Data Processing Agreement

This Data Processing Agreement (“Agreement” or “DPA”) is entered into between:

• Data Controller: the business customer using Ardoca (for example an immigration, relocation, legal or HR firm) (“Customer” or “Controller”).
• Data Processor: Ardoca, a service operated by ezyClients OÜ (“ezyClients”, “we”, “us”), an Estonian private limited company, Narva mnt 7-652, Kesklinna linnaosa, 10117 Tallinn, Harju maakond, Estonia (“Processor”).

Contact for data protection matters: [email protected].

This Agreement supplements the Terms of Service and governs the processing of personal data on behalf of the Customer under Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”), in particular Article 28 GDPR. Terms not defined here have the meaning given in the GDPR or the Terms of Service. If this Agreement conflicts with the Terms of Service regarding the processing of personal data, this Agreement prevails.

1. Definitions

• Customer Personal Data: personal data that the Customer, its Authorised Users or its End Clients upload to or enter into Ardoca, and that ezyClients processes on behalf of the Customer.
• Authorised Users: the Customer’s staff and other persons the Customer authorises to use Ardoca.
• End Clients: the Customer’s own clients, who use the client portal.
• Personal Data Breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Sub-processor: a third party engaged by ezyClients to process Customer Personal Data.

2. Subject Matter and Duration

This Agreement governs ezyClients’ processing of Customer Personal Data on behalf of the Controller in connection with the Controller’s use of Ardoca (the dashboard at app.ardoca.com, the Customer’s subdomain {company}.ardoca.com and the client portal). The Agreement remains in force for the duration of the Customer’s subscription and thereafter until all Customer Personal Data has been deleted in accordance with Section 9.

3. Nature and Purpose of Processing

ezyClients processes Customer Personal Data solely to provide and support Ardoca for the Customer, including:

• collecting, storing and managing documents and form data from End Clients through the client portal;
• secure document handling, review and case tracking by Authorised Users;
• sending transactional e-mail notifications;
• hosting, backups, security, monitoring and support;
• where the Customer has switched them on, AI document checks (Section 4.3).

The nature of processing comprises collection, recording, organisation, storage, retrieval, consultation, transmission, restriction, erasure and destruction of data.

ezyClients processes Customer Personal Data only on the Customer’s documented instructions, does not process it for ezyClients’ own purposes and never uses it to train AI models.

4. Instructions

4.1 Documented instructions

The Controller’s documented instructions consist of this Agreement, the Terms of Service, and the Customer’s configuration and use of Ardoca (including settings chosen by its owners and admins). The Controller may give further reasonable written instructions to [email protected], provided they are consistent with the functionality of the service.

4.2 Unlawful instructions

ezyClients shall immediately inform the Controller if, in its opinion, an instruction infringes the GDPR or other EU or Member State data protection provisions. ezyClients may suspend execution of that instruction until it is confirmed or changed by the Controller.

4.3 AI document checks

AI document checks are off by default. Switching them on for an organisation by a Customer owner or admin is the Customer’s documented instruction to send the documents uploaded to that organisation, and the PDFs and checklists the Customer uses with AI help in the workflow builder, to Mistral AI SAS (processing in the EU) to read their text, check them and suggest values, as described in Ardoca. Mistral AI processes this data under zero data retention: nothing is kept after processing. Documents requested as criminal-record certificates are never sent to AI. A file uploaded where another type of document is requested is sent before its type is known, even if it turns out to be a criminal-record certificate. Customer Personal Data is never used to train AI models. Switching AI checks off stops any further sending to Mistral AI. The AI results stored in Ardoca for that organisation are deleted 30 days after AI checks are switched off, unless they are switched on again before then; values the Customer’s users have confirmed are kept.

4.4 Legal requirements

If ezyClients is required by EU or Member State law to process Customer Personal Data otherwise than on the Controller’s instructions, it shall inform the Controller of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

5. Types of Personal Data

The following categories of data may be processed, as determined by the Controller:

• names, contact details and signatures;
• identity and civil-status documents (for example passports, ID cards, birth and marriage certificates);
• financial documents (for example bank statements, tax and insurance details);
• employment and education documents and history;
• family information;
• legal and immigration information;
• answers to forms configured by the Customer;
• criminal-record certificates;
• account and usage data of Authorised Users and End Clients within the service (for example login and security logs);
• any other data uploaded by the Controller, its Authorised Users or its End Clients.

