Who controls what, who processes what, where it lives, and how rights get honored — the complete data-protection picture for Epafi workspaces, with the DPA machinery summarized in plain terms.
For workspace data — the contact records you import — you are the controller and Epafi is the processor. We act only on your documented instructions: the features you use and the settings you choose are the instructions.
For account and billing data — your name, email, payment details — Epafi is the controller, and our Privacy Policy governs that processing directly.
Every paid workspace is covered by our DPA, which incorporates these page commitments by reference and adds the Article 28 machinery: confidentiality, audit rights, assistance obligations, and deletion-on-termination.
Workspace data is stored and processed in the EU. Two enrichment providers receive the specific identifiers you submit for enrichment; all other processing stays inside the EU hosting region.
| Processor | Role | Transfer mechanism | Location |
|---|---|---|---|
| Amazon Web Services EMEA | Hosting, storage, backups | EU region — no transfer | EU (Frankfurt) |
| Clearbit | Enrichment provider | EU–US Data Privacy Framework | US |
| FullContact | Enrichment provider | EU–US Data Privacy Framework | US |
| Clerk | Authentication | SCCs + DPF | US |
| Stripe | Billing | EU–US Data Privacy Framework | US |
Where data leaves the EEA, transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses (2021/914), with supplementary measures documented in the DPA.
As controller, you own the lawful basis for the contacts you import. In practice:
We build the tools; the compliance posture of your list is yours. We will help — support can walk any workspace through a rights-request workflow.
How Epafi helps you answer your contacts when they exercise rights:
| Right | How you honor it in Epafi |
|---|---|
| Access (Art. 15) | Record-level JSON/CSV export from any contact profile |
| Rectification (Art. 16) | Direct editing with full audit trail |
| Erasure (Art. 17) | Hard delete — gone from production instantly, backups within 30 days |
| Restriction (Art. 18) | Record freeze flag blocks enrichment, merges, and exports |
| Objection (Art. 21) | Suppression list — matching ignores flagged records |
| Portability (Art. 20) | Structured JSON export per record, API-addressable |
Data protection contact: dpo@epafi.app. For DPA execution, breach inquiries, or records of processing, this is the address — monitored daily, answered within two business days.
Epafi is established in Greece; our lead supervisory authority is the Hellenic Data Protection Authority (dpa.gr). Data subjects may also complain to their own local authority.
Questions about this document? legal@epafi.app — we answer legal mail within two business days.