GDPR & Data Processing

GDPR at DevProofs

DevProofs is operated from Romania, in the European Union, so the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romanian Law 190/2018 apply to everything we do, wherever you are.

• For our own visitors, leads, prospects and clients we are the controller. Our Privacy Policy explains what we collect, why, our legal bases, and how long we keep it.
• For our clients' website visitors and customers, we are a processor acting on the client's instructions under the Data Processing Addendum below.

Your rights

How to use your rights

1. Email hello@devproofs.com, or write to Pelea Raul-Daniel, Strada Principală, 407560 Tureni, Cluj County, Romania. Say which right you want to use.
2. We may ask for information to confirm your identity, usually just a reply from the email address we have on file.
3. We respond within one month. For complex requests we may extend this by up to two more months, and we will tell you why within the first month.
4. Requests are free. We may only charge, or refuse, if a request is clearly unfounded or excessive, and we will explain why.

If your data is held by one of our clients (for example, you filled in a form on a plumber's website that we built), contact that business. If you contact us instead, we will pass your request to them promptly.

Complaints

Please contact us first so we can put things right. You also have the right to complain to a data protection authority, especially in the EU country where you live or work, or where you think the problem happened. Our lead authority is:

National Supervisory Authority for Personal Data Processing (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, Romania
www.dataprotection.ro

Data Processing Addendum (for clients)

This addendum forms part of our Terms of Service. It applies whenever we process personal data on behalf of a client ("you"), and meets the requirements of GDPR Article 28. Where the GDPR does not apply to your data, we follow these terms anyway as our standard of care.

1. Details of the processing

• Subject matter and purpose: hosting and running your website, contact and quote forms, AI assistant and automations, and sending you the resulting leads and reports.
• Duration: for as long as we provide the services, plus the deletion period below.
• Data subjects: your website visitors, customers and leads, and your staff who use the services.
• Types of data: names, phone numbers, email and postal addresses, ZIP codes, service requests, messages and chat transcripts, appointment details, and technical data such as IP address and browser details. We do not intend to process special category data. Please don't configure forms to collect it.

2. Our obligations as processor

1. We process personal data only on your documented instructions: these Terms, your project settings and your written requests. The exception is processing required by law, and we will tell you about it unless the law forbids that.
2. Everyone who handles the data for us is bound by confidentiality.
3. We apply appropriate security measures under Article 32: encryption in transit (HTTPS), access limited to the owner, two-step verification on admin accounts, reputable infrastructure providers, backups, and prompt security updates.
4. We use the sub-processors listed below. You give general authorization for them. We will notify you by email at least 30 days before adding or replacing one, and you may object on reasonable grounds. If we can't resolve the objection, you can end the affected service without penalty. Each sub-processor is bound by data protection terms at least as protective as these.
5. We help you answer requests from people exercising their GDPR rights, and pass on any request we receive directly.
6. We help you meet your obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32-36), taking into account the information available to us.
7. We notify you of a personal data breach affecting your data without undue delay, and within 48 hours of becoming aware of it, with the information you need to meet your own obligations.
8. When the services end, we delete or return your personal data at your choice within 30 days, unless the law requires us to keep it. Backups expire within a further 30 days.
9. We make available the information needed to show compliance with this addendum, and allow audits, which are normally done by written questionnaire, at your cost and with reasonable notice.
10. Transfers outside the EEA are protected by the EU-U.S. Data Privacy Framework or Standard Contractual Clauses. Where you are outside the EEA and we transfer your data to you, the Commission's SCCs (Module 4, processor to controller) apply as needed.

3. Your obligations as controller

• You are responsible for having a lawful basis for the processing, for providing privacy notices to your visitors and customers, and for any consents your use of the services requires (including consent for texts and calls under the TCPA).
• Your instructions to us must comply with applicable law.

Sub-processors

Some features use services that you own or choose, such as your own n8n workspace, SMS provider or Google account. Those providers process data under their contract with you, not as our sub-processors.