Data Processing Addendum

Version 2026-10 · 10 October 2026 · subject to legal review

Effective from 10 October 2026.

This addendum forms part of the Terms of Service between the customer organization (controller, 'customer') and NoLogTech, Lda. (processor, 'we'), and applies to the personal data the customer enters in OutDo, under Article 28 of the GDPR.

For any dispute arising from this addendum, the courts of Lisbon have jurisdiction.

1. Subject matter, duration, nature and purpose

We process personal data only to provide the OutDo service to the customer: storage, synchronization, display, calculation, automation and the features the customer's users choose to use. Processing lasts for the term of the subscription and until deletion under section 7.

2. Instructions

We process the data only on the customer's documented instructions, which consist of these terms and the use the customer makes of the service. If we consider an instruction unlawful, we inform the customer. We do not use the data for our own purposes and do not sell it.

3. Confidentiality

Access to customer data is limited to the people who need it to operate and support the service, bound by confidentiality obligations.

4. Security

We apply the technical and organizational measures described in Annex 2 and on the security page, and keep them appropriate to the risk.

5. Subprocessors

• The customer gives general authorization for the subprocessors listed on the subprocessors page.
• We notify the customer by email at least 30 days before adding or replacing a subprocessor. The customer may object on reasonable grounds; if no solution is found, it may terminate the affected service.
• We impose on each subprocessor data protection obligations equivalent to these, and remain responsible for its performance.

6. Assistance

Taking into account the nature of the processing, we help the customer answer data subject requests, carry out impact assessments and prior consultations, and meet its security obligations. Most requests can be handled directly in the product (editing, export through the API or CSV, deletion).

7. Deletion and return

At the end of the service, the customer can export its data through the API or as CSV. After the organization is deleted, we delete the data from the production systems within 30 days. Copies in backups are removed when those backups expire, under the retention set out in the Privacy Policy, unless the law requires longer retention.

8. Audits

We make available, on request, the information needed to demonstrate compliance with this addendum, including security reports and answers to questionnaires. On-site audits are possible with reasonable notice, under a confidentiality agreement and at the customer's cost.

9. Personal data breaches

We notify the customer without undue delay, and within 72 hours of becoming aware of it, of any personal data breach affecting its data, with the information available on its nature, likely consequences and the measures taken.

10. Liability

Liability under this addendum is subject to the limits of the Terms of Service, except where the law does not allow them.

Annex 1. Processing details

• Data subjects: the customer's users and the people whose data the customer enters (for example employees, clients, suppliers and contacts).
• Categories of data: those chosen by the customer when configuring its workspaces, usually identification and contact data, professional and commercial data, documents and records of time and activity.
• Special categories: not expected; the customer decides whether to enter them and is responsible for the corresponding legal basis.
• Operations: storage, synchronization with devices, calculation, automation, export, AI and OCR processing at the user's request, backup and deletion.
• Location: production servers and backups at OVH in Gravelines, France; subprocessors as listed.

Annex 2. Technical and organizational measures

• Data isolation per organization with row-level security on every database table, and per-user access tokens in the clients.
• Encryption in transit (TLS) on all connections; provider API keys encrypted in the database; passwords stored as hashes.
• Permissions per workspace and role; isolated kiosk and external accounts.
• API keys shown once and stored as hashes, with scopes, expiry and rate limits.
• Audit log of data changes and of administrative actions, per organization.
• Continuous backups with point-in-time recovery for 30 days, daily full backups and off-site copies in a separate storage bucket.
• Continuous monitoring with a public status page.