Data Processing Agreement

This Data Processing Agreement is made between the customer who accepts the MyPIF Terms of Service (you) and Aeternus Progressus, Lda. (we, us). We are a private limited company (sociedade por quotas) with registered office at Rua dos 3 Lagares, N.º 1, Incubadora Fablab, 6230-421 Fundão, Portugal, registered at the Conservatória do Registo Comercial de Lisboa under number 518337952, which is also our tax number (NIPC). Share capital: €2,500. EU VAT number: PT518337952. Contact: geral@mypif.eu.

This agreement forms part of the Terms of Service published at mypif.eu/service-terms and is accepted with them. It takes effect when you accept the Terms of Service and applies for as long as we process personal data for you, including the exit periods in the section on deletion and return.

If this agreement and the Terms of Service conflict on the protection of personal data, this agreement prevails. If this agreement and the Standard Contractual Clauses named in the section on international transfers conflict, those Clauses prevail.

This agreement meets the requirements of Article 28 of Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and of Portuguese Law 58/2019.

It applies to personal data contained in your content, where you decide why and how that data is processed (you are the controller) or you act on behalf of another controller. We call this data Customer Personal Data. Your content means the files you upload, the data extracted from them, your edits, the versions, translations, scores, AI suggestions and pages the service produces from them, and your sharing settings and recipient lists.

It does not cover the personal data we process for our own purposes as controller, such as your account details, billing records, support correspondence and security logs. Our Privacy Policy at mypif.eu/privacy describes that processing.

If you are a consumer using MyPIF for purely personal or household purposes, the GDPR does not apply to your own processing (Article 2(2)(c)). In that case we handle the personal data in your content as our Privacy Policy describes, with the same security measures and providers as this agreement sets out.

The processing we carry out for you is as follows (GDPR Article 28(3)).

As controller, you are responsible for having a lawful basis for the personal data you put into MyPIF, for publishing it or sharing it, and for informing the people concerned, including the people named in your PIFs (GDPR Articles 13 and 14). Your instructions to us must comply with data protection law.

We process Customer Personal Data only on your documented instructions, including with regard to transfers to countries outside the European Economic Area (EEA). Your instructions are the Terms of Service, this agreement, and the choices you make in the service: uploading, editing, translating, scoring, publishing, sharing, exporting and deleting. You can give further instructions in writing to geral@mypif.eu. If an instruction would need work that the service does not offer, we may decline it, and you may then end the contract.

If EU or Portuguese law requires us to process Customer Personal Data in another way, we tell you before we do so, unless that law forbids it on important grounds of public interest.

We tell you at once if, in our opinion, an instruction infringes the GDPR or other EU or Member State data protection law. We may suspend that instruction until you confirm or change it.

We do not sell Customer Personal Data, use it for our own purposes or use it to train AI models. Our AI provider may not train its models on it either.

Only the members of our staff who need access to Customer Personal Data to provide the service have it, and each of them is bound to confidentiality by contract or by law. That duty continues after they leave.

We look at the content of a PIF only when it is needed to provide the service, to answer a request you make to us, to deal with a report of illegal content, to investigate a security problem, or where the law requires it.

We take the technical and organisational measures required by GDPR Article 32, appropriate to the risk of the processing. Annex 1 describes them. We may change them over time, provided the overall level of protection does not fall.

You give us general written authorisation to engage the sub-processors listed in Annex 2.

At least 30 days before we add or replace a sub-processor, we email the owner of your account and update Annex 2. Within that period you may object in writing to geral@mypif.eu on reasonable grounds relating to data protection. We will then try to meet your objection, for example by not using the new sub-processor for your data. If we cannot, you may end the contract before the change takes effect. If you are on a yearly plan, we refund the unused whole months.

Each sub-processor acts under a written contract with us, named in Annex 2, that contains data protection obligations. We remain fully liable to you for the performance of each sub-processor's obligations (GDPR Article 28(4)).

Customer Personal Data is stored in Ireland, in the European Union. Some of our sub-processors are established outside the EEA, or may access data from outside it, in the United States and Singapore. Annex 2 shows where each one stores and processes data.

We transfer Customer Personal Data outside the EEA only in one of these ways: to an organisation certified under the EU-US Data Privacy Framework, which the European Commission found adequate in Implementing Decision (EU) 2023/1795; or under the Standard Contractual Clauses adopted by the Commission in Implementing Decision (EU) 2021/914, using Module Two (controller to processor) or Module Three (processor to processor) as applicable, as incorporated in that provider's terms. Annex 2 names the safeguard for each provider. You can ask us for a copy of the safeguards at geral@mypif.eu.

