Data Processing Agreement

This is an English translation provided for information only. The Slovak version of this Agreement is the only legally binding version.

In short

This overview is for quick orientation only. The full text below is legally binding.

• When you store data in frego about your clients, contacts or collaborators, you are its controller. We process it only on your instructions, as processor under Art. 28 GDPR.
• You conclude this agreement automatically by accepting the Terms of Service. There is nothing to sign.
• We use the data only to provide the Service, never for our own purposes, and protect it with appropriate measures. The vault is end-to-end encrypted and we cannot see its content.
• Some tasks are handled by sub-processors (listed in Annex 1). We will tell you in advance about any change.
• In the event of a data breach we will notify you without undue delay and help you handle requests from data subjects.
• After you delete your account, the data is permanently erased after 30 days.

Article 1 – Parties and conclusion

1.1 This data processing agreement (the "DPA") is concluded between:

a) the User of the frego Service, who, regarding the personal data under Article 3, is the controller within the meaning of Regulation (EU) 2016/679 (the "GDPR"), and

b) WCR Technologies s. r. o., Karpatské námestie 7770/10A, 831 06 Bratislava – Rača, Slovakia, company ID (IČO): 57261733, registered in the Commercial Register of the Municipal Court Bratislava III, section Sro, file No. 192642/B, e-mail: studio@wcr.sk, which is the processor of that data (the "Processor").

1.2 The DPA forms part of the contract for the Service concluded under the Terms of Service (the "Terms"). The User accepts it together with the Terms when registering; no separate signature is required. Capitalised terms not defined in this DPA have the meaning given in the Terms. The terms "personal data", "processing", "data subject", "personal data breach" and others have the meaning given in the GDPR.

1.3 This DPA does not apply to personal data the Processor processes as controller (in particular the User's account data, payment data, support communication and security records); that is governed by the Privacy Policy.

Article 2 – Subject matter, nature, purpose and duration

2.1 The subject matter is the processing of personal data that the User, the Members of the User's Projects or persons invited by the User enter into the Service, solely for the purpose of providing the Service to the User under the Terms.

2.2 The nature of processing includes in particular storage, organisation, display, search, making data available to Project Members according to the User's settings, backup, sending notifications, generating documents (for example invoices and work reports), synchronisation with services the User connects, processing through AI features the User starts, and erasure.

2.3 The duration of processing corresponds to the term of the contract for the Service and the erasure period under Article 10.

Article 3 – Categories of data subjects and personal data

3.1 Categories of data subjects: the User's clients and their representatives and contact persons, Project Members and other persons invited to Projects, suppliers and customers named on invoices, and other persons about whom the User keeps records in the Service.

3.2 Categories of personal data: identification and contact data (name, e-mail, phone, address, company ID, tax ID, VAT ID), invoice and payment data, the content of tasks, comments, notes, specifications, ideas and mind maps, time records, files and their content, voice recordings, calendar event data and Vault items.

3.3 Vault items are end-to-end encrypted in the browser and the Processor stores them only in encrypted form, with no ability to access their content.

3.4 The Service is not intended for processing special categories of personal data (Art. 9 GDPR) or data relating to criminal offences (Art. 10 GDPR). If the User nevertheless enters such data, the User is responsible for having a legal basis for processing it and for the measures in place being sufficient for it.

Article 4 – The User's instructions

4.1 The Processor processes personal data only on documented instructions from the User. Such instructions are this DPA, the Terms and the actions the User or persons authorised by the User take in the Service (for example entering, editing, sharing or deleting data, inviting a Project Member, turning on an integration or starting an AI feature). The User may give further instructions by e-mail to studio@wcr.sk where technically feasible and consistent with the Service.

4.2 The Processor does not process personal data for its own purposes, does not sell it and does not use it for advertising or for training artificial intelligence models.

4.3 If the Processor is required to process personal data by Union or Member State law, it will inform the User before processing unless that law prohibits it.

