Data Processing Agreement

1. Subject matter and duration

Claister processes personal data contained in Customer Data in order to provide the Claister service to the Customer. The processing lasts as long as the Customer uses the service and ends when the data is deleted under section 9. Annex 1 describes the processing.

Claister acts as a controller, not a processor, for account administration, sign-in security, billing, support and the public website. The privacy policy at claister.com/privacy covers that processing.

2. Instructions

Claister processes personal data only on the Customer's documented instructions. The Terms, this agreement and the Customer's use and settings of the service (including the people it invites, what it shares in the portal, the connections and AI features it turns on) are those instructions. Claister informs the Customer if, in its opinion, an instruction infringes data protection law, and may then suspend that instruction.

If EU or Member State law requires Claister to process personal data otherwise, Claister informs the Customer first unless that law prohibits it.

3. Confidentiality

Claister grants access to personal data only to staff and contractors who need it to operate and support the service, and they are bound by confidentiality. Claister staff do not open a Customer's records except to provide support the Customer requested, to investigate a security incident or fault, or where the law requires it.

4. Security

Claister takes the technical and organisational measures in Annex 2 to ensure a level of security appropriate to the risk, as Article 32 GDPR requires. It may update them as long as the overall level of protection does not decrease.

5. Sub-processors

The Customer gives Claister general authorisation to engage the sub-processors listed at claister.com/subprocessors. Claister gives each one data protection obligations no less protective than this agreement and remains responsible to the Customer for their performance.

Claister announces a new or replacement sub-processor at least 30 days in advance by updating the list and notifying workspace owners. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may end the agreement and receives a refund of any prepaid fees for the remaining period.

Some sub-processors are used only when the Customer turns on the feature that needs them, such as AI features or meeting recording. Services the Customer connects on its own (for example its email account or Telegram) are not Claister's sub-processors; the Customer engages them directly.

6. Transfers outside the EEA

Claister hosts the service, its databases and stored files in the European Union. Where a sub-processor processes personal data outside the European Economic Area, Claister relies on an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or the European Commission's standard contractual clauses, as shown for each sub-processor in the list.

7. Assistance to the Customer

Claister helps the Customer respond to requests from people exercising their rights (access, correction, erasure, restriction, portability and objection), mainly through features of the service: editing and deleting records, and exporting data. Where the Customer cannot do something itself, Claister helps on request within a reasonable time. If a person contacts Claister directly about Customer Data, Claister forwards the request to the Customer and does not answer it on the Customer's behalf unless instructed.

Claister also provides reasonable information and help for the Customer's security obligations, data protection impact assessments and consultations with a supervisory authority, taking into account the nature of the processing.

8. Personal data breaches

Claister notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice describes, as far as then known, what happened, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. Claister supplements it as more becomes known and takes reasonable steps to contain the breach. Notifying the supervisory authority and the people concerned remains the Customer's decision as controller.

9. Deletion and return

During the agreement the Customer can export its data and delete records itself. When the agreement ends, the Customer's data remains available for export for 30 days. Claister then deletes the workspace's personal data and stored files from the active service within a further 30 days, unless EU or Member State law requires it to keep them.

Copies in backups are not restored into the service and are deleted as the backups expire, within 90 days of deletion from the active service.

10. Information and audits

Claister makes available the information needed to demonstrate compliance with Article 28 GDPR, including this agreement, the sub-processor list and a description of its security measures, and answers reasonable questions from the Customer. The Customer, or an independent auditor bound by confidentiality, may audit Claister's compliance once a year, or after a personal data breach, with 30 days' notice, during business hours and without disrupting the service. Each party bears its own costs.

11. AI features

AI features send the model provider only the context needed for the request, filtered by the requesting person's access rights. Claister asks providers not to keep or use that content to train their models where the provider allows it (OpenAI requests are made with storage turned off). The Customer can turn AI off for the whole workspace or block categories of data in Settings, and can set a monthly spending limit. AI output is advisory: a person confirms before anything is sent, saved or changed.

12. General

If this agreement and the Terms conflict on the protection of personal data, this agreement prevails. The liability provisions of the Terms apply to this agreement, without limiting either party's liability to people under Article 82 GDPR. This agreement is governed by the law of the Republic of Lithuania.

Annex 1. Details of the processing

Nature and purpose: storing, organising, displaying, sharing, transmitting and deleting Customer Data so that the Customer can run its practice in Claister; delivering the messages and emails the Customer sends; and, if turned on, AI features, meeting recording and connections.

• People concerned: the Customer's team members; its clients and their representatives, employees and contacts; people the Customer corresponds with by email, Telegram or the portal; participants in recorded meetings; other people named in documents the Customer uploads.
• Personal data: names, contact details, job titles, identification and registration numbers, tax and accounting information, bank details, invoices and payments, documents and their contents, messages and email, voice notes and their transcripts, meeting recordings and transcripts, time entries, tasks and notes, and records of who did what in the workspace.
• Special categories: Claister is not designed for special category data. Documents the Customer uploads may nevertheless contain it (for example health information on a payroll document); the Customer decides whether to upload such data.
• Frequency: continuous, for as long as the Customer uses the service.

Annex 2. Technical and organisational measures

Claister maintains at least the following measures.

• Hosting, databases, file storage, virus scanning and backups in the European Union (Railway, EU West).
• Separation between firms enforced in the application and by row-level security in the database, so one firm's queries cannot read another's rows.
• Permissions per workspace role, client assignment and portal grant, checked on the server for every request; portal users see only what is shared with them.
• Encryption in transit (TLS) for all connections; mail and connector credentials sealed with a separate key.
• Passwords of at least 12 characters stored as hashes, optional two-factor authentication, and two-factor authentication required for sensitive integrations.
• Private file storage with no public links; every download re-checks access; uploads are checked for type and scanned for viruses.
• An audit trail of changes in the workspace, kept with the change itself.
• Daily database backups and point-in-time recovery, separate document backups, and a tested restore procedure.
• Access to production limited to the people who operate the service, with changes deployed only after automated checks pass.