Special categories of personal data (Article 9 GDPR) are not requested by Ardoca as such, but may occur incidentally in documents uploaded by the Controller or its End Clients (for example health information in a medical certificate).

6. Categories of Data Subjects

• End Clients of the Controller (for example individuals applying for visas, residence permits, relocation or employment) and their family members, as applicable;
• Authorised Users of the Controller.

7. Obligations of the Processor

ezyClients shall:

• process Customer Personal Data only on documented instructions from the Controller (Section 4);
• ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
• implement appropriate technical and organisational measures in accordance with Article 32 GDPR, as described in Annex 1, and keep them up to date with the state of the art without reducing the overall level of protection;
• engage Sub-processors only under the conditions in Section 8;
• taking into account the nature of the processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from data subjects exercising their rights under Chapter III GDPR; if a data subject contacts ezyClients directly about Customer Personal Data, ezyClients will refer the request to the Controller without undue delay and will not respond itself unless instructed;
• assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security of processing, breach notification and communication, data protection impact assessments and prior consultation), taking into account the nature of processing and the information available to ezyClients;
• delete or return Customer Personal Data after the end of the provision of services as set out in Section 9;
• make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for and contribute to audits as set out in Section 11.

8. Sub-processors

8.1 General authorisation

The Controller gives ezyClients general written authorisation to engage Sub-processors. The current list of Sub-processors is published at /legal/subprocessors (Annex 2) and is authorised by the Controller.

8.2 Changes

ezyClients will inform the Controller in advance of any intended addition or replacement of a Sub-processor by e-mail to the Customer’s account owner and by updating /legal/subprocessors. The Controller may object to the change on reasonable data-protection grounds within 10 days of the notice by e-mail to [email protected]. The parties will discuss the objection in good faith to find a solution.

8.3 Sub-processor obligations

ezyClients shall impose on each Sub-processor, by contract, data protection obligations that offer at least the same level of protection as this Agreement, in particular sufficient guarantees to implement appropriate technical and organisational measures. ezyClients remains fully liable to the Controller for the performance of each Sub-processor’s obligations.

9. Data Retention and Deletion

• During the term, Customer Personal Data is retained until the Controller deletes it. The Controller can delete its data in Ardoca at any time and can export it: all of the organisation’s data at once (its owner downloads one ZIP file with the organisation’s details, members, clients and their profiles, workflows with their status history, form answers, documents including signed PDFs, and the audit log; the file is deleted 7 days after it is created, or at once when the organisation is deleted), client by client (documents as ZIP files, form answers as CSV files) or, where its plan includes API access, through the API. Deleting a client or an organisation deletes its stored files.
• After termination of the subscription, ezyClients keeps Customer Personal Data for 30 days so that the Controller can export it. On request during that period, ezyClients gives the Controller access to its account for that purpose.
• ezyClients then deletes all Customer Personal Data within 30 days.
• Backup copies expire no later than 30 days after deletion.
• On request, ezyClients will confirm the deletion in writing.
• Customer Personal Data may be kept longer only where EU or Member State law requires its storage.

10. Security and Personal Data Breaches

10.1 Security

ezyClients implements the technical and organisational measures described in Annex 1.

10.2 Breach notification

ezyClients shall notify the Controller without undue delay and in any event within 24 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will be sent to the Customer’s account owner and will include, as it becomes available, the information required by Article 33(3) GDPR: the nature of the breach including, where possible, the categories and approximate number of data subjects and records concerned; the name and contact details of the contact point at ezyClients; the likely consequences of the breach; and the measures taken or proposed to address it and mitigate its possible adverse effects. Where information cannot be provided at the same time, it will be provided in phases without undue further delay. ezyClients will take reasonable steps to contain and remedy the breach and will assist the Controller with its notifications to the supervisory authority and data subjects.

