Data Processing Agreement

Version 1 · in force from [date of publication]

In short

Your company decides what goes into PlanPicPro and why. We process it only to run PlanPicPro for you.
It's hosted in Germany. Every other service that handles it is on the sub-processor list, and we email your managers before we add one.
If a breach affects your data, we tell you without undue delay.
When you leave, you can have a copy of everything. Then we delete it.

1. Who and what this covers

1.1 This agreement is between the company registered in PlanPicPro ("the Customer", "you"), as controller, and RM DMS Hungary Kft. ("we", "us"), as processor. It covers the personal data we process for the Customer in PlanPicPro ("Customer Personal Data"), that is, in the mobile app, the web portal at planpicpro.com and the servers behind them. Annex 1 describes that data and the processing.

1.2 It forms part of the Terms of Service. The manager who registers the company in PlanPicPro accepts it on the Customer's behalf and confirms that they may do so. It applies from then until we no longer hold any Customer Personal Data. Where it conflicts with the Terms on how personal data is handled, this agreement prevails.

1.3 "Personal data", "processing", "controller", "processor", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the GDPR (Regulation (EU) 2016/679). Where the UK GDPR applies to the Customer, references to the GDPR include the UK GDPR, and to supervisory authorities the UK Information Commissioner.

1.4 We are a controller ourselves, not your processor, for user accounts and sign-in, billing, our security logs (including a log of deletions and membership changes), support emails and our website. The Privacy notice covers those. A user's membership of the Customer's company, their role, and what they create, change and delete in its projects are Customer Personal Data.

2. Processing only on your instructions

2.1 We process Customer Personal Data only on the Customer's documented instructions, including as regards transfers outside the EEA, unless EU or Hungarian law requires us to do otherwise. In that case we tell the Customer before we process, unless that law forbids it.

2.2 The Customer's instructions are: the Terms and this agreement; what its users do in PlanPicPro (creating, sharing, changing and deleting projects and their contents, inviting and removing members); and written instructions from one of its managers sent by email to support@planpicpro.com. We confirm instructions we receive by email.

2.3 If we believe an instruction infringes data protection law, we tell the Customer at once, and may hold off carrying it out until the Customer confirms or changes it.

2.4 We keep the Customer's written instructions for as long as they apply and for three full calendar years after that.

2.5 We use Customer Personal Data only to provide PlanPicPro to the Customer, to keep it secure and working, and to support the Customer. We don't use it for our own purposes, for advertising or profiling, or to train AI models, and we don't sell it.

3. Confidentiality and our access

3.1 Everyone we authorise to process Customer Personal Data is bound to confidentiality, by contract or by law.

3.2 The staff who run PlanPicPro have administrator access to its server and database, which they need to operate, maintain and repair it. They look at Customer Personal Data only when that is necessary: to deal with an incident, to carry out the Customer's instructions (for example a support request, an export or an erasure), or where the law requires it. Administrator accounts inside PlanPicPro itself see licensing information only (company names, seats, expiry dates and project counts), not survey content, with one exception: to give a copy the Customer or a user has asked for (clause 11.2, or a data subject's request), once we have checked who is asking, an administrator can export that company's data or that user's account. This needs two-step verification and a fresh sign-in, is logged, and the Customer's managers (or the user) are emailed each time.

4. Security

4.1 We take the technical and organisational measures in Annex 2, which meet Article 32 GDPR. We may change them, provided the overall level of protection doesn't go down.

4.2 The Customer is responsible for using PlanPicPro securely, as clause 10 describes.

5. Sub-processors

5.1 The Customer gives us general written authorisation to engage sub-processors. The current ones are on the sub-processor list at planpicpro.com/subprocessors.html, which forms part of this agreement.

5.2 We bind each sub-processor by contract to data protection obligations that give at least the protection this agreement and Article 28 GDPR require. We remain fully liable to the Customer for how our sub-processors meet those obligations.

5.3 Before a new or replacement sub-processor starts processing Customer Personal Data, we update the list and email the Customer's managers:

for a change we make, at least 14 days before it takes effect;
for a change made by one of our sub-processors (for example, our hosting provider engaging a new supplier), within 3 calendar days after that sub-processor tells us.

5.4 The Customer may object to the change on objective grounds relating to data protection, by email to support@planpicpro.com within 7 calendar days after our email, giving its reasons. We then look for a solution with the Customer. Where the change was made by one of our sub-processors, we raise the objection with that sub-processor. If the change goes ahead nonetheless, the Customer may end its subscription and close its company with effect from the date of the change, and we refund the fees paid for any period after that date.

5.5 Suppliers of pure infrastructure, telecommunications and similar ancillary services (such as network carriers, data-centre premises, power and hardware maintenance) are not sub-processors for this agreement, and we don't give notice of them.

6. Transfers outside the EEA

6.1 We store and process Customer Personal Data in the EU/EEA. PlanPicPro's server is in a data centre in Nuremberg, Germany.

6.2 We transfer Customer Personal Data to a country outside the EEA only through a sub-processor the sub-processor list shows there, after notice under clause 5, and only with a safeguard under Chapter V GDPR: an adequacy decision, or the European Commission's standard contractual clauses.