4.4 If the Processor considers that an instruction infringes the GDPR or other data protection law, it will inform the User immediately and is not obliged to carry out the instruction.

Article 5 – Obligations of the Processor

5.1 The Processor shall:

a) ensure that persons authorised to process personal data have committed themselves to confidentiality or are under a statutory obligation of confidentiality, b) adopt and maintain technical and organisational measures under Art. 32 GDPR, summarised in Annex 2; it may change them provided the level of protection is not reduced, c) respect the conditions for engaging sub-processors under Article 6, d) assist the User under Article 8, e) notify personal data breaches under Article 9, f) proceed under Article 10 after the provision of the Service ends, g) make information available to the User and allow audits under Article 11.

Article 6 – Sub-processors

6.1 The User gives the Processor a general authorisation to engage sub-processors. The sub-processors engaged on the effective date of this DPA are listed in Annex 1.

6.2 The Processor will inform the User of any intended addition or replacement of a sub-processor by e-mail or in the Service at least 14 days in advance and will update Annex 1. The User may object to the change on reasonable data protection grounds at studio@wcr.sk. If the parties do not agree on a solution, the User may end the contract by deleting the account before the change takes effect and is entitled to a refund of the proportionate part of the price paid for the period after the contract ends.

6.3 The Processor will impose on each sub-processor, by contract, the same data protection obligations as set out in this DPA, in particular the obligation to provide sufficient guarantees of appropriate technical and organisational measures. The Processor remains liable to the User for the performance of the sub-processor's obligations under Art. 28(4) GDPR.

Article 7 – Transfers to third countries

7.1 The Processor stores personal data in the European Union. Some sub-processors listed in Annex 1 may also process data in the US. Such transfers take place only on the basis of an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses and in accordance with Chapter V GDPR.

7.2 Data is passed to AI feature providers only when the User or a Project Member starts an AI feature themselves, and only to the extent needed to carry out that action.

Article 8 – Assistance

8.1 Taking into account the nature of processing, the Processor assists the User by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects exercising their rights. Most requests (access, rectification, erasure) the User can handle directly in the Service; in other cases the Processor will assist on request, for example with a data export.

8.2 If a data subject contacts the Processor directly, the Processor will forward the request to the User without undue delay, where it can identify the User, and will not respond on the merits unless the User authorises it to.

8.3 Taking into account the nature of processing and the information available to it, the Processor assists the User in meeting its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessment, prior consultation).

Article 9 – Personal data breach

9.1 The Processor will notify the User of a personal data breach affecting the User's data without undue delay after becoming aware of it, by e-mail to the account address.

9.2 To the extent the information is available, the notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed, and give a contact point for further information. Information not available immediately will be provided in phases.

9.3 The Processor will promptly take appropriate measures to mitigate the effects of the breach. Notifying the supervisory authority and data subjects is the responsibility of the User as controller; the Processor will assist.

Article 10 – Erasure and return of data

10.1 While the account exists, the User may at any time edit, download (for example files and invoices) or delete personal data in the Service. On request sent to studio@wcr.sk, the Processor will provide the data in a structured, commonly used and machine-readable format.

10.2 After the account is deleted, it is blocked immediately and after 30 days all personal data processed under this DPA is permanently erased, including files, Projects and invoices. If on deleting the account the User hands over Projects to one of their Members, the data in those Projects passes to the new Project Owner. The User's data in other Owners' Projects is anonymised under point 10.5 of the Terms.

10.3 Backups are made daily and kept for 7 days; deleted data is therefore removed from backups within 7 days at the latest. Backups are kept within the infrastructure in the EU and, until removed, are not used for any purpose other than restoring the Service.

10.4 The erasure obligation does not apply where Union or Member State law requires the personal data to be retained.

Article 11 – Information and audit

11.1 On request, the Processor will provide the User with the information needed to demonstrate compliance with Art. 28 GDPR, in particular a written description of the measures in place and the current list of sub-processors.

