Data Processing Agreement
Last updated: 11 October 2026
This Agreement forms part of the Terms and Conditions and complies with Article 28 of the GDPR. It applies when Superteams (the "Processor") processes personal data on behalf of the Customer (the "Controller").
1. Subject matter and duration
The Processor processes personal data to provide the Superteams service, for the term of the contract and until the data is returned or deleted.
2. Description of the processing
| Element | Description |
|---|---|
| Nature | Hosting, storage, search, sharing and backup of documents |
| Purpose | Provide the contracted internal documentation service |
| Data subjects | The Customer's users (employees, external collaborators) and anyone mentioned in the documents |
| Categories of data | Name, email, role, authentication data, and any personal data the Customer includes in documents |
| Special categories of data | Not needed for the service; the Customer should avoid entering them |
3. Processor obligations
The Processor undertakes to:
- process the data only on documented instructions from the Customer, which include the Terms and this DPA, and inform the Customer if it believes an instruction breaches the law;
- ensure that people authorised to process the data are bound by confidentiality;
- apply appropriate technical and organisational measures (section 6);
- help the Customer respond to requests from data subjects;
- notify the Customer without undue delay, and within 48 hours at the latest, after becoming aware of a personal data breach, with the information available;
- help the Customer with data protection impact assessments and prior consultations, where reasonably necessary;
- at the end of the contract, allow the data to be exported for 30 days and then delete it, unless required by law to keep it;
- make available the information needed to demonstrate compliance with this DPA and allow reasonable audits, with 30 days' prior notice, during normal business hours and without compromising the security of other customers.
4. Sub-processors
4.1. The Customer gives general authorisation for the sub-processors in the list of subprocessors.
4.2. We notify the Customer by email at least 30 days before adding or replacing one of them. The Customer may object on reasoned data protection grounds; if no solution is found, it may cancel the contract without penalty.
4.3. The Processor imposes equivalent obligations on each sub-processor and remains liable to the Customer for their compliance.
5. International transfers
When data is transferred outside the EEA, the Processor ensures a valid basis: an adequacy decision or standard contractual clauses, with supplementary measures where necessary. Primary data region: AWS Europe Central 1 (Frankfurt, Germany).
6. Security measures
- Encryption in transit (HTTPS) and at rest, with a key per workspace for page content.
- User authentication and access control per workspace and per area.
- Internal access to data limited to staff who need it, and logged.
- Regular backups and a recovery process.
- Regular software updates and vulnerability management.
- Internal incident response procedure.
7. Customer responsibilities
The Customer warrants that it has a legal basis for the processing, that it has informed the data subjects and that its instructions are lawful.
8. Liability and governing law
Each party's liability is governed by the liability rules of the Terms and Conditions, without prejudice to the rights of data subjects under the GDPR. Portuguese law applies, and jurisdiction is as set out in the Terms.
9. Contact
Questions about this DPA: [email protected].