Data Processing Agreement

Last updated: 18 September 2026

This Data Processing Agreement ("DPA") is entered into between Notnull, Unipessoal, Lda, Rua Campo Alegre, N.º 1636, h42, 4150-176 Porto, Portugal ("Processor", "we", "us") and the customer of the Cisma service at cisma.app ("Controller", "you"). Each is a "Party" and together the "Parties".

This DPA is made under Article 28 of Regulation (EU) 2016/679 ("GDPR") and governs the processing of Personal Data by the Processor on behalf of the Controller in connection with the Service.

1. Definitions

Terms not defined here have the meaning given to them in the GDPR.

• Applicable Data Protection Law means all laws and regulations that apply to the processing of Personal Data under this DPA, including the GDPR and the Portuguese Data Protection Act (Lei n.º 58/2019).
• Action means an operation the Service performs in a Connected System on the Controller's behalf, such as sending a message, issuing a refund, updating a record or scheduling an event.
• Automation means a configuration created by the Controller that defines a trigger, the instructions the Service follows when that trigger fires, the Connected Systems it may use and which Actions need human approval.
• Connected System means a third-party system the Controller connects to the Service, such as an email account, a messaging account, a payment provider, a CRM or an internal back office.
• Controller means the customer of the Service, which determines the purposes and means of the processing.
• Personal Data means any information relating to an identified or identifiable natural person that the Processor processes on behalf of the Controller under this DPA, including data read from or written to Connected Systems, data the Controller places in the Knowledge Base, and account data.
• Knowledge Base means the documents, notes and standing orders the Controller stores in the Service so that agents have the business context they need.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.
• Processor means Notnull, Unipessoal, Lda.
• Service means Cisma, the operations automation platform provided at cisma.app.
• Sub-Processor means a third party the Processor engages to process Personal Data on behalf of the Controller.
• Standard Contractual Clauses or SCCs means the clauses adopted by the European Commission in Implementing Decision (EU) 2021/914.

2. Scope and purpose of the processing

2.1 Subject matter

The Service reads items that arrive in the Controller's Connected Systems, proposes a plan of Actions, and carries out those Actions once the Controller approves them or where the Controller has configured them to run without approval. This DPA governs the processing of Personal Data in that work.

2.2 Duration

The processing lasts for as long as the Controller uses the Service, plus the retention periods in Section 8.

2.3 Nature and purpose

The Processor processes Personal Data only for:

1. Reading and classifying items that arrive in Connected Systems.
2. Producing a written plan of Actions for the Controller to review.
3. Carrying out approved Actions in Connected Systems, including sending messages to the Controller's own customers, partners and staff.
4. Holding business context in the Knowledge Base and in per-thread memory so that agents act consistently.
5. Recording an audit log of what was proposed, approved and done.
6. Providing support to the Controller and investigating faults.

The Processor will not:

1. Use the Controller's Personal Data to train its own models.
2. Sell or share the Controller's Personal Data, as those terms are defined in Applicable Data Protection Law.
3. Retain, use or disclose the Controller's Personal Data outside the direct business relationship, or for any purpose other than those in this Section.
4. Combine the Controller's Personal Data with personal data it receives from anyone else or collects from its own dealings with a Data Subject.

2.4 Types of Personal Data

Determined by the Controller. The Controller decides what Personal Data the Service processes by choosing which systems to connect, which Automations to run and what to place in the Knowledge Base.

The Processor additionally processes the account data of the Controller's own users of the Service, being name, email address and authentication identifiers.

2.5 Categories of Data Subjects

Determined by the Controller.

2.6 Special categories of data

The Service is not designed for special categories of Personal Data under Article 9 GDPR or for data relating to criminal convictions under Article 10. The Controller shall not route such data through the Service unless the Parties have agreed additional measures in writing.

