Data Processing Agreement (DPA)

• Controller: the customer company that signs up for GetUp and uploads its employee, client and supplier data (“Customer”). The Customer determines the purposes and means of the Personal Data it uploads.
• Processor: GetUp (“Provider”, “we”). Processes Personal Data only on the documented instructions of the Customer and as permitted by this DPA.

For Customer Account Data (signup, payment), GetUp acts as a Controller and handles that data under its Privacy Policy.

• Subject matter: hosting, processing and serving employee, client, invoice, shift, payroll, expense and similar operational data uploaded by the Customer.
• Duration: for as long as the Customer's GetUp subscription is active, plus the return/deletion window after termination.
• Nature: storage (Postgres database + file storage), display, search, filtering, reporting, transactional email, payment interface, KSeF integration.
• Purpose: letting the Customer run its multi-company operational, staff, financial and KSeF obligations.
• Categories of data subjects: Customer's employees, clients, business partners, suppliers.
• Categories of personal data: name, contact (email, phone), salary/payroll info, working hours, identifiers (NIP/REGON), address, invoice details, KSeF reference numbers.

GetUp processes Personal Data only:

• (a) on the documented instructions given under this DPA and the Main Agreement,
• (b) unless otherwise required by EU or Polish law,
• (c) to the extent technically necessary to provide the Service.

If we believe an instruction violates GDPR or applicable law, we will inform the Customer promptly (Art. 28(3)(h)).

Connecting a third-party application to the Service, such as an AI assistant through GetUp's connector, is a documented instruction from the Customer to make the data that application requests available to it for reading, for as long as the connection lasts. If the Customer also allows the application to propose changes, GetUp keeps each proposal and carries out a proposed change only once the Customer approves it in the Service; each such approval is a documented instruction from the Customer. If the Customer allows the application to make changes, each change the application requests while the connection lasts is a documented instruction from the Customer, except the erasure of an employee's personal data, which GetUp carries out only once the Customer approves it in the Service. The provider of such an application is not a sub-processor of GetUp but a recipient chosen by the Customer, and the Customer is responsible for its agreement with that provider.

The Customer grants prior general authorisation for the following sub-processors:

• Supabase — database and file storage (Frankfurt)
• Cloudflare — application hosting, CDN, image processing, cookieless web analytics, inbound email routing (support@, quote@, privacy@)
• Anthropic — AI assistant
• OpenAI — AI assistant (fallback model)
• Upstash — caching and rate limiting
• Google — Sign in with Google and Google Calendar sync (when used)
• Stripe — payment processing, subscription management
• Resend — transactional email

When a new sub-processor is added or an existing one replaced, we notify the Customer by email at least 14 days in advance. If the Customer objects within that window, we will seek a reasonable resolution; if none is possible, the Customer may terminate without penalty.

We maintain a written contract with each sub-processor providing a protection level equivalent to Art. 28. The current sub-processor list is always available at /compliance.

GetUp applies at minimum the following measures:

• Encryption in transit: TLS 1.3 on all traffic
• Encryption at rest: AES-256 (Supabase), AES-GCM layer for password hashes
• Access control: role-based authorisation, HMAC-SHA256 signed session tokens, mandatory TOTP 2FA for admins
• Data isolation: server-side access policies (per-company companyId match), Postgres Row Level Security on tenant tables
• Network security: HTTPS-only, CSP, CORS, HMAC webhook signature verification
• Region: Supabase, AWS eu-central-1 (Frankfurt) — database and files within the EU
• Observability: activity log, subscription event log, daily retention cron
• Incident response: written breach playbook + incident register (Art. 33–34)
• Data minimisation: self-service erasure (Art. 17), cascade delete, retention cron

The current, detailed TOM list is always viewable by the Customer at /compliance.

Every GetUp staff member authorised to access Personal Data is under a written confidentiality obligation or bound by statutory confidentiality duties. Access is limited on a need-to-know basis.

GetUp reasonably assists the Customer with responding to data subject requests (access, rectification, erasure, portability, objection) through appropriate technical and organisational measures. Self-service tooling:

• Art. 20 — Portability: /api/account/export JSON dump of all company data
• Art. 17 — Erasure: self-service account deletion on the Subscription page
• Art. 16 — Rectification: in-app edit screens
• Other requests: privacy@getup.dev — answered within 30 days

On becoming aware of a Personal Data breach, GetUp notifies the affected Customer without undue delay and, where feasible, within 24 hours, by email. The notice contains:

• Nature of the breach, categories and approximate number of data subjects
• DPO / contact point: privacy@getup.dev
• Likely consequences
• Measures taken or proposed

Every breach, whether notified or not, is recorded in GetUp's internal incident register (Art. 33(5)).

The Customer has the right to review GetUp's compliance with this DPA once per year. In practice this is satisfied primarily through review of the RoPA, TOM and sub-processor list published at /compliance and, where available, sharing of independent audit reports (e.g. the Supabase, Cloudflare and Stripe SOC 2 reports). On-site audit requires at least 30 days' prior written notice; reasonable confidentiality and cost obligations may apply.

GetUp only transfers data outside the EU subject to appropriate safeguards:

• EU Standard Contractual Clauses (SCC) — 2021 version, Module 2 (Controller–Processor)
• EU-U.S. Data Privacy Framework (DPF) — for certified sub-processors
• Where necessary, a transfer impact assessment (TIA) plus additional technical safeguards

Core data (companies, content, uploaded files) is stored in Supabase's Frankfurt region — in practice most data stays within the EU.

On termination the Customer may choose between:

• (a) Return: Customer may download a data dump via /api/account/export before termination.
• (b) Deletion: If the Customer chooses self-service deletion or gives no other instruction within 30 days of termination, GetUp cascade-deletes all Personal Data — except KSeF metadata and invoice records that must be retained by Polish tax law (5 years).

In the audit trail (subscriptionEvents) companyId is pseudonymised to "__deleted__" so the personal-data link is broken while the event record is preserved.

Matters outside this DPA are governed by the Main Agreement. In case of conflict this DPA prevails. Governing law: English law and directly applicable EU law (GDPR/UK GDPR). Forum: courts of England and Wales — without prejudice to mandatory consumer or small-business protections.

The current version of this DPA is 2026-10-19, published at getup.dev/dpa. Material changes are notified to the Customer by email at least 30 days in advance.

The version accepted by the Customer at signup is recorded on the Account (DPA version, timestamp, IP, user-agent) as an audit trail.