ChaseList Data Processing Agreement (DPA)

Last updated: 16 October 2026

This DPA forms part of the ChaseList Terms of Service between the Customer ("Controller" / "Business") and Aurora AI Solutions Studio UG (haftungsbeschränkt), Friedhofstr. 10, 70191 Stuttgart, Germany ("Processor" / "Service Provider"). It applies to personal data contained in Customer Data processed through the Service. It covers the EU/UK GDPR (Art. 28) and, for US customers, service-provider and safeguards obligations under US law (e.g. CCPA/CPRA as amended, FTC Safeguards Rule 16 CFR Part 314, where applicable).

1. Subject matter, duration, nature and purpose

• Subject matter: hosting and processing of documents and contact data so the Customer can request, receive and track documents from its End Clients, and send them reminder emails.
• Duration: the term of the Customer's subscription plus the deletion periods in §10.
• Nature: storage, transmission, display, email delivery, deletion.
• Purpose: solely to provide the Service as instructed by the Customer.

2. Categories of data and data subjects

• Data subjects: the Customer's End Clients and their contact persons; the Customer's users.
• Data: names, email addresses, business names, checklist items. Uploaded documents may include bank and credit-card statements, payroll reports, receipts, tax forms, and therefore financial account information, transaction details, employee pay data and tax identifiers (e.g. SSN/EIN on forms).
• Special categories (Art. 9 GDPR): not intended. The Customer shall not request them.

3. Instructions

The Processor processes personal data only on the Customer's documented instructions. These Terms, this DPA and the Customer's configuration of the Service are the complete instructions. The Processor informs the Customer if it believes an instruction infringes applicable law.

4. US service-provider terms

The Processor shall not (a) sell or share personal information; (b) retain, use or disclose it for any purpose other than providing the Service, including any commercial purpose outside the direct business relationship; (c) combine it with personal information from other sources, except as permitted by law; and it shall (d) notify the Customer if it can no longer meet its obligations. The Processor certifies it understands these restrictions. The Customer may take reasonable steps to stop and remediate unauthorised use.

5. Confidentiality

Persons authorised to process personal data are bound by confidentiality obligations.

6. Security (Art. 32 GDPR / Safeguards Rule)

The Processor implements the technical and organisational measures in Annex 1 and maintains a written information security program appropriate to the nature of the data. Measures may be updated, provided the overall level of protection is not reduced.

7. Sub-processors

The Customer gives general authorisation for the sub-processors listed at chaselist.helloaurora.ai/subprocessors. The Processor will give at least 30 days' notice of new sub-processors by email or on that page. The Customer may object on reasonable data-protection grounds; if no solution is found, the Customer may terminate and receive a pro-rata refund. The Processor imposes data-protection obligations on sub-processors equivalent to this DPA and remains liable for them.

8. International transfers

The Processor is established in the EU. Where personal data is transferred to the Customer outside the EEA, Module 4 (processor-to-controller) of the EU Standard Contractual Clