the safeguards in Article 11 apply. Data: recipient name and email address and user-triggered message content included in transactional emails.