Data Processing Agreement

1Who is who

You are the controller. The people in your resource pool are your employees and contractors; you decide what is recorded about them and why.

We are the processor. NMPV UG (haftungsbeschränkt), Katharinenstraße 15, 71634 Ludwigsburg, Germany. We process that data only to provide ResourcePlan to you.

Where we process data about your account holders for our own purposes — billing you, securing the service — we are a controller, and the privacy policy governs that instead.

2Subject matter, duration, nature and purpose

Subject matter: providing a hosted project portfolio and resource planning service.
Duration: for as long as your account exists, plus the deletion window in clause 8.
Nature and purpose: storage, organisation, retrieval and analysis of planning data so that you can plan projects, capacity and cost.

3Categories of data subject and personal data

Data subjects: your employees, contractors and other people you plan work against; the individuals you give logins to; the named contacts you record against clients and internal billing entities.

Categories of personal data, taken from what the product actually stores:

• Identity and role: name, work email, job title, department, location, manager, employment type
• Working arrangements: weekly hours, holiday calendar, absences (dates, not reasons)
• Cost and commercial: internal cost rate, charge-out rate, cost centre
• Capability: skills held and proficiency level
• Work: project allocations, recorded time, milestones owned, approvals and decisions taken
• Account: login identifiers, role in the organisation, authentication events

No special categories. ResourcePlan is not designed to hold Article 9 data — health, trade union membership, and the like. Absence records deliberately carry dates and a type, never a medical reason. Do not put special-category data into free-text fields; if you do, you are doing so outside the design of the product and outside this agreement.

4Our instructions are your instructions

We process personal data only on your documented instructions. Your use of the product, and these terms, are those instructions. We will tell you if we believe an instruction breaches data protection law.

If we are ever compelled by law to process or disclose your data, we will tell you first unless the law forbids it.

5Confidentiality

Everyone we allow near customer data is bound by a duty of confidentiality that survives the end of their engagement. Nobody has standing access: support access to a customer’s organisation is granted for a bounded time, requires a stated reason, and the grant itself is an audit record you can see.

6Security measures (Art. 32)

These are the measures actually implemented, not a wish list.

• Tenant isolation in the database. Every table carrying customer data is protected by row-level security, so one organisation cannot read another’s even if the application has a bug. An automated suite rebuilds the schema from scratch on every change and asserts isolation before anything ships.
• Access control by role. Cost and rate data is readable by admins and executives only. Roles are enforced in the database, not merely hidden in the interface.
• Authentication. Password, Google and Apple sign-in; optional multi-factor authentication which an organisation can require of everyone; SAML single sign-on and SCIM provisioning for organisations that want identity managed centrally.
• Encryption. All traffic over TLS. Data encrypted at rest by the hosting provider. Passwords and API keys are stored only as hashes.
• Audit trail. Decisions, approvals and delivery evidence can be added to but not silently rewritten. Sign-ins, permission changes and API key use are logged.
• Segregation of the AI features. The models used for the advisor and plan check are given no tools and no database access; they receive a snapshot and return text, and cannot act on your data.
• Retention hygiene. Notifications and the mail log are pruned automatically after twelve months.

7Sub-processors

You give general authorisation for the sub-processors below. We will give at least 30 days’ notice before adding or replacing one. If you object on reasonable data-protection grounds within that period and we cannot resolve it, you may terminate for the affected part of the service without penalty.

Sub-processors marked avoidable can be switched off for your organisation: the AI features do nothing unless someone runs them, transactional mail can go through your own SMTP server, and a plan settled by invoice never touches the payment provider. Transfers outside the EU rest on Standard Contractual Clauses.

8Deletion and return

You can export your organisation’s complete data at any time, without asking us. On termination we keep it for 30 days so you can retrieve it, then delete it from live systems; backups age out on their own cycle and are not restored selectively.

We keep only what law requires us to — invoices and the records around them — and those are kept as controller, not as processor.

9Helping you meet your own obligations

Data subject requests. The product lets you find, correct, export and delete an individual’s record yourself, which is the fastest route. If one of your people writes to us directly we will not act on it; we will tell them to ask you, and tell you it happened.

Breach notification. If we become aware of a personal data breach affecting your data we will notify you without undue delay and in any case within 48 hours, with what we know: what happened, which categories and roughly how many people are affected, the likely consequences, and what we are doing. We will keep you updated as we learn more rather than waiting for a complete picture.

Impact assessments. We will give you the information you reasonably need for a DPIA or a prior consultation, taking into account what we know about the processing.

10Audit

You may satisfy yourself that we comply. In the first instance we will answer a security questionnaire and provide the documentation we have. Beyond that you may audit, or appoint an independent auditor who is not our competitor, once in any twelve-month period, on 30 days’ notice, during business hours, without unreasonable disruption — and more often if there has been a breach affecting you or a supervisory authority requires it.

We do not hold a SOC 2 or ISO 27001 certificate and will not imply one. What we have is described on the security page, written as an engineering account rather than a marketing claim.

11Order of precedence

Where this agreement and the Terms of Service disagree about personal data, this agreement wins.