7. Helping the Customer

7.1 The Customer's managers can handle most requests from data subjects themselves in PlanPicPro: they can see, correct, share and delete projects, plans, pins, notes and photos, and remove members. Where that isn't enough, we help with appropriate technical and organisational measures, for example by exporting data or permanently erasing deleted items on the Customer's instruction.

7.2 If a data subject asks us about Customer Personal Data, we pass the request on to the Customer without undue delay and don't answer it ourselves, except to say that we have passed it on, unless the Customer instructs us otherwise.

7.3 Taking into account the nature of the processing and the information available to us, we help the Customer meet its obligations under Articles 32 to 36 GDPR: security, notifying personal data breaches, data protection impact assessments and prior consultation.

7.4 We make available to the Customer the information needed to show that we meet Article 28 GDPR, as clause 9 describes.

8. Personal data breaches

8.1 We notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by email to its managers.

8.2 The notice says, as far as we know at the time: what happened; the categories and approximate number of data subjects and records concerned; the likely consequences; what we have done and propose to do; and whom to contact. We don't hold the notice back until we know everything: we send what we know, and follow up as we learn more.

8.3 We take reasonable steps to contain the breach and limit its effects, and record it. Deciding whether to notify a supervisory authority or the data subjects is the Customer's responsibility as controller; we help it with both.

8.4 Notifying a breach is not an admission of fault or liability.

9. Audits and inspections

9.1 We give the Customer the information it needs to check that we meet this agreement: this agreement and its annexes, the sub-processor list, answers to reasonable written questions and, where available, certificates and audit reports, including our hosting provider's. The Customer relies on these first.

9.2 If they aren't sufficient, or a supervisory authority requires it, the Customer may inspect our processing itself or through an auditor it appoints:

with at least 30 days' written notice, saying what it will inspect;
during business hours, without unreasonably disrupting our operations or putting other customers' data at risk; we don't give access to other customers' data;
by people bound to confidentiality who don't work for a competitor of ours or of the sub-processor concerned;
at most once in any 12 months, unless a personal data breach has affected Customer Personal Data or a supervisory authority requires it.

9.3 A sub-processor's premises and systems can be inspected only through that sub-processor's own audit arrangements and on the conditions it sets, which we pass on to the Customer.

9.4 The Customer bears the costs of an inspection, including those our sub-processors charge us for it, unless the inspection shows a material breach of this agreement by us or a sub-processor. In that case we bear them.

9.5 We tell the Customer at once if we believe an instruction given during an audit infringes data protection law.

10. The Customer's responsibilities

10.1 As controller, the Customer is responsible for the lawfulness of the processing: in particular for having a legal basis for the personal data its users put into PlanPicPro, such as photographs of and notes about owners, occupants and other people at survey sites, and for giving those people the information the law requires.

10.2 PlanPicPro isn't designed for, and the Customer won't use it to record: special categories of personal data (Article 9 GDPR, for example health, religion or ethnic origin); personal data about criminal convictions and offences (Article 10 GDPR); dates of birth; identity document or national identification numbers; or bank and payment card details. Users should take photos so that they don't show such information, or people, where that isn't needed for the survey.

10.3 The app keeps the Customer's surveys on the device so that users can work offline. Signing out deletes them from the device; a session ended from elsewhere hides them until the same user signs in again, and another account signing in deletes them. The app leaves them out of the device's own backups (iCloud, Google). The Customer is responsible for securing the devices its users work on: a screen lock, the device's encryption, and removing the app before a device changes hands.

10.4 The Customer manages its users: whom it invites and with which role, and removing people who leave, which ends their access at once. We recommend that its managers turn on two-step verification. PDF reports exported from PlanPicPro leave our systems; the Customer controls where they go.

11. Deletion and return of data

11.1 While the contract runs, the Customer's users delete data in PlanPicPro themselves. Deleted items are hidden from every user straight away (on devices, once they next sync). We keep them for 30 days, so that every device learns of the deletion, and then erase them permanently, with their files. At the end of the contract we erase everything (clause 11.3).

11.2 The contract ends when the Customer's company is closed, at a manager's request to support@planpicpro.com, by a manager on the portal's Company page (which ends every user's access at once), or under the Terms. On a request made before the company is closed, or within 30 days after, we give the Customer a copy of its Customer Personal Data: the records of its projects, plans, pins and notes in a common format (JSON or CSV), and the original plan and photo files.

11.3 We then delete all Customer Personal Data, at the latest 30 days after the company is closed or after we deliver the copy, whichever is later, unless EU or Hungarian law requires us to keep it. Copies in backups are deleted as those backups expire, at the latest 30 days after that. On request, we confirm the deletion in writing.

11.4 Closing a company doesn't delete its members' accounts: a user may belong to other companies. The Privacy notice covers accounts.

12. Liability

12.1 Each party is liable to data subjects as Article 82 GDPR provides.

12.2 Between the parties, the limitations of liability in the Terms of Service apply to claims under this agreement, as far as the law allows.

12.3 The Customer indemnifies us against claims, costs and, where the law allows, fines arising from personal data it puts into PlanPicPro without a legal basis, from its instructions that infringe data protection law, or from its breach of this agreement.

13. Term, changes and law

13.1 This agreement lasts for as long as we process Customer Personal Data, including the return and deletion periods in clause 11.

13.2 We may change this agreement in the way clause 12 of the Terms describes: by email to the Customer's managers at least 30 days before the change takes effect, unless the law requires a change sooner. Changes of sub-processor follow clause 5 instead.

13.3 Hungarian law governs this agreement, and the courts named in the Terms decide disputes about it. Nothing in it limits the rights of data subjects or the powers of a supervisory authority.

Annex 1: Description of the processing

Subject matter and nature	Hosting PlanPicPro for the Customer: storing its survey data, synchronising it between devices and the web portal, showing it to the Customer's users according to their roles and shares, exporting and erasing it, and sending the invitations its managers send.
Purpose	Providing PlanPicPro to the Customer under the Terms of Service.
Duration	As long as the Customer's company exists in PlanPicPro, then the return and deletion periods in clause 11.
Data subjects	The Customer's users: its managers and surveyors, whether employees or contractors. People the Customer invites to join its company. People who appear in the Customer's surveys: property owners, occupants and tenants, neighbours, the Customer's clients and their staff, people working on site, and anyone visible in a photo or named in a note.
Personal data	Users and invitees: name, email address, role in the company, the projects shared with them; which user created, changed or deleted each item, and when; invitations (email address, role, who invited, when). Survey content: project names and site addresses; floor plans, which can show names and addresses in their title blocks; pins and free-text notes; photos of sites, buildings and rooms and of whatever and whoever is visible in them; when each photo was taken and, for photos taken with the app's camera, where (the phone's GPS position and its accuracy at that moment, if the user allows it), and when our server received it.
Special categories	None (clause 10.2).
Where	On our server in Nuremberg, Germany (EU). Invitation emails pass through our email provider (see the sub-processor list).
Retention	Until 30 days after the Customer's users delete it, or after the company is closed (clause 11).

Annex 2: Technical and organisational measures

Encryption

Every connection between the app or a browser and our server uses HTTPS (TLS), with HSTS on the web. Emails leave our server for the email provider over TLS.
Passwords are stored only as salted one-way hashes (bcrypt). Codes sent by email work once, for one hour.
Access tokens expire after one hour. The app keeps its sign-in tokens in the device's secure storage (Keychain on iOS, Keystore on Android).

Access control

Each company's data is separated inside the database itself (PostgreSQL row-level security), for every table and every file, not only in the app's screens. Managers see their company's projects; surveyors see the projects they created and those a manager has shared with them.
Sign-in: passwords of at least 10 characters, checked against known data breaches; limits per IP address on sign-in, sign-up, code and password-reset requests; optional two-step verification with an authenticator app, which the database enforces on every request once it is on.
Every access to a company's data is checked against a live session: signing out, "sign out everywhere", a password change or reset, and removal from a company take effect immediately, not when a token expires.
Emails carry codes to type in, never links that sign anyone in. Changing the sign-in email needs a code from both the old and the new address; users get an email when their password, email or two-step verification changes.
Membership changes go only through checked server functions, and a company always keeps at least one manager. Co-members see each other's name and email address only.
Uploads must be JPEG or PNG images within size limits, are served with headers that stop them running as web pages, and can't be shared by public link.
The web portal sends a strict Content Security Policy and refuses to be framed by other sites.
Each server component has its own database role with the least privileges it needs. The database, the internal services and the administration tools can't be reached from the internet; the server's firewall admits only SSH, HTTP (redirected to HTTPS) and HTTPS. Only named staff administer the server, over SSH [with keys, not passwords: confirm].
The server is in our hosting provider's data centre in Nuremberg, whose physical security is covered by the provider's ISO/IEC 27001 certification.

Integrity and logging

A row's company, parent and creator can't be changed through the API, and devices can't date changes into the future.
Access logs (IP address, time, request and result; sign-in tokens and cookies removed): 30 days. A sign-in log and a log of deletions, restores, unshares, member removals, role changes and cancelled invitations: one year. Only our administrators can read them.

Availability and resilience

[Backups: describe the nightly off-box backups once they exist (security review G8): what is backed up, where (EU/EEA, another provider), how it is encrypted, how long it is kept (at most 30 days, clause 11.3), and the last restore test.]
The app works fully offline: if the server can't be reached, surveys stay on the device and sync later.
Every server component runs a pinned version. We apply security releases, and check for them at least monthly, testing each update on a separate test system before it reaches the live server.

Testing and organisation

An automated test suite checks the database's access rules, across companies and roles, on every schema change. Security reviews: October 2026.
Staff are bound to confidentiality. Test systems hold test data only: Customer Personal Data is never copied to them.
No analytics, advertising or tracking in the app or the portal. Plans, photos and notes aren't used for anything but the Customer's own use of PlanPicPro.
We keep records of processing (Article 30 GDPR), a register of sub-processors, and the breach procedure in clause 8.