3. Obligations of the Controller

The Controller shall:

1. Have a lawful basis under Article 6 GDPR for the processing and for instructing the Processor to carry it out.
2. Give the notices and obtain the consents or authorisations required from Data Subjects, including for messages the Service sends on the Controller's behalf.
3. Configure its Automations, approval settings and Connected System permissions to match what it is lawfully entitled to do.
4. Keep the Knowledge Base free of data it has no lawful basis to hold.
5. Decide which Actions may run without human approval, and review that decision as volume grows.
6. Comply with its own obligations under Applicable Data Protection Law.

4. Automated decisions and human oversight

4.1 Approval gates

The Service lets the Controller require human approval for any Action, per Automation and per Action type. Where the Controller removes that requirement, Actions of that type run without a person reviewing them.

4.2 Article 22 GDPR

The Controller is responsible for deciding whether an Automation produces a decision based solely on automated processing that has legal effects on a Data Subject or similarly significantly affects them, and for meeting its obligations under Article 22 GDPR if it does. Scoring, ranking or rejecting applicants are examples where this may apply. The Processor shall, on request, provide the audit log and the configuration needed for the Controller to demonstrate meaningful human involvement.

4.3 Accuracy

Output produced by a language model can be wrong. The Processor gives no warranty that any plan, classification or draft the Service produces is accurate, complete or fit for a particular decision. The Controller shall not rely on the Service as the sole source of a decision about a Data Subject without review.

4.4 Responsibility for decisions

The Controller decides which Automations to run, what instructions to give them, which Connected Systems they may reach and which Actions may run without approval. The Controller is responsible for those decisions and for every Action the Service takes under them, including Actions it configured to run without a person reviewing them.

To the fullest extent permitted by law, the Processor is not liable for a decision the Controller takes or authorises using the Service, or for the consequences of such a decision for the Controller or for any Data Subject. This does not limit Article 82 GDPR, the Processor's own obligations under this DPA, or any liability that cannot be excluded by law.

5. Obligations of the Processor

5.1 Processing on instructions

The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do otherwise by EU or Member State law, in which case the Processor shall inform the Controller before processing unless that law forbids it.

The Controller's documented instructions are this DPA, the Terms under which the Service is provided, and the Automations, standing orders, approval settings and Knowledge Base content the Controller configures in the Service.

The Processor shall inform the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law.

The Processor shall promptly inform the Controller if it determines that it can no longer meet its obligations under this DPA, so that the Controller can stop or remedy the processing.

5.2 Confidentiality

The Processor shall ensure that every person authorised to process Personal Data is bound by confidentiality, whether by contract or by statute.

5.3 Security

The Processor shall implement the technical and organisational measures in Annex C, which the Parties agree are appropriate to the risk under Article 32 GDPR.

5.4 Sub-processing

The Controller gives general written authorisation for the Processor to engage the Sub-Processors listed in Annex B.

Annex B sets out the categories of Sub-Processor the Processor uses and names those engaged as at the date of this DPA. The Service is under active development and the named list will change. The list in force at any time is published at cisma.app and, together with the notice and objection rights below, is the list the Controller authorises.

Some Sub-Processors run the Service for every Controller. Others are engaged only when the Controller connects a particular system or allows a particular capability, and those receive no Personal Data of a Controller that does not use it.

The Processor shall notify the Controller at least 2 days before adding or replacing a Sub-Processor, by email to the Controller's registered address and by updating Annex B on cisma.app.

The Controller may object on reasonable data protection grounds within 2 days of the notice. If it does not object within that period, it is taken to have consented. Where it objects, the Parties shall discuss the objection in good faith, and if they reach no resolution the Controller may terminate the Agreement by written notice without penalty.

The Processor shall bind each Sub-Processor to data protection obligations no less protective than this DPA, and remains fully liable to the Controller for the Sub-Processor's performance.

5.5 Model providers and customer keys

The agents run on the OpenAI Agents API. OpenAI acts as a Sub-Processor of the Processor and is listed in Annex B.

