Data Processing Agreement

This agreement is between the customer who holds the workspace (the Controller) and:

All in One Software S.R.L., a limited liability company (S.R.L.) registered in Romania, tax identification code (CUI) 55693621, trade registry number J2026057554000, share capital 500 RON, registered office Bd. Dinicu Golescu, nr. 7, et. Parter, ap. SP. COM. 3, Sector 1, București, România, represented by Cristian Vieru. Contact: cristianvieru3@gmail.com.

(the Processor). It applies to personal data that the Controller or its users put into Frusma or that Frusma collects on the Controller’s behalf (for example through lead forms and the client portal), together the Customer Personal Data. If this agreement conflicts with the Terms of Service about the processing of Customer Personal Data, this agreement prevails. Terms such as “personal data”, “processing”, “controller” and “processor” have the meaning given in the GDPR.

The Processor processes Customer Personal Data to provide Frusma to the Controller (hosting, storing, displaying, exporting, e-mailing documents on the Controller’s instruction, generating reports and enabling client-portal access). The processing lasts as long as the Controller uses Frusma, plus the deletion period in section 9. The details of the processing are in Annex 1.

The Processor processes Customer Personal Data only on the Controller’s documented instructions, which are: this agreement, the Terms of Service, and the Controller’s use of Frusma’s features and settings. The Processor will inform the Controller if it believes an instruction infringes data protection law, and may process data where required by EU or Member State law, informing the Controller beforehand unless the law forbids it. The Controller remains responsible for having a lawful basis and for informing the people whose data it enters.

The Processor ensures that everyone authorised to process Customer Personal Data is bound by confidentiality or is under a statutory duty of confidentiality, and allows access only as needed to provide the service.

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, taking into account the state of the art, costs, the nature, scope, context and purposes of processing and the risks to individuals. The measures in place are listed in Annex 2. The Processor may update them as long as the overall level of protection is not lowered.

1. The Controller gives the Processor general authorisation to use the sub-processors listed in Annex 3.
2. The Processor will inform the Controller (by e-mail or in the app) of any intended addition or replacement at least 30 days beforehand. The Controller may object on reasonable data-protection grounds within that period; if the parties cannot resolve the objection, the Controller may terminate the affected service and receive a refund of prepaid fees for the unused period.
3. The Processor imposes on each sub-processor, by contract, data protection obligations no less protective than those in this agreement, and remains liable to the Controller for their performance.

• Taking into account the nature of the processing, the Processor assists the Controller with appropriate measures in answering requests from individuals to exercise their rights. Frusma includes tools for export and erasure of a company’s or contact’s data (see GDPR and data protection). The Processor forwards any request it receives directly to the Controller without undue delay and does not respond to it itself unless instructed.
• The Processor assists the Controller with its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36 GDPR), taking into account the information available to the Processor.

The Processor notifies the Controller without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and provides the information reasonably available to it about the nature of the breach, the categories and approximate number of individuals and records concerned, the likely consequences and the measures taken or proposed, so that the Controller can meet its own notification duties.

After the end of the service, or on the Controller’s written request, the Processor deletes Customer Personal Data within 30 days, unless EU or Member State law requires storage. During the term and for 30 days after it ends, the Controller can export its data using the export features. Copies in encrypted backups are overwritten on the normal backup cycle. The Processor confirms deletion in writing on request.

The Processor makes available to the Controller the information necessary to demonstrate compliance with this agreement and allows for and contributes to audits, including inspections, by the Controller or an auditor it appoints. Audits are announced at least 30 days ahead, take place during business hours, must not unreasonably disturb operations or compromise other customers’ data, are limited to once a year unless a breach requires otherwise, and are at the Controller’s cost. The Processor may satisfy this duty by providing current security documentation and answers to a reasonable questionnaire.

The Processor processes Customer Personal Data in the European Union and transfers it outside the EU/EEA only as needed to use the sub-processors in Annex 3 and only where the conditions of Chapter V GDPR are met, in particular an adequacy decision or the EU Standard Contractual Clauses (Module 3, processor to processor, where the sub-processor is outside the EU/EEA), supplemented by additional safeguards where needed. The Processor will provide a copy of the safeguards on request.

Each party’s liability under this agreement is governed by the liability provisions of the Terms of Service, without limiting individuals’ rights under Article 82 GDPR or liability that cannot be limited by law. This agreement lasts as long as the Processor processes Customer Personal Data. It is governed by the law of Romania, and disputes are brought before the competent courts of Bucharest, Romania, subject to mandatory provisions of the GDPR.

• Subject and purpose: providing the Frusma back-office application to the Controller.
• Categories of data subjects: the Controller’s clients and prospects and their contacts; the Controller’s employees, freelancers and other users; people who submit the Controller’s lead forms; users of the client portal.
• Types of personal data: names, business and personal e-mail addresses, phone numbers, job titles, company and postal addresses, VAT and tax numbers, account and sign-in data, invoices and payment status, project, task and time-tracking records, notes and messages, documents and attachments the Controller uploads, contracts and proposals, lead-form content and consent timestamps, e-mail recipients and delivery status, and technical log data.
• Special categories of data: Frusma is not designed to process special categories (Article 9) or criminal-offence data. The Controller should not enter such data except where necessary and lawful, and is responsible for any it does enter.
• Frequency and duration: continuous, for the term of the agreement and the deletion period.
• Operations: storing, retrieving, displaying, structuring, exporting, transmitting by e-mail on instruction, anonymising and deleting.

• Access control: individual accounts; role-based permissions (admin, employee, freelancer, client); database-level row access rules that isolate each workspace; privileged operations only from server-side code; deactivation of users on request.
• Authentication: passwords stored as salted hashes; optional sign-in through established identity providers; ability to end sessions on other devices.
• Encryption: TLS for data in transit; encryption at rest provided by the database and storage platform.
• Storage and files: private storage with expiring access links; no public file URLs.
• Separation and minimisation: portal users can see only their own company’s data; sensitive financial data is restricted to admins.
• Logging and accountability: an audit log of personal-data exports and erasures (identifiers only); server logs retained for a limited period.
• Availability and resilience: managed infrastructure with regular backups by the platform provider.
• Application security: input validation, rate limiting and spam protection on public forms, secrets kept out of the code base, and dependency updates.
• Organisation: access to production restricted to the operator; confidentiality obligations; incident response and customer notification as in section 8.

The current list is also published on the GDPR and data protection page.