1. Requesting a DPA
Email legal@chartbuddy.io with your legal entity name, registered address, and the products you plan to use. We will send our standard Data Processing Addendum for signature, normally within two business days. There is no charge, and you do not need to be on a particular plan to ask for one.
If your organization requires us to sign your own DPA instead, send it with your request. We will review it and come back with any comments.
2. When you need one
You need a DPA where Chartbuddy processes personal data on your behalf and you are the controller of that data. In practice this means you have a Chartbuddy account, or your organization does, and we process Customer Content when providing Hub or Chartbuddy for Google Slides.
You do not need a DPA to use Chartbuddy Embed. The Remote MCP connector is not a schedule in the Master Subscription Agreement. If you use it, the public Terms and Privacy Policy apply.
3. What the DPA covers
Our standard DPA is drafted as a controller to processor agreement under Article 28 GDPR. It covers:
- The subject matter, nature, purpose, and duration of processing, described per product
- The categories of personal data and data subjects involved
- Our obligation to process only on your documented instructions
- Technical and organizational security measures
- Confidentiality obligations on our personnel
- Subprocessor authorization, our current list, notice of changes, and your right to object
- Assistance with data subject requests, impact assessments, and consultations with supervisory authorities
- Audit rights, including documentation of controls on request
- Personal data breach notification without undue delay
- Return and deletion of personal data on termination
- Data transfer mechanisms, including the European Commission's Standard Contractual Clauses where relevant
4. Enterprise agreements
If you sign a Master Subscription Agreement with us, the DPA is included as an exhibit and you do not need to request it separately. Where you have executed such an agreement, it governs in place of any conflicting provision in our Terms of Use.
5. Security documentation
Alongside a DPA we can provide, under NDA, our security overview, a completed security questionnaire, and our certificate of insurance. Our Security page describes our controls for each product. To report a vulnerability, email security@chartbuddy.io.
6. Contact
- DPA requests and legal: legal@chartbuddy.io
- Data protection contact: tim@chartbuddy.io
- Security: security@chartbuddy.io