Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the OIO Terms of Service. It applies whenever you use OIO to process personal data of other people (your clients, their contacts, your team, people who fill in your forms) and the GDPR, the UK GDPR or a similar law applies to that processing. You do not need to sign anything: accepting the Terms accepts this DPA. If your organisation needs a signed copy, write to [email protected] and we will send one with the same text.

1. Parties and roles

• You, the customer who holds the OIO account ("Customer"), are the controller of the personal data you put into the Service.
• Damian Mathew Bishop, ul. Wierzbięcice 44a/40A, 61-568 Poznań, Poland, NIP 7773472578, trading as OIO ("OIO", "we"), is your processor.
• If you are yourself a processor for someone else, we are your sub-processor and you pass on their instructions to us.

Data we process for our own purposes (your account, billing, security, our own measurement) is covered by our Privacy Policy, not by this DPA.

2. What we process for you

• Subject matter and purpose: hosting and processing your workspace data so the Service works as described in the Terms: storing, showing, sharing, sending, exporting, transcribing and running AI features on it when you use them.
• Duration: as long as you use the Service, then as in section 9.
• Nature: storage, retrieval, organisation, transmission, AI and speech-to-text processing, deletion.
• People concerned: your clients and their staff, prospects and form respondents, people you send documents to for signature, team members and collaborators, and anyone else you record in OIO.
• Data types: names, contact details, company and tax details, project and financial data, invoices, messages, notes, files, audio and video recordings and their transcripts, electronic signatures (signature and initials images) with their audit trail (IP address, browser, times, consent to sign electronically), and anything else you upload.
• Special category data: OIO is not built for it. Do not upload health, biometric or similar data unless you have a legal basis and have checked that our safeguards are enough for it.

3. Your instructions

We process the data only on your documented instructions. The Terms, this DPA and the way you use the Service (what you create, share, send, delete) are those instructions. If an instruction breaks data protection law in our view, we tell you. If EU or Polish law makes us process data in another way, we tell you first unless that law forbids it.

4. Confidentiality

Only the operator of OIO has access to customer data, and only when needed to run the Service, fix a problem you reported or meet a legal duty. Anyone who helps us with that is bound to confidentiality.

5. Security

We keep appropriate technical and organisational measures under Art. 32 GDPR, including:

• encryption in transit (TLS) and at rest at our infrastructure providers;
• row-level access rules in the database, so each account only reaches its own data and what was shared with it;
• private file storage with short-lived signed links;
• optional two-factor sign-in, rate limits, bot checks and a strict content security policy;
• daily database backups;
• least-privilege access to infrastructure;
• dependency updates and security reviews of changes.

More detail is on our Security page. We may improve these measures but will not lower the overall level of protection.

6. Helping you

• Requests from people: most requests (access, correction, deletion, export) you can handle yourself in the app. If you need more, we help. If a request reaches us directly, we pass it to you and do not answer it ourselves unless you ask us to.
• Breaches: if we become aware of a personal data breach affecting your data, we tell you without undue delay, and in any case within 48 hours, with what we know and what we are doing. We keep you updated.
• Assessments: we give you the information you reasonably need for a data protection impact assessment or a consultation with an authority about the Service.

7. Sub-processors

You give us general authorisation to use the sub-processors in the list below. Each is bound by a written contract with data protection obligations no weaker than this DPA. We stay responsible to you for their work.

Changes. We announce a new or replaced sub-processor by email to account owners and on this page at least 30 days before it starts processing your data. You can object in that time by writing to [email protected] with a reasonable data protection reason. If we cannot solve it, you can end your subscription before the change applies and we refund what you prepaid for the time after it. In an emergency (a provider failing or becoming unsafe) we may switch sooner and tell you as soon as we can.

Integrations you switch on. Some features send data to a third party only when you or your team choose to use them: Telegram (reminder messages, if you connect it), Google Calendar (your OIO dates, if you connect it), KLIPY (GIF search words, a one-way pseudonymous id and, when a GIF is shown, the viewer's IP address), and AI tools you connect to OIO yourself (MCP). These services act under their own terms and privacy policies, not as our sub-processors under a contract like this DPA. Don't switch them on for data you must keep inside a processor contract.

8. Transfers outside the EEA

Where a sub-processor outside the EEA receives your data, we use the EU-US Data Privacy Framework where the provider is certified, and otherwise the EU Standard Contractual Clauses (Module 3, processor to sub-processor) with the UK Addendum where UK data is involved.

Until 5 October 2026 the assistant also sent some text requests to DeepSeek in China. That route is removed. No customer data goes to China any more.

9. End of the service

• Before you close your account you can export your data from Settings at any time.
• When you delete your account, we delete your data, with backups rolling off within 30 days.
• Issued invoices. You instruct us to keep the invoices you issued through OIO after you delete your account, as your tax archive, for 10 years from the end of the year of issue, closed to every user, and to give a copy to you or a tax authority on request. You can withdraw this instruction at any time by writing to us, and we then delete them.
• If we end the Service or your account (Terms section 13), you get at least 30 days to export first, unless the law or a serious breach prevents it.

10. Showing that we comply

We give you the information you reasonably need to check that we meet this DPA, in writing, on request. If that is not enough, you or an auditor bound to confidentiality can audit us once a year, at your cost, with 30 days' notice, in a way that does not expose other customers' data. We keep internal records of our processing as Art. 30 GDPR requires.

11. Everything else

• Liability under this DPA follows the Terms, except where the GDPR does not allow a limit.
• If this DPA and the Terms conflict on data protection, this DPA wins. If the Standard Contractual Clauses apply and conflict with either, the Clauses win.
• Polish law governs this DPA, as in the Terms.
• We may update this DPA for changes in law or in the Service, with the same notice as for the Terms, but never to lower the protection of your data without your agreement.

Contact

[email protected]