OpenContact

Data Processing Agreement

Effective date: 23 October 2026

This agreement forms part of the Terms of Service. It applies when OpenContact processes personal data for a customer under the GDPR (Regulation (EU) 2016/679). It is accepted when the customer accepts the Terms. We will countersign a copy on request at support@opencontact.dev.

Customer (controller): the account holder. Processor: Softway Solutions SRL, Nicolae Filipescu 53-55, 4th floor, Cam 4, Bucharest, Romania

Processing details

  • Subject matter: contact capture, storage, routing, import, migration, suppression sync, events and related support.
  • Duration: the service term, plus the deletion period below.
  • Purpose: providing OpenContact as the customer instructs.
  • Data subjects: the customer’s prospects, subscribers, users, customers and other contacts.
  • Data categories: identity and contact details, profile and custom fields, consent data, source, subscription status, provider identifiers and event history.
  • Special categories: not intended. Do not send them unless we agree in writing.

Processor obligations

We will:

  1. Process personal data only on the customer’s documented instructions, which are the Terms and the customer’s configuration of OpenContact. We tell the customer if we think an instruction breaks the law.
  2. Make sure everyone with access is bound by confidentiality.
  3. Apply the measures on the Security page, including encryption of credentials, project isolation, role-based access, authenticated webhooks, audit logging and retention limits.
  4. Use only the subprocessors on the Subprocessors page, under written terms with equivalent data protection duties. We stay responsible for them.
  5. Help the customer answer data-subject requests. The product supports contact export and permanent erasure.
  6. Tell the customer without undue delay after becoming aware of a personal data breach, with the information we have.
  7. Help with impact assessments and consultations with authorities, as far as the law requires.
  8. Give the customer the information needed to show compliance, and allow audits by the customer or its auditor. Audits need reasonable notice, a confidentiality agreement and normal business hours.

Subprocessors

The customer authorises the subprocessors listed on the Subprocessors page. We will update that page and email account owners at least 30 days before adding or replacing one. The customer can object on reasonable data protection grounds within that time. If we cannot resolve the objection, the customer may cancel the affected service.

Transfers

Application data is hosted in Germany. If we transfer personal data outside the European Economic Area, we do so only under an EU adequacy decision or the Standard Contractual Clauses (Commission Decision 2021/914, Module 2 or 3 as it applies), which are incorporated here by reference.

Deletion and return

The customer can export and erase data at any time in the product. After the account closes we delete the customer’s personal data, unless the law requires us to keep it. The customer should export first.

Liability and law

Liability under this agreement follows the Terms. Romanian law governs, and the courts of Bucharest have jurisdiction.