Processor terms,not a sales call.

The processor under this DPA is Entro314 Labs ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (Entro314 Labs Single Member P.C.), G.E.MI. 193782603000, which operates Epafi; its registered address is on the Legal Notice. The customer named on the account is the controller.

This DPA is incorporated into the Terms of Service by reference. If you have an Epafi account, it is already in force between us — you do not need to request it, negotiate it, or sit through a call to get a copy.

If your procurement process requires a countersigned document, email dpa@epafi.app with your legal entity name and registered address and we will return an executed copy of these exact terms. We do not have a second, better DPA reserved for larger customers.

The line between what you control and what we control matters more than any other clause here, so it is drawn first:

As controller for contact data you are responsible for having a lawful basis to process it, for informing data subjects where required, and for the accuracy of what you import. Our GDPR page sets out how the product helps you meet those duties.

We process contact data only to provide the service as documented, and only on your instructions. Your instructions are: this DPA, the Terms of Service, the documented behaviour of the application and API, and anything you configure in your account.

We will tell you if an instruction appears to breach data protection law rather than quietly carrying it out. Where a legal obligation compels us to process beyond your instructions, we notify you first unless the law forbids it.

The subject matter is contact data management; the duration is the term of your subscription plus the retention windows in the Privacy Policy; the nature and purpose are storage, deduplication, matching, enrichment, import, export, and search; the categories of data subject are the people whose records you choose to import.

Everyone with access to customer data is bound by confidentiality obligations that survive the end of their engagement. Access is granted on a need-to-know basis and removed when the need ends.

The technical and organisational measures required by Article 32 are described in detail on the Security page, which forms part of this DPA. In summary:

• +API keys are stored only as a SHA-256 hash; the plaintext is shown once, at creation or rotation.
• +Scheduled-export destination credentials are encrypted at the application layer with the configured encryption key.
• +API keys can be restricted by scope, expiry, rate, and source IP.
• +Account isolation is enforced by ownership filters plus database tenant-reference constraints, so a query cannot cross an account boundary.
• +Merges store the snapshot needed to reverse them, so a processing decision remains auditable and undoable.
• +CI runs formatting, linting, type checks, migrations, schema-drift checks, and the test suite before anything ships.

You give general authorisation for us to engage sub-processors. The current list is published at /subprocessors and is part of this DPA.

We give thirty days’ notice before a new sub-processor begins processing, and you may object on reasonable data-protection grounds within that period. Each sub-processor is bound by written terms no less protective than these, and we remain liable to you for their performance.

Contact data is stored on Hetzner infrastructure in the region set by the deployment configuration. Two sub-processors involve processing outside the EEA regardless of that setting: Clerk, which operates in the United States, and Vercel, whose edge network is global. Clerk’s processing is limited to authentication and session data; contact records are never sent to it.

Transfers outside the EEA rely on the Standard Contractual Clauses together with a transfer impact assessment, or on an adequacy decision where one covers the recipient country. Epafi is pre-launch: the executed transfer terms and the contracted region for each provider are confirmed and published on the sub-processor page before the service accepts a paying customer. We mark that status rather than assume it.

Most of the assistance you need is built into the product rather than routed through a support ticket: export in CSV, JSON, or vCard; correction through the UI or API; permanent deletion of individual records; and a full account-level export.

If a data subject contacts us directly about your records, we do not answer on your behalf. We forward the request to you and tell them we have done so. Where the product cannot satisfy a request on its own — a restriction or suppression workflow, for instance — we assist by operational means and say so honestly rather than claiming a feature that does not exist.

We also assist with your obligations under Articles 32 to 36: security measures, breach notification, data protection impact assessments, and prior consultation, taking into account the nature of processing and the information available to us.

We notify you without undue delay after becoming aware of a personal data breach affecting your data, as Article 33(2) requires. The notice describes what happened, the categories and approximate volume of data involved, the likely consequences, and the measures taken or proposed — enough for you to meet your own 72-hour deadline to your supervisory authority. We will not sit on an incident while we decide how it looks.

As the Security page states, the production incident runbook and named responders are established before launch rather than versioned in the application today. We would rather tell you that than quote a response time this DPA cannot yet stand behind.

We make available the information necessary to demonstrate compliance with Article 28. In the first instance this means the Security page, this DPA, the sub-processor list, and written answers to your security questionnaire. Where that is genuinely insufficient, you may audit once per year on thirty days’ notice, at your cost, under confidentiality, and without disrupting other customers’ service.