This Data Processing Agreement (DPA) applies between the customer (controller) and Shopsy AS (processor) when the customer processes personal data about its own employees, customers and contacts using Onebase. It satisfies the requirements of GDPR Article 28.
Version: 2026.05.01
Summary
- Nature and purpose of processing: Delivery of Onebase as a service, including storage, retrieval, analytics and communication features
- Categories of personal data: Contact information, names, email, phone, job title, notes and activity related to the customer's contacts and employees
- Categories of data subjects: The customer's own employees, customers, suppliers and business contacts
- Duration: For the duration of the customer relationship + 90 days post-termination retention (see privacy policy)
- Subprocessors: See /trust/subprocessors — general prior authorization with 30-day change notice
- Security measures: See /trust/security
- Breach notification: Within 24 hours of Shopsy AS becoming aware of the breach
Acceptance
For paid customers, this DPA is deemed entered into upon acceptance of the terms of service. A signed counterpart may be requested by emailing [email protected]. Larger enterprises that require a counter-signed copy for their own records can request one in the same email.
Standard Contractual Clauses (SCCs)
Where Onebase or a subprocessor transfers personal data outside the EEA, the European Commission's Standard Contractual Clauses (Module 2 — controller to processor) form an annex to this DPA. Per-vendor transfer mechanisms are listed at /trust/subprocessors.
Complete Text
The complete agreement text with all annexes is available as PDF. The version is reviewed by legal counsel prior to publication.
In progress: a PDF version with annexes will be published here after legal review. Email [email protected] for the current draft.
Changes
Material changes are announced at least 30 days in advance by email to the tenant administrator. Minor editorial revisions are published directly with an updated version number.