Where the Controller uses the Processor's own model routing, the model providers reached through OpenRouter act as Sub-Processors of the Processor and are listed in Annex B. The Processor uses zero data retention settings on that route.

Where the Controller supplies its own model provider API key or its own model provider subscription, the Controller contracts with that provider directly. That provider is then the Controller's own processor and not a Sub-Processor of the Processor. The Processor is not responsible for that provider's retention, location of processing or transfer mechanisms. A Controller that requires processing of model calls inside the EEA under its own contract should use its own key.

5.6 Data Subject rights

The Processor shall assist the Controller, by appropriate technical and organisational measures and as far as possible, in responding to requests from Data Subjects under Chapter III GDPR.

If the Processor receives such a request directly, it shall notify the Controller promptly and shall not respond itself unless the Controller authorises it.

5.7 Assistance with compliance

The Processor shall assist the Controller in complying with Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to it.

5.8 Audit

The Processor shall make available to the Controller the information necessary to demonstrate compliance with Article 28 GDPR and this DPA, and shall allow for and contribute to audits, including inspections, by the Controller or an auditor it mandates and that is bound by confidentiality.

The Controller shall give reasonable written notice, and the Parties shall agree the start date, scope, duration and security arrangements. Audits shall take place no more than once in any twelve months, unless there are indications of non-compliance, a Personal Data Breach has occurred, or a supervisory authority requires it.

The Controller shall bear the cost of an audit, and reimburse the Processor's reasonable costs, unless the audit is required by Applicable Data Protection Law or follows a Personal Data Breach. The Controller may use the results only to meet its own regulatory obligations and to confirm compliance with this DPA.

6. Personal Data Breach

6.1 Notification

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, of becoming aware of a Personal Data Breach affecting Personal Data processed on the Controller's behalf.

Notifying a Personal Data Breach, or responding to one, is not an admission by the Processor of fault or liability for it.

6.2 Content

The notification shall describe the nature of the breach, including where possible the categories and approximate number of Data Subjects and records concerned, give a contact point for further information, describe the likely consequences, and describe the measures taken or proposed.

6.3 Cooperation

The Processor shall assist the Controller in investigating the breach, in notifying the supervisory authority under Article 33 GDPR and the Data Subjects under Article 34 GDPR where required, and in taking remedial measures.

6.4 Documentation

The Processor shall document every Personal Data Breach, its effects and the remedial action taken, under Article 33(5) GDPR.

7. International transfers

7.1 Principle

The Processor shall not transfer Personal Data outside the European Economic Area unless an adequacy decision under Article 45 GDPR applies, appropriate safeguards under Article 46 GDPR are in place, or a derogation under Article 49 GDPR applies.

7.2 Mechanisms

Transfer mechanisms for each Sub-Processor are set out in Annex B. For Sub-Processors in the United States the Processor relies on the Standard Contractual Clauses together with the supplementary measures in Section 7.3.

7.3 Supplementary measures

• TLS 1.2 or higher for all data in transit.
• Zero data retention settings on the model routing path where the provider offers them.
• Data minimisation in what is sent to each Sub-Processor.
• Contractual commitments from Sub-Processors on government access requests.

7.4 Information

The Controller may request a copy of the Standard Contractual Clauses and of the transfer impact assessment at [email protected].

8. Retention and deletion

8.1 Retention periods

8.2 Deletion at the end of the Agreement

Within 30 days of the end of the Agreement the Processor shall delete all Personal Data processed on the Controller's behalf, including copies, except where EU or Member State law requires it to be kept or where retention is needed to resolve a dispute between the Parties. At the Controller's choice, made before that period ends, the Processor shall instead return the data in a structured, commonly used and machine-readable format and then delete it.

8.3 Deletion on request

The Controller may request deletion of specific Personal Data at any time. The Processor shall carry it out without undue delay, subject to the audit log, where entries are retained for the period in Section 8.1 so that the record of what was done remains complete.

