Data Processing Addendum

1. Who is who

This addendum forms part of the Terms of Service between you and Darren Xerri trading as STILL., 67, Main Street, Xewkija, Gozo, Malta ("STILL.", "we"). It applies to the personal information about other people that you store in STILL., such as your clients and property owners ("Customer Data").

• You are the controller of Customer Data. For an individual account that is you. For a team it is the company, acting through its admin's account; members use STILL. on the company's behalf.
• STILL. is your processor. We process Customer Data only to provide STILL. to you, apart from the anonymous figures section 3 allows.

It meets article 28 of the EU General Data Protection Regulation (GDPR). If it conflicts with the Terms, this addendum wins for Customer Data.

2. What we process (Annex I)

• Subject matter and purpose: storing, showing, matching, reminding about, sharing within your team, backing up and deleting Customer Data, so you can use STILL.
• Duration: for as long as your account exists, then as set out in section 10.
• Types of data: names, phone numbers, email addresses, budgets and prices, property details, addresses and map pins, areas, notes, follow-up dates and history, and anything else you choose to type in.
• People concerned: your clients and prospective clients, property owners and developers, their contact people, and anyone else you record.
• Sensitive data: not intended; you agree not to store it (section 12).

3. Only on your instructions

We process Customer Data only on your documented instructions, which are these terms and the way you use the app, including for any transfer outside the EU. If the law ever requires us to do otherwise, we will tell you first unless the law forbids it. If we believe an instruction breaks data protection law, we will tell you.

Anonymous statistics. You also allow us to create anonymous, combined figures about how STILL. is used (for example how many follow-ups are done, or how long new leads wait for a first contact). They are counts and times only, never contain Customer Data itself, and cannot identify you or the people in your records. Such figures are not Customer Data and we may keep and use them to improve STILL. and to describe what it does.

4. Confidentiality

Only Darren Xerri has administrator access, and only to the extent needed to run and support STILL. Anyone else we ever authorise will be bound by confidentiality.

We access Customer Data only on your instructions. For support, that instruction is the one-time code you create in Settings (Security, Support access): it gives us read-only access to your records for no more than 24 hours, ending sooner when you stop it or when we have finished; in a team only the admin can create it. You are emailed when access starts, and every step is written in a support log you can see and that cannot be changed or deleted. The log is kept for 5 years and contains no Customer Data.

5. Security (Annex II)

• All traffic encrypted in transit (HTTPS / TLS); data stored by our database provider with encryption at rest.
• In addition, the personal details of clients and owners (name, mobile number, email address, notes, address and named contacts) are encrypted in the app with AES-256-GCM before they are stored. Encryption keys are managed by STILL.: one per account and one per team, kept in the database and released only to that account or team (and, for support, only after the customer's code). Other fields (for example prices, areas, property types and dates) are stored readable because the service needs them.
• Change history keeps no readable personal details of encrypted records; older history is cleared of them nightly.
• Database rules that let each account reach only its own records and its team's, as the team's settings allow.
• Hashed passwords, optional app PIN and Face ID / fingerprint lock, a limit of two devices per account, and automatic sign-out of removed devices.
• Records deleted by team members kept in the admin's Recycle Bin for 90 days; regular backups by our provider.
• Administrator access limited to Darren Xerri, protected by two-step sign-in; problem reports kept without client details where possible.
• A safety brake that stops large numbers of records being deleted at once from the app, and daily backups kept for 7 days.

6. Sub-processors (Annex III)

You authorise us to use these sub-processors for Customer Data:

• Supabase (Supabase Pte. Ltd.), on Amazon Web Services: database, sign-in, server functions and backups; data stored in Ireland (EU).
• Vercel (Vercel Inc., USA): hosting and delivery of the app.
• Resend (Resend Inc., USA): sending emails, where an email contains Customer Data (for example a team invitation).
• Push services of Google, Apple and Mozilla: delivering notifications; messages are encrypted for the device.

Each is bound by written terms giving Customer Data the same protection as this addendum, and we remain responsible to you for them. We will tell account owners by email at least 30 days before adding or replacing a sub-processor, and keep this list up to date. If you object on reasonable data protection grounds and we cannot address it, you may end your plan before the change and receive a refund for the time you have not used.

7. Transfers outside the EU

Customer Data is stored in the EU. Where a sub-processor accesses it from outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. If you are based outside the EEA, the Standard Contractual Clauses (module 4, processor to controller) apply between us where needed.

8. Helping you with requests

The app lets you find, correct, export and delete Customer Data yourself, which is how you answer most requests from the people concerned. If a request reaches us directly, we pass it to you without delay and do not answer it ourselves unless you ask. We will also give reasonable help with security, breach notifications, data protection impact assessments and consultations with the authority, taking into account the information available to us.

9. Data breaches

If we become aware of a breach of security affecting Customer Data, we will tell you within 48 hours, by email, with what we know: what happened, what data and how many people are likely to be affected, the likely consequences, and what we have done and recommend. We will update you as we learn more, so you can meet your own duty to notify the authority within 72 hours where required.

10. When your account ends

You can export Customer Data at any time (Settings, Backup & Restore). If you delete your account, Customer Data is deleted straight away. If your plan ends without the account being deleted, it is kept so you can return or export it, then deleted: 90 days after a free trial that was never paid for, 180 days after a cancelled plan, 365 days after a cancelled team plan, each counted from the last time the account was used and followed by a 30-day safety hold. Copies in our provider's backups are removed within 30 days of deletion. We keep nothing afterwards unless the law requires it, apart from the support log described in section 4, which contains no Customer Data.

11. Information and audits

We will give you the information reasonably needed to show that we meet this addendum, including our sub-processors' own security reports where available. If that is not enough, you may audit our compliance once a year, at your cost, with 30 days' notice, in a way that protects other customers' data and our providers' security.

12. Your promises

• You have a lawful basis for each record you store and for contacting the people concerned (for example a request for property services, or their consent for messages).
• You tell your clients and owners, in your own privacy notice, that you use a contacts app (STILL.) to keep their details.
• You do not store sensitive information (health, religion, political views, criminal records and similar) or ID card numbers.
• You only import contacts you are allowed to use, and you answer the requests of the people whose data you store.
• In a team, the admin decides who is given access and is responsible for the members' use.

13. Liability and law

Each party's liability under this addendum follows the Terms of Service, except where the law does not allow it to be limited. This addendum is governed by the laws of Malta. Questions: support@stillers.io.