11.2 If that information is not sufficient, the User or an auditor appointed by the User and bound by confidentiality may carry out an audit, including an inspection, with at least 30 days' prior notice, to a reasonable extent, during business hours, without disrupting the Service and without access to other Users' data. An audit may take place at most once every 12 months, except in the case of a personal data breach or at the request of a supervisory authority. The User bears the costs of the audit.

11.3 Audits of sub-processors are carried out by providing their certifications, audit reports or other documents those providers make available.

Article 12 – Obligations of the User

12.1 The User is responsible for entering and processing personal data in the Service lawfully, in particular for having a legal basis for processing, for having properly informed data subjects and for being entitled to make the data available to the persons the User invites to Projects.

12.2 The User is responsible for choosing Project Members' roles, for sharing settings (for example public file links) and for what data the User passes to AI features.

12.3 The User must protect their sign-in details, master password and Vault recovery key and notify the Processor without undue delay of any suspected unauthorised access to the account.

Article 13 – Liability

13.1 The parties' liability for damage caused by a breach of this DPA is governed by Art. 82 GDPR and Article 15 of the Terms. The limitations of liability under the Terms do not apply to the extent mandatory law does not allow them.

Article 14 – Final provisions

14.1 The DPA is concluded for the term of the contract for the Service. Obligations which by their nature are meant to survive its end (in particular confidentiality and erasure of data) continue until fulfilled.

14.2 In data protection matters this DPA takes precedence over the Terms.

14.3 Changes to this DPA are governed by Article 21 of the Terms. An update of Annex 1 under Article 6 and an amendment of Annex 2 that does not reduce the level of protection are not a material adverse change.

14.4 The DPA is governed by the law of the Slovak Republic. It is concluded in Slovak; translations are for information only.

14.5 This DPA takes effect on 9 October 2026.

Annex 1 – List of sub-processors

Real-time updates (websockets) are run by the Processor on its own servers; they pass through the Cloudflare network, with no other sub-processors involved. Stripe processes only the User's payment and billing data as the Processor's customer (not data under Article 3) and is therefore not a sub-processor under this DPA.

Annex 2 – Technical and organisational measures

1. Encryption in transit: all communication between the browser, the application and the server is encrypted with TLS (HTTPS). Traffic passes through the Cloudflare network, which protects the Service against attacks; the connection between Cloudflare and the server is also encrypted and the server's certificate is verified.
2. Passwords: account passwords are stored only as a secure one-way hash.
3. Vault: Vault content is end-to-end encrypted directly in the User's browser; the Processor stores only encrypted content and has no access to the master password or recovery key.
4. Encrypted tokens: OAuth access tokens for Google services are stored encrypted.
5. Access control: data is available only to the Project Owner and Project Members according to their roles; only authorised persons of the Processor have access to the infrastructure and production data, and only to the extent needed for operation and support. Access to the administration of the Service is protected by two-factor authentication, actions on Users' accounts are logged and kept for 2 years, and Project content is not displayed in the administration.
6. Files: files in a Project's cloud are kept in private storage and served through temporary signed links; profile photos and task and comment attachments are stored at random, unguessable addresses; a public link to a file is created only when the User creates it.
7. EU hosting: the application, database, files and backups are located in DigitalOcean's data centre in Amsterdam (AMS3).
8. Backup and recovery: data is backed up daily within the infrastructure in the EU; backups are kept for 7 days.
9. Minimisation and deletion: deleted accounts are permanently erased after 30 days; change history is deleted after 365 days, AI request records after 12 months, verification codes after 7 days, read notifications after 12 months, application logs after 14 days and sessions on expiry.
10. Monitoring: application errors are tracked with Sentry, with sending of personal data off by default; security notifications from Google about connected accounts are processed automatically.
11. No tracking: the Service uses no third-party analytics, marketing or advertising tools and serves fonts from its own server.