8.4 Confirmation

The Processor shall confirm deletion in writing on request.

8.5 Connected Systems

Personal Data that lives in a Connected System stays under the Controller's control. Deleting data from the Service does not delete it from a Connected System.

9. Liability

9.1 GDPR

Liability for a breach of this DPA, including damage caused by processing that infringes the GDPR, is governed by Article 82 GDPR.

9.2 Cap

Subject to Article 82 GDPR, which cannot be limited by contract, and save for either Party's wilful misconduct, the total aggregate liability of each Party under this DPA is limited to the greater of one thousand euros (EUR 1,000) and the fees paid by the Controller for the Service in the twelve months before the event giving rise to the claim.

10. Term

This DPA takes effect when the Controller starts using the Service and remains in force for as long as the Processor processes Personal Data on the Controller's behalf. Sections 6, 8, 9 and 11 survive its termination.

11. General

11.1 Governing law

This DPA is governed by the law of Portugal.

11.2 Jurisdiction

The courts of Porto, Portugal have exclusive jurisdiction over disputes arising from this DPA, without prejudice to the right of a Data Subject under Article 79 GDPR to bring proceedings in the Member State of their habitual residence.

11.3 Conflict

Where this DPA conflicts with any other agreement between the Parties on the subject of Personal Data, this DPA prevails.

11.4 Amendments

The Processor may amend this DPA to reflect changes in Applicable Data Protection Law, giving the Controller at least 30 days notice of a material change.

11.5 Severability

If a provision of this DPA is invalid or unenforceable, the rest remains in force.

Annex A. Description of the processing

Annex B. Sub-Processors

The Processor engages Sub-Processors in the categories below.

Named Sub-Processors as at 24 September 2026 follow. This list is not closed, and Section 5.4 governs how it changes.

B.1 Used for every Controller

B.2 Used only if the Controller turns on the feature

Where the Controller supplies its own model provider key or subscription, that provider is not listed here. See Section 5.5.

Annex C. Technical and organisational measures

1. Encryption

• TLS 1.2 or higher for all data in transit, including to every Sub-Processor.
• Encryption at rest for the database and for backups.
• Credentials for Connected Systems held encrypted and never shown back to the user.

2. Access control

• Multi-factor authentication for administrative access.
• Access to Personal Data limited to authorised personnel on a need-to-know basis.
• Access removed promptly when a role changes or ends.
• Each Controller's data is separated by organisation, and every query is scoped to the organisation of the authenticated user.

3. Agent permissions

• Each Automation reaches only the Connected Systems the Controller grants it.
• Each Action type is either gated by human approval or explicitly allowed to run without it, on the Controller's configuration.
• Spend and rate limits per thread.

4. Network security

• Firewall rules that limit exposure.
• Hosting in Hetzner data centres in Germany, certified to ISO 27001.

5. Application security

• Periodic internal security testing.
• Input validation and output encoding.
• Dependency updates.

6. Physical security

Provided by Hetzner's ISO 27001 certified data centres in Germany, including access control, surveillance and environmental controls.

7. Logging and audit

• Every proposed plan, approval, and executed Action is recorded with its actor and timestamp.
• Access to systems and anomalies are logged.

8. Data management

• Data minimisation in what is sent to each Sub-Processor.
• Zero data retention settings on the model routing path where the provider offers them.
• Secure deletion at the end of the retention period.

9. Incident management

• Documented incident response procedure.
• Notification to the Controller within 48 hours.
• Review and remediation after any incident.

10. Continuity

• Encrypted backups, 30 days rolling.
• Restoration tested periodically.

11. Organisational

• Confidentiality obligations for everyone with access to Personal Data.
• Record of processing activities under Article 30 GDPR.
• Privacy by design and by default in how the Service is built.

Contact

Notnull, Unipessoal, Lda Rua Campo Alegre, N.º 1636, h42, 4150-176 Porto, Portugal

Data protection: [email protected] Support: [email protected]