If a public authority asks us for Customer Personal Data, we ask it to address you where we can. We tell you of the request promptly, unless the law forbids it. We check whether the request is lawful and challenge it where there are reasonable grounds to do so. If we must disclose, we disclose only the minimum the request lawfully requires.

The service lets you view, correct, export and delete your content yourself, which covers most requests from data subjects under GDPR Articles 15 to 22.

If a person contacts us about data in your content, we forward the request to you without undue delay and do not answer it ourselves, other than to say that we have passed it on, unless the law requires otherwise. Where you cannot answer a request with the tools in the service, we help you by appropriate technical and organisational measures, as far as possible.

Taking into account the nature of the processing and the information available to us, we help you meet your obligations under GDPR Articles 32 to 36: security, personal data breach notification, data protection impact assessments and prior consultation of the supervisory authority. On request, we give you the information about our processing and our measures that you need for this.

If we become aware of a personal data breach affecting Customer Personal Data, we notify you without undue delay and in any case within 48 hours of becoming aware of it. We send the notice to the email address of the owner of your account.

The notice describes, as far as we know at the time: the nature of the breach, including the categories and approximate number of people and records concerned; its likely consequences; the measures we have taken or propose to take, including to limit its effects; and a contact point for more information. Where we cannot give all of this at once, we give it in stages without further undue delay.

We take reasonable steps to contain and investigate the breach, and we help you notify the supervisory authority and the people affected where you must. We do not notify them on your behalf unless you ask us to or the law requires it. Notifying you is not an admission of fault.

While the contract lasts, you can delete any PIF or file in the service. We then erase it from our systems within 30 days.

When the contract ends, including when you switch to another provider, you have a retrieval period of 30 days to export your content in the formats described at mypif.eu/data. If you switch under the Terms of Service, the retrieval period starts when the transitional period ends. At the end of the retrieval period we erase all Customer Personal Data within 30 days and, on request, confirm the erasure to you in writing.

We keep Customer Personal Data after that only if EU or Portuguese law requires it. We would then tell you what we keep and why, and keep protecting it under this agreement.

Copies in our providers' logs and backups are erased as their own retention periods end. Anthropic deletes inputs and outputs within 30 days, except content flagged for a breach of its usage policy, which it may keep for up to 2 years.

On request, we give you the information you need to check that we meet this agreement and GDPR Article 28: a description of our processing and of the measures in Annex 1, the list of sub-processors and the contracts they act under, and reasonable answers to written questions. We answer within 30 days.

If that information is not enough, or a supervisory authority requires it, you may audit our compliance, including by inspection, yourself or through an independent auditor bound by confidentiality. You bear the cost. You must give us at least 30 days' written notice, and the audit takes place during business hours, does not give access to other customers' data, and happens no more than once in any 12 months, except after a personal data breach or at the request of a supervisory authority.

Our providers' own facilities are audited through the reports and audit rights in their contracts with us.

Each party's liability under this agreement is governed by the liability section of the Terms of Service. Nothing in this agreement limits liability that the law does not allow to be limited, or the rights of data subjects under GDPR Article 82.

Changes to the list of sub-processors follow the section on sub-processors. Other changes follow the procedure for changes in the Terms of Service. We do not change this agreement in a way that lowers the protection of Customer Personal Data.

Portuguese law governs this agreement. Disputes go to the courts named in the Terms of Service.

This agreement is published in English and Portuguese. For customers established in Portugal, the Portuguese version prevails.

These are the measures we apply to Customer Personal Data today.

• Encryption in transit. Connections to the website and the app use HTTPS (TLS). Our calls to the AI provider and our other providers are also encrypted in transit.
• Encryption at rest. Data is encrypted at rest by our providers. Supabase states that it encrypts its disks and backups with AES-256.
• Access rules in the database. Row-level security rules limit reading and changing each PIF, and the pages produced from it, to its owner and to the people the owner has shared it with. Uploaded files are kept in a private file store and are opened only through signed links that expire. Only the owner can list, upload, replace or delete the files in their own folder. Users cannot change their own role or plan.
• Sign-in. Accounts are managed by Supabase's authentication service.
• Staff access. Only the members of our staff who need it for their work have access to our provider accounts and to the database, and they are bound to confidentiality.
• Backups. Our database provider makes backups under the plan we hold with it.
• AI processing. Content sent to Anthropic for extraction and scoring (and, once released, translation) travels encrypted. Anthropic may not train its models on it and deletes it within 30 days, except content flagged for a breach of its usage policy, which it may keep for up to 2 years.
• Logs. Our providers keep server logs for short periods, for security and troubleshooting.
• Incidents. We handle security incidents as the section on personal data breaches describes.

We use these sub-processors. We give 30 days' notice of any change, as the section on sub-processors describes.