Data Processing Agreement (DPA)

Last Updated: October 15, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (or other applicable agreement) between Produktly ("Processor") and the customer using Produktly's services ("Controller"), collectively referred to as the "Parties." It applies automatically when the Controller accepts the Terms of Service, and no separate signature is required.

1. Definitions

  • "GDPR" means the General Data Protection Regulation (EU) 2016/679.
  • "Personal Data" means any information related to an identified or identifiable natural person processed by the Processor on behalf of the Controller.
  • "Processing" means any operation performed on Personal Data, such as collection, storage, use, deletion, or disclosure.
  • "Sub-Processor" means any third party engaged by the Processor to assist in processing Personal Data.

2. Scope and Responsibilities

  • The Controller determines the purpose and means of processing Personal Data, while the Processor processes Personal Data solely on behalf of the Controller in accordance with this DPA.
  • The Processor processes Personal Data only to provide the services to the Controller, including hosting, maintenance, customer support and security. The Processor does not sell Personal Data or use it for its own purposes.
  • The Processor may create aggregated, anonymized statistics that do not identify the Controller, its users or any individual, and use them to operate and improve the services.
  • The Controller shall ensure that it has a lawful basis for collecting and processing Personal Data.
  • Processing continues for as long as the Controller uses the services, and afterwards until the data is deleted as described in Section 9.

3. Processor Obligations

  • The Processor shall process Personal Data only on documented instructions from the Controller, including with respect to transfers outside the EU/EEA. The Controller's configuration and use of the services count as such instructions.
  • The Processor shall inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.
  • The Processor shall ensure that employees or authorized personnel processing Personal Data are bound by confidentiality obligations.
  • The Processor shall implement appropriate technical and organizational measures to ensure data security, as described in Section 8.
  • The Processor shall assist the Controller in responding to data subject requests, including access, rectification, deletion, and portability requests, where possible, but only to the extent that such assistance is technically feasible and does not require disproportionate effort.
  • Taking into account the nature of the processing and the information available to it, the Processor shall reasonably assist the Controller with its obligations regarding security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 of the GDPR).

4. Data Subject Rights

  • The Controller is responsible for handling data subject requests. The Controller can view and delete content such as feedback, feature requests and comments directly in the Produktly dashboard.
  • The Processor shall provide reasonable assistance to the Controller in fulfilling GDPR obligations related to data subject rights, upon request and where technically feasible.
  • The Processor shall, to the extent legally permitted, promptly notify the Controller if a data subject directly contacts the Processor regarding their Personal Data.

5. Sub-Processors

  • The Controller provides general authorization for the Processor to engage Sub-Processors, provided that the Processor imposes data protection obligations on each Sub-Processor that are no less protective than those in this DPA. The Processor remains liable for its Sub-Processors' actions.
  • The Processor currently uses the following Sub-Processors:
    • Hetzner - Cloud service provider (application hosting, Germany)
    • DigitalOcean - Managed database hosting (Frankfurt, Germany)
    • Cloudflare - Content delivery network, security, and file storage (file storage in the EU)
    • Bugsnag - Application monitoring and error tracking
    • PostHog - Product analytics and error tracking (EU hosting)
    • Stripe - Payment processing
    • Loops - Email sending
    • Sender - Email sending
    • Namecheap (Private Email) - Support email hosting and sending
    • OpenAI - Large Language Model provider (optional, only used if you choose to use AI-powered features)

6. Data Collected

  • The data subjects are the Controller's end-users who interact with Produktly widgets, roadmaps, changelogs and surveys.
  • The personal data collected by Produktly depends on which services you use, and how your end-users interact with them. It may include:
    • Produktly user id
    • Email address (if provided by the user)
    • Name (if provided by the user)
    • IP Address
    • Browser information (browser vendor, version, preferred language etc.)
    • Device information (device type, operating system, screen resolution, etc.)
    • User provided feedback (ratings, NPS, comments, etc.)
    • User interactions (clicks, page views, etc.)
    • Produktly usage analytics (feature usage, feature progress, feature completions etc.)
    • Other user generated content (feature requests, comments, etc.)
    • Other user attributes you choose to share with us through the identifyUser feature
  • The Processor does not send emails to the Controller's end-users. Notification emails about end-user activity, such as new feedback responses, go only to the addresses the Controller configures.

7. Data Location and Transfers

  • The Processor stores and processes customer data primarily on servers located in the European Union, currently in Germany: application hosting with Hetzner and managed database hosting with DigitalOcean in Frankfurt. However, the Processor may use certain sub-processors located outside the EU/EEA (such as in the United States) for specific service functions.
  • The Processor shall not transfer Personal Data outside the EU/EEA unless adequate safeguards are in place, such as the EU-US Data Privacy Framework (DPF), where the recipient is certified under the DPF, or Standard Contractual Clauses (SCCs) or an EU-approved data transfer mechanism.

8. Security & Data Breach Notification

  • The Processor shall implement appropriate security measures to prevent unauthorized access, disclosure, or loss of Personal Data. These include, but are not limited to:
    • Encryption in transit (HTTPS/TLS) for all traffic to the services and between the application and the database
    • Encryption at rest by the database and file storage providers
    • Passwords stored only as salted hashes (bcrypt)
    • Role-based access control for the Controller's team members within the dashboard
    • Access to production systems limited to authorized personnel
    • Daily database backups with point-in-time recovery
  • In the event of a Personal Data breach, the Processor shall notify the Controller without undue delay and provide sufficient details to enable compliance with GDPR obligations.

9. Data Retention & Deletion

  • The Controller decides how long Personal Data is kept, and can delete individual content in the dashboard at any time.
  • Data is not deleted automatically when the services end. Upon termination, the Controller can request deletion or return of its Personal Data by contacting [email protected], unless legal obligations require further retention. Deleted data is removed from backups as they expire.

10. Compliance & Documentation

  • The Processor shall provide reasonable documentation, upon request, to demonstrate compliance with this DPA and the GDPR.

11. Miscellaneous

  • This DPA remains in effect as long as the Processor processes Personal Data on behalf of the Controller.
  • If any provision of this DPA is deemed invalid or unenforceable, the remaining provisions remain in full effect.
  • Questions about this DPA can be sent to [email protected].