Data Processing Addendum
Last updated: October 28, 2026
This Data Processing Addendum (“DPA”) forms part of the Summerbase Terms of Service between Summerbase ApS (“Processor”) and the Customer (“Controller”). It applies when Summerbase processes personal data within Customer Data on the Customer’s behalf. Terms such as “personal data”, “processing” and “sub-processor” have the meanings given in Data Protection Laws. “Data Protection Laws” means, to the extent each applies, the GDPR (Regulation (EU) 2016/679) and the Danish Data Protection Act, the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), and US state privacy laws.
1. Roles and instructions
1.1 The Customer is the controller and Summerbase is the processor of personal data in Customer Data. Where the Customer is itself a processor for a third party, Summerbase acts as its sub-processor.
1.2 Summerbase processes personal data only on the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration of the Service, including the Integrations and Connected AI Clients it connects and its chosen hosting region, are the Customer’s complete instructions. When Summerbase makes Customer Data available to a Connected AI Client the Customer has connected, it does so on the Customer’s instructions, and that Connected AI Client is not a sub-processor. Summerbase will inform the Customer if it believes an instruction breaches data protection law.
1.3 The details of processing are set out in Annex 1.
2. Confidentiality
Summerbase ensures that personnel authorized to process personal data are bound by confidentiality obligations and access it only as needed to provide the Service.
3. Security
Summerbase implements the technical and organizational measures in Annex 2. Summerbase may update these measures provided the overall level of protection is not reduced.
4. Sub-processors
4.1 The Customer gives general authorization for Summerbase to use the sub-processors listed in Annex 3.
4.2 Summerbase will give at least 10 days’ notice before adding or replacing a sub-processor, by email. The Customer may object on reasonable data protection grounds within that period, and the parties will discuss the objection in good faith. Where a sub-processor must be replaced urgently to protect the Service or Customer Data, Summerbase may do so immediately and will notify the Customer as soon as possible.
4.3 Summerbase imposes data protection obligations on each sub-processor that are no less protective than this DPA and remains liable for their performance.
5. Hosting region and international transfers
5.1 Customer Data is stored at rest in the hosting region the Customer selects: Google Cloud regions in the European Union, or Google Cloud regions in the United States, except as described in section 5.2.
5.2 Cloudflare processes Customer Data in transit across its global network, which may be outside the selected region, as stated in Annex 3. Shared Views the Customer publishes, including their link-preview images, are served and cached across that network.
5.3 Where personal data is transferred outside the European Economic Area to a country without an adequacy decision, the parties rely on, in order: (a) the recipient’s certification under the EU–US Data Privacy Framework; or (b) the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”), which are incorporated by reference as follows:
- Module 2 (controller to processor) where the Customer is in the EEA and selects US hosting.
- Module 3 (processor to processor) between Summerbase and its sub-processors.
- Module 4 (processor to controller) where the Customer is outside the EEA.
5.4 For the SCCs: clause 7 (docking clause) applies; the option in clause 9(a) is general authorization with 10 days’ notice; the option in clause 11 does not apply; clauses 17 and 18 are governed by Danish law and Danish courts; and the competent supervisory authority is Datatilsynet. Annexes 1 to 3 of this DPA complete the SCC annexes. Transfers from the United Kingdom and Switzerland are covered in sections 5.5 and 5.6.
5.5 United Kingdom. The UK recognizes the EEA as providing adequate protection, so UK personal data stored in EU hosting needs no additional transfer mechanism. This section applies only where UK personal data goes to a country without UK adequacy, which in practice means US hosting and Cloudflare’s processing under section 5.2. In those cases the parties rely on: (a) the recipient’s certification under the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”); or otherwise (b) the SCCs as amended by the International Data Transfer Addendum issued by the Information Commissioner’s Office, version B1.0 (“UK Addendum”). For the UK Addendum, Table 1 is completed with the party details in Annex 1, Table 2 with the modules and options in sections 5.3 and 5.4, and Table 3 with Annexes 1 to 3; in Table 4, both the importer and the exporter may end the UK Addendum under its Section 19. References to the GDPR are read as references to the UK GDPR, and the competent supervisory authority is the Information Commissioner’s Office.
5.6 Switzerland. Switzerland also recognizes the EEA as providing adequate protection, so this section likewise applies only to US hosting and Cloudflare’s processing under section 5.2. In those cases the parties rely on the recipient’s certification under the Swiss–US Data Privacy Framework, or otherwise on the SCCs with these changes: references to the GDPR are read as references to the FADP, the competent supervisory authority is the Federal Data Protection and Information Commissioner, and data subjects in Switzerland may bring claims in their place of habitual residence.