11. Audits and Information

ezyClients shall make available to the Controller, on request, all information necessary to demonstrate compliance with this Agreement and Article 28 GDPR, and shall allow for and contribute to audits, including inspections, conducted by the Controller or an independent auditor mandated by the Controller and bound by confidentiality. Audits require reasonable prior notice, shall take place during normal business hours and shall not unreasonably disrupt ezyClients’ operations or compromise the security or confidentiality of other customers’ data. One audit per calendar year is at ezyClients’ own cost; further audits are at the Controller’s cost, unless the audit follows a Personal Data Breach affecting Customer Personal Data.

12. International Transfers

All servers, the database, file storage and backups are located in the EU (Germany). Customer Personal Data is transferred outside the EU/EEA only where the requirements of Chapter V GDPR are met, including through Standard Contractual Clauses (SCCs) adopted by the European Commission and supplementary measures where needed. This applies in particular to network traffic passing Cloudflare’s global edge and to support e-mails handled in Google Workspace, as described in Annex 2.

13. Controller Responsibilities

The Controller:

• ensures it has a lawful basis for processing the personal data, including any special categories and criminal-record data;
• provides the necessary notices to data subjects, including naming Mistral AI as a recipient where it switches on AI document checks;
• responds to data subject requests;
• decides whether to switch on AI document checks;
• complies with applicable data protection laws.

14. Liability

Each party remains liable for breaches of this Agreement or the GDPR caused by its own acts or omissions. The limitations of liability in the Terms of Service apply to this Agreement, except where liability cannot be limited under the GDPR or other applicable law.

15. Termination

This Agreement ends with the Customer’s subscription. It remains in effect after termination until all Customer Personal Data is deleted or returned in accordance with Section 9.

16. Governing Law and Jurisdiction

This Agreement is governed by the laws of the Republic of Estonia. The courts of Estonia (Harju County Court) have jurisdiction, unless the parties agree otherwise in a signed order form.

17. Execution

The Customer accepts this Agreement when accepting the Terms of Service. A signed copy is available on request via [email protected].

Annex 1: Technical and Organisational Measures

Location and data residency

• All servers, the database, file storage and backups are in the EU (Germany).
• The application refuses to start if e-mail, analytics or AI endpoints are configured outside the EU.

Encryption

• Encryption in transit: HTTPS only, TLS 1.2 and 1.3; HSTS; Cloudflare-to-origin traffic validated (Full strict).
• Files and backups encrypted at rest (AES-256, Cloudflare R2).
• Two-factor secrets encrypted at application level (AES-256-GCM).

Storage and tenant isolation

• Private storage only: every file read or write uses a short-lived signed link (links to client documents expire after 5 minutes, upload links after 15 minutes, and links to the Customer’s own templates after 1 hour); no public buckets.
• Every record and file is scoped to the Customer’s organisation and checked on every request.
• Deleting a client or an organisation deletes its stored files.

Access control and authentication

• Passwords hashed with bcrypt.
• Optional TOTP two-factor authentication for all users.
• Sessions expire after 1 hour and can be revoked.
• Role-based access control inside each organisation (owner, admin, member, HR, client).
• Operator access: SSH key-only, restricted by firewall to known networks; administration panels behind 2FA and IP allow-lists.

Logging and monitoring

• Every request is logged with user, role and organisation identifiers but without personal data.
• An audit log records sign-ins, sign-outs and failed sign-ins of all users, every document downloaded in the web application or through the API, administrative changes (members, settings, AI switch, API key, data exports) and administrator impersonation. The Customer’s owners and admins can view and filter it; entries hold identifiers only and are deleted after 12 months.
• External availability probes every 5 minutes and host health checks every 15 minutes, with automatic alerts.

Availability and resilience

• Complete backup sets twice a day, stored in a separate EU bucket, immutable for 14 days and deleted after 30 days.
• Restore procedure documented and tested on synthetic data.

Vulnerability and incident management

• Dependencies scanned for known vulnerabilities on every build.
• Documented incident response procedure.

Annex 2: Sub-processors

The authorised Sub-processors, their purposes and locations are listed at /legal/subprocessors. Changes follow Section 8.2.