Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Jolo Vita (KvK: 87189437), operating as Bulk Contact Manager ("Processor"), and the user of the Service ("Controller").

1. Subject Matter and Nature of Processing

The Processor provides a third-party software application that integrates with the Controller's Xero account. To provide filtering, bulk-editing, and anonymization features, the Processor will temporarily cache and process personal data stored in the Controller's Xero environment.

2. Roles of the Parties

Under the EU General Data Protection Regulation (GDPR), the Controller is the owner and "Data Controller" of the Xero contacts. The Processor acts exclusively as the "Data Processor" and will only process this data based on the Controller's documented instructions (i.e., the user's interactions with the Bulk Contact Manager application).

3. Obligations of the Processor

To ensure the safety of the Controller's data, the Processor agrees to:

• Confidentiality: Ensure that all persons authorized to process the personal data have committed themselves to strict confidentiality.
• Security: Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk (detailed in Annex 2).
• Data Subject Rights: Assist the Controller, insofar as possible, in fulfilling their obligation to respond to requests from individuals exercising their GDPR rights (e.g., Right to be Forgotten). Because the Processor's tool is explicitly designed to assist with data anonymization, the Controller can execute these requests directly within the application.
• Personal Data Breaches: Notify the Controller without undue delay, and in any event within forty-eight (48) hours, after becoming aware of a personal data breach affecting the Controller's data. The first notification states what is known at that point and who to contact. The Processor provides updates as its investigation progresses and a written summary within five (5) working days of becoming aware of the breach. Notifications are sent from privacy@bulkcontactmanager.com to the email address of each account with access to the affected Xero organization.

4. Sub-processors

The Controller grants the Processor general authorization to engage sub-processors to deliver the Service. The Processor remains fully liable for the acts of its sub-processors. The current list of authorized sub-processors is:

• Hetzner Online GmbH (Germany): Cloud server hosting and database infrastructure.
• Scaleway SAS (France): Encrypted off-site storage of database backups. Backups are encrypted (AES-256) on the Processor's own infrastructure before upload; Scaleway holds no decryption keys and cannot access the data.
• Proton AG (Switzerland): Inbound email handling for support, privacy, and legal addresses. Switzerland is recognized as an adequate country under the GDPR.
• Resend, Inc. (data processing region: Ireland, EU): Transactional email delivery for marketing-site forms. Resend, Inc. is incorporated in the United States; outbound email content is processed and stored in the EU. Any residual transfers outside the EEA (e.g., parent-company support access) are governed by Standard Contractual Clauses.
• Stripe Payments Europe, Ltd. (Ireland) / Stripe, Inc. (USA): Subscription billing management, payment infrastructure, and automated global tax calculation (Stripe Tax). Any residual data transfers outside the EEA are governed by the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs).

Sub-processor Changes

The Processor will update this DPA if new sub-processors are added, giving the Controller the opportunity to object.

5. Return or Deletion of Data

When the connection between the Service and a Xero organization of the Controller ends, the Processor permanently deletes all cached personal data of that organization from its active systems, including the contents of past bulk actions (only counts are kept as a log): (a) immediately when the Controller disconnects the organization in the Service, or deletes their account and no other account uses the organization; (b) within seven (7) days when the connection is revoked or lost on Xero’s side; (c) within thirty (30) days after the trial or subscription of every account with access to that organization has ended; (d) fifty (50) days after the last sign-in, sync or other request to Xero for the organization. Where the connection still exists at Xero, the Processor also ends it there.

Deleted data may persist in encrypted disaster-recovery backups for up to thirty-five (35) days after deletion from active systems, after which it is automatically and permanently purged. If a backup is restored, deletions and anonymizations performed after that backup was taken are re-applied as part of the restore procedure.

Annex 1: Details of Processing

• Categories of Data Subjects: Customers, clients, suppliers, and employees of the Controller whose details are stored in the Controller's Xero account.
• Types of Personal Data: Names, email addresses, physical addresses, telephone numbers, tax identification numbers, contact group memberships, contact persons (named individuals at customer or supplier organizations), free-text user-entered notes about contacts, and basic invoice metadata (invoice dates and identifiers). Bank account details (where stored on supplier or customer contacts in Xero) are processed transiently during a sync or an import the Controller starts, and are never stored by the Processor.
• Duration: For the duration the Controller maintains an active connection between the Service and their Xero account, followed by the deletion periods in section 5.

Annex 2: Technical and Organizational Security Measures

The Processor implements the following baseline security measures:

• Encryption: OAuth tokens are encrypted at rest using AES-256-GCM. Database backups are encrypted (AES-256) before they leave the Processor’s servers. Connections between users’ browsers and the Service, and between the Service and Xero, use TLS 1.2 or higher.
• Hosting: All database and application servers are physically located within the European Union (Germany).
• Tenant Isolation: Database architecture strictly isolates data at the query level based on the Controller's unique Xero Tenant ID.
• Data Minimization: No financial amounts, line items, or general ledgers are synchronized or stored by the Processor.

Changes to this DPA

• 14 October 2026: section 3 commits to a first notification of a personal data breach within 48 hours, updates during the investigation, and a written summary within 5 working days.
• 14 October 2026: Annex 1 states that bank account details are processed only in passing, during a sync or an import the Controller starts, and are never stored by the Processor.
• 13 October 2026: section 5 lists when cached data is deleted after a connection ends or an account is deleted; Annex 2 states TLS 1.2 or higher and backup encryption.

Contact

For questions about this DPA, contact privacy@bulkcontactmanager.com or legal@bulkcontactmanager.com.