6. Assistance and data subject requests
Summerbase will promptly forward to the Customer any request from a data subject relating to Customer Data and will not respond except on the Customer’s instructions. Taking into account the nature of processing, Summerbase will assist the Customer with data subject requests, data protection impact assessments and prior consultations.
7. Personal data breaches
Summerbase will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. The notice will describe the breach, the data and individuals affected, likely consequences and measures taken, as far as known.
8. Deletion and return
The Customer chooses whether Customer Data is returned or deleted. The Customer may export Customer Data from the Service (return) at any time until it is deleted, or request its deletion in the Service or at support@summerbase.com, in which case Summerbase deletes it within 30 days.
When the Customer’s subscription ends, or Summerbase ends an inactive free account under section 16.3 of the Terms, Summerbase may delete Customer Data from 60 days afterwards.
In either case, deleted data leaves Summerbase’s backups as they expire, within a further 30 days, unless law requires retention.
9. Audits
Summerbase will make available information needed to demonstrate compliance with this DPA, including third-party certifications or audit reports where available. If these are insufficient, the Customer may conduct an audit once per year, on 30 days’ notice, during business hours, at its own cost and subject to confidentiality.
10. Liability and precedence
Liability under this DPA is subject to the limitations in the Terms, except where the SCCs or law provide otherwise. If this DPA conflicts with the Terms, this DPA prevails. If it conflicts with the SCCs, the SCCs prevail.
Annex 1: Details of processing
| Item | Description |
|---|---|
| Data subjects | The Customer’s end customers |
| Categories of personal data | Contact and identification data (such as names and email addresses), subscription and payment history, and any other personal data about End Customers that the Customer sends through an Integration |
| Special categories | None. The Customer must not send special categories of personal data or full payment card numbers |
| Nature and purpose | Syncing data from Integrations and calculating subscription metrics such as MRR, churn and lifetime value for the Customer, making Customer Data available to Connected AI Clients the Customer connects, displaying reports the Customer chooses to publish at a shared link to anybody who opens it (these are designed to show aggregated metrics, but may include End Customer personal data if the Customer adds it, for example as a chart breakdown), and creating aggregated, anonymized data as permitted by the Terms |
| Frequency | Continuous, while Integrations are connected |
| Duration | Until Customer Data is deleted under section 8 |
| Data exporter | The Customer, with the name and contact details given in its Summerbase account. Role: controller, or processor where it acts on behalf of another controller |
| Data importer | Summerbase ApS, Denmark, support@summerbase.com. Role: processor, or sub-processor where the Customer is itself a processor |
| Signature and date | By accepting the Terms, both parties are deemed to have signed the SCCs and these annexes, dated the day the Customer accepts the Terms |
Annex 2: Technical and organizational measures
- Encryption: Customer Data is encrypted in transit and at rest using industry-standard methods. Third-Party Credentials are additionally encrypted at the application level, with the key held in a secrets manager.
- Access control: access to Customer Data is limited by role to personnel who need it and is reviewed regularly. Integrations use read-only or restricted access where supported.
- Authentication: multi-factor authentication for staff access to production systems.
- Tenant isolation: logical separation of each Customer’s data.
- Logging and monitoring: administrative access to production systems is logged and monitored.
- Backups and resilience: Customer Data is backed up regularly, encrypted and stored within the selected hosting region.
- Secure development: changes are tested and scanned for vulnerable dependencies and secrets before release, and production is separated from development.
- Incident response: a documented process, with notification as in section 7.
- Personnel: confidentiality obligations and security training for staff with data access.
Annex 3: Sub-processors
The Customer’s authorized sub-processors are those listed in section 1 (“Sub-processors for Customer Data”) of Summerbase’s Sub-processors and service providers page, as updated under section 4.2. The page shows each sub-processor’s purpose and data location; transfer safeguards are set out in section 5.
Section 2 of that page lists other service providers that do not process Customer Data. They are not sub-processors under this DPA.
Annex 4: US state privacy laws
Where the CCPA or similar US state laws apply, Summerbase acts as a “service provider” or “processor”. Summerbase will not sell or share Customer Data, will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than providing the Service, and will not combine it with personal data from other sources except as those laws permit. Summerbase will notify the Customer if it can no longer meet these obligations.