Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the OIO Terms of Service. It applies whenever you use OIO to process personal data of other people (your clients, their contacts, your team, people who fill in your forms) and the GDPR, the UK GDPR or a similar law applies to that processing. You do not need to sign anything: accepting the Terms accepts this DPA. If your organisation needs a signed copy, write to privacy@oio.app and we will send one with the same text.

1. Parties and roles

• You, the customer who holds the OIO account ("Customer"), are the controller of the personal data you put into the Service.
• Damian Mathew Bishop, ul. Wierzbięcice 44a/40A, 61-568 Poznań, Poland, NIP 7773472578, trading as OIO ("OIO", "we"), is your processor.
• If you are yourself a processor for someone else, we are your sub-processor and you pass on their instructions to us.

Data we process for our own purposes (your account, billing, security, our own measurement) is covered by our Privacy Policy, not by this DPA.

2. What we process for you

• Subject matter and purpose: hosting and processing your workspace data so the Service works as described in the Terms: storing, showing, sharing, sending, exporting, transcribing and running AI features on it when you use them.
• Duration: as long as you use the Service, then as in section 9.
• Nature: storage, retrieval, organisation, transmission, AI and speech-to-text processing, deletion.
• People concerned: your clients and their staff, prospects and form respondents, people you send documents to for signature, team members and collaborators, and anyone else you record in OIO.
• Data types: names, contact details, company and tax details, project and financial data, invoices, messages, notes, files, audio and video recordings and their transcripts, electronic signatures (signature and initials images) with their audit trail (IP address, browser, times, consent to sign electronically), and anything else you upload.
• Special category data: OIO is not built for it. Do not upload health, biometric or similar data unless you have a legal basis and have checked that our safeguards are enough for it.

3. Your instructions

We process the data only on your documented instructions. The Terms, this DPA and the way you use the Service (what you create, share, send, delete) are those instructions. If an instruction breaks data protection law in our view, we tell you. If EU or Polish law makes us process data in another way, we tell you first unless that law forbids it.

4. Confidentiality

Access is limited to authorized persons and approved sub-processors who need it to provide the Service, support you or meet a legal obligation. Persons authorized to process personal data are bound by contractual confidentiality or an appropriate statutory duty.

5. Security

We keep appropriate technical and organisational measures under Art. 32 GDPR, including:

• encryption in transit (TLS) and at rest at our infrastructure providers;
• row-level access rules in the database, so each account only reaches its own data and what was shared with it;
• private file storage with short-lived signed links;
• optional two-factor sign-in, rate limits, bot checks and a strict content security policy;
• daily database backups;
• least-privilege access to infrastructure;
• dependency updates and security reviews of changes.

More detail is on our Security page. We may improve these measures but will not lower the overall level of protection.

6. Helping you

Taking account of the processing and information available to us, we will assist you with data-subject requests and your obligations under Articles 32 to 36 GDPR, including security, breach notifications, impact assessments and prior consultation. Most requests (access, correction, deletion, export) you can handle yourself in the app.

We will forward requests concerning your data to you and follow your instructions, unless the law requires us to respond directly.

We will notify you of a personal data breach affecting data we process for you without undue delay and no later than 48 hours after becoming aware of it. We will provide available information about its nature, affected data and people, likely consequences, mitigation and a contact point. Missing information will follow without undue further delay.

7. Sub-processors

You give us general authorisation to use the sub-processors in the list below. Each is bound by a written contract with data protection obligations no weaker than this DPA. We stay responsible to you for their work.

Changes. We will give account owners advance written notice of an intended new or replacement sub-processor, normally at least 30 days before it receives customer data. The notice will identify the provider, processing, locations and transfer safeguards.

You may object on reasonable data protection grounds, by writing to privacy@oio.app. We will work with you on a solution; if none is available, you may end the affected service before the change and receive unused prepaid fees.

An emergency does not remove the requirement for authorization and a meaningful opportunity to object. Where necessary, we will seek specific authorization or pause the affected processing.

Integrations you switch on. Some features send data to a third party only when you or your team choose to use them: Telegram (reminder messages, if you connect it), Google Calendar (your OIO dates, if you connect it), KLIPY (GIF search words, a one-way pseudonymous id and, when a GIF is shown, the viewer's IP address), the push service of your browser maker (notification text, if you turn on push notifications), and AI tools you connect to OIO yourself (MCP). They are not in the list above and we have no processor contract like this DPA with them. Being optional does not by itself make them independent controllers: their role depends on the service and how you use it, and their own terms and privacy policies apply. Don't switch them on for data you must keep inside a processor contract.

8. Transfers outside the EEA

Transfers outside the EEA must follow your documented instructions and a valid GDPR transfer mechanism.

We rely on an applicable adequacy decision only where it covers the receiving entity and processing. Otherwise, we use an appropriate Article 46 safeguard, including the applicable EU Standard Contractual Clauses, and assess whether supplementary measures are required. Processor-to-subprocessor transfers ordinarily use Module 3.

UK transfers require a valid UK transfer mechanism. We will provide information about the relevant safeguards on request, subject to necessary protection of confidential information.

We removed the DeepSeek integration on 5 October 2026. This statement does not establish deletion of data previously sent to that provider.

9. End of the service

• Before you close your account you can export your data from Settings at any time.
• We do not retain your issued invoices after account closure solely because they are tax records. You are responsible for identifying your retention duties and exporting the records you need.
• Continued archiving requires a separate documented instruction accepted by us, specifying the records, purpose, retention period and access arrangements. We remain your processor for that archive. Without such an arrangement, invoices follow the normal return and deletion process, unless law binding on us requires retention.
• If we end the Service or your account (Terms section 13), you get at least 30 days to export first, unless the law or a serious breach prevents it.

At the end of processing, you may instruct us to return your personal data or delete it. Exported file links are not copies of the files: download the files before access ends. If the export tools do not provide the required return, contact privacy@oio.app.

Ordinary deleted workspace items remain in Trash for 30 days before deletion from active systems. Backup copies expire within a further 30 days. Account deletion does not create a new Trash period; deletion from active systems begins on that request, and backup copies expire within 30 days.

Backups awaiting expiry are restricted to recovery and security purposes. If restored, applicable deletions are reapplied. Separately required legal records and security logs follow their stated retention periods. Statutory export and switching rights remain unaffected.

10. Showing that we comply

We will provide information needed to demonstrate compliance with Article 28 GDPR and allow and contribute to audits, including inspections, by you or an auditor you appoint.

Routine audits normally require 30 days' notice and occur no more than once a year. These arrangements do not restrict audits reasonably required following a breach, credible evidence of non-compliance or a competent authority's request.

We may agree reasonable confidentiality, security and cost arrangements that protect other customers without preventing effective verification or access required by law. We keep internal records of our processing as Art. 30 GDPR requires.

11. Everything else

• Liability under this DPA follows the Terms, except where the GDPR does not allow a limit.
• If this DPA and the Terms conflict on data protection, this DPA wins. If the Standard Contractual Clauses apply and conflict with either, the Clauses win.
• Polish law governs this DPA, as in the Terms.
• We may update this DPA for changes in law or in the Service, with the same notice as for the Terms, but never to lower the protection of your data without your agreement.

Contact

privacy@oio.app