Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer using Groundstop ("Controller") and Begoña Prats Escobar, sole trader (empresaria individual), NIF 43117147J, C/ Lepant 270, bajos, 08013 Barcelona, Spain ("Processor"). The Controller accepts this DPA by creating an account and using the service. Version 2026-10-13.

1. Subject matter and duration

The Processor processes personal data contained in event payloads sent by the Controller's automations in order to provide the Groundstop service. Processing lasts for the term of the Controller's account and ends with the deletion described in section 9.

2. Nature and purpose

Receiving, redacting, storing, displaying and deleting event logs; evaluating the Controller's rules and pre-action checks; sending alerts to channels configured by the Controller; and, only if the Controller adds its own API key, sending event data to the AI provider chosen by the Controller to produce summaries, answers and reports.

3. Types of personal data and data subjects

• Data subjects: the Controller's customers, contacts, employees and other persons referenced in automated actions.
• Data types: identifiers and contact data (names, email addresses, phone numbers — redacted by default), order and transaction references, amounts, and other operational details the Controller chooses to send.
• Special categories (art. 9 GDPR) and criminal-offence data must not be sent. The Controller is responsible for complying with this restriction.

4. Processor obligations

• Process personal data only on the Controller's documented instructions, which consist of this DPA, the Terms and the settings configured in the app, unless required by EU or Member State law (in which case the Processor will inform the Controller unless prohibited).
• Ensure that persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational measures under art. 32 GDPR, described on the Security page.
• Assist the Controller, by appropriate measures, in responding to data subject requests (export and deletion tools are provided in the app).
• Assist the Controller with its obligations under arts. 32–36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the nature of processing.
• Notify the Controller of a personal data breach without undue delay after becoming aware of it, with the information available at the time.
• Inform the Controller if, in its opinion, an instruction infringes data protection law.

5. Subprocessors

The Controller grants general authorisation for the Processor to engage the subprocessors listed on the Subprocessors page. The Processor will give notice of any intended addition or replacement by updating that page and notifying the Controller by email at least 15 days in advance; the Controller may object on reasonable grounds and, if no solution is found, terminate the service. The Processor imposes on each subprocessor data protection obligations equivalent to this DPA and remains liable for their performance. Services the Controller connects with its own account (notification channels, AI providers) are not subprocessors of the Processor: they act under the Controller's own agreement with them.

6. International transfers

Event data is stored in the European Union. Where a subprocessor transfers or accesses personal data outside the EEA, the transfer is covered by an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or by the European Commission's Standard Contractual Clauses, with supplementary measures where needed.

7. Audits and information

The Processor will make available all information necessary to demonstrate compliance with art. 28 GDPR and allow for and contribute to audits, including inspections, by the Controller or an auditor it mandates, with reasonable prior notice, limited to once per year unless required by a supervisory authority or following a breach.

8. Controller obligations

The Controller ensures it has a lawful basis for the data it sends, informs data subjects as required, and sends only the data needed for monitoring its automations.

9. Deletion and return

Event data is deleted automatically according to the retention period selected by the Controller. At the end of the service, or when the Controller deletes its account, all personal data is deleted immediately; the Controller can export its data beforehand from Settings. Residual copies in provider backups are overwritten in their normal rotation cycle.

10. Contact

Data protection questions: hola@groundstop.eu.