Effective date: October 18, 2026
This Data Processing Agreement (“DPA”) forms part of the Girderly Terms of Use between Girderly LLC (“Girderly,” “Processor”) and the customer (“Customer,” “Controller”). It applies where, and to the extent that, Girderly processes personal data on the Customer’s behalf that is subject to the UK GDPR, the EU GDPR, or the Swiss FADP. If there is a conflict, this DPA governs for such processing. It is signable on request — email legal@girderly.com.
1. Definitions
“Personal Data,” “processing,” “controller,” “processor,” “data subject,” and “supervisory authority” have the meanings given in the UK/EU GDPR. “Data Protection Laws” means the UK GDPR and the Data Protection Act 2018; the EU GDPR (Regulation 2016/679); the Swiss FADP; and any successor laws, each as applicable. “Sub-processor” means a third party engaged by Girderly to process Personal Data. “SCCs” means the European Commission’s Standard Contractual Clauses (Decision 2021/914); “UK IDTA” means the UK International Data Transfer Addendum to the SCCs.
2. Roles and scope (details of processing)
- Customer = Controller; Girderly = Processor of the personal data that the Girderly add-in displays from, and writes to, the Customer’s connected platform (for example the Customer’s own customers’, suppliers’, or contacts’ names, email addresses, and related job or financial record details) when the Customer uses the Service.
- Subject matter and duration: provision of the Girderly add-in for the term of the Customer’s subscription.
- Nature and purpose: reading the connected-platform record related to an open email and displaying it to the Customer; and, only on the Customer’s explicit action, writing a note or log, creating or updating a record, uploading an attachment, or recording a payment the Customer enters.
- Types of personal data: business contact details (names, email addresses, phone, addresses) and related commercial record data (quotes, estimates, invoices, bills, balances, payments, projects, jobs, notes).
- Categories of data subjects: the Customer’s own customers, suppliers, contacts, and staff.
- No special-category data is intended or required; the Customer must not route special-category data through free-text fields where avoidable.
- Separately, Girderly is an independent controller of the Customer’s own account, billing, and website data (described in the Privacy Policy, Part C); that is not governed by this DPA.
3. Processor obligations (Art. 28(3))
Girderly shall: (a) process Personal Data only on the Customer’s documented instructions (these Terms, this DPA, and the Customer’s use of the Service), including for transfers, unless required by law (and then notify the Customer unless the law prohibits it); (b) ensure persons authorized to process are bound by confidentiality; (c) implement the technical and organizational measures described in the Annex below; (d) respect the sub-processor conditions in Section 4; (e) assist the Customer, taking into account the nature of processing, to respond to data-subject requests (Art. 12–22); (f) assist with the Customer’s Art. 32–36 obligations (security, breach notification, data-protection impact assessments, prior consultation); (g) at the Customer’s choice, delete or return Personal Data at the end of the Service and delete existing copies unless law requires retention; and (h) make available the information necessary to demonstrate compliance and allow for and contribute to audits.
4. Sub-processors
The Customer gives general authorization for Girderly to engage the sub-processors listed at girderly.com/subprocessors. Girderly imposes data-protection terms on each sub-processor no less protective than this DPA and remains liable for their performance. Girderly will give notice (via the subprocessors page and, where the Customer subscribes to notice, by email) before adding or replacing a sub-processor; the Customer may object on reasonable data-protection grounds within 30 days, and the parties will work in good faith to resolve it.
5. International transfers
Where Girderly transfers Personal Data from the UK, EEA, or Switzerland to a country without an adequacy decision (including the United States, where Girderly and certain sub-processors are located), the transfer is made under the SCCs (EEA), the UK IDTA (UK), and the SCCs with the Swiss amendments (Switzerland), which are incorporated by reference, with Girderly as “data importer.” The Annex describes the supplementary technical measures.
6. Data-subject requests and breaches
Girderly will, without undue delay, notify the Customer of any request it receives directly from a data subject relating to the Customer’s Personal Data (and will not respond except on the Customer’s instruction or as legally required), and will notify the Customer without undue delay after becoming aware of a personal-data breach affecting the Customer’s Personal Data, with the information the Customer reasonably needs to meet its own breach obligations.
7. Audit
Girderly will make available the information necessary to demonstrate compliance with Art. 28 and allow for audits no more than once per 12 months (or following a breach, or where required by a supervisory authority), on reasonable prior notice, during business hours, subject to confidentiality, and ordinarily satisfied by Girderly’s then-current security documentation and responses to a reasonable security questionnaire.
8. Deletion and return
On termination, the Customer may use Disconnect to erase the stored connected-platform credential immediately. Girderly does not retain the Customer’s connected-platform business data durably in the ordinary course (see the Privacy Policy and the short-lived cache described in the Annex); any residual copies are deleted within the periods in the Annex. On written request within 30 days of termination, Girderly will confirm deletion.
9. Liability; order of precedence
This DPA is subject to the limitation of liability in the Terms. Nothing in this DPA limits either party’s obligations to data subjects or supervisory authorities under Data Protection Laws. For transfers, the SCCs and UK IDTA prevail over this DPA to the extent of any conflict.
Annex — Technical and organizational measures
- Encryption in transit (HTTPS/TLS) end to end; encryption at rest (AES-GCM) for stored connection credentials, with decryption keys held separately.
- Connected-platform business data is read live and not stored durably; held only in a short-lived cache (up to 24 hours for sender-to-record matching; 15 minutes or less for card details) on QuickBooks Online, Xero, FreshBooks, and Sage; read live with no business-data cache on JobTread, CompanyCam, and Contractor+.
- Least-privilege access; credentials isolated per account; no shared super-account.
- US hosting with Google Cloud (Cloud Run), Supabase, and Render; transfers under SCCs/UK IDTA.
- Content is sent to the AI provider only on the user’s explicit action, as text only, and is not used for model training. No AI processing of Sage Accounting data pending Sage’s written approval.
- Disconnect erases the stored credential immediately; credentials unused for 90 days are deleted automatically.
- Development and testing never use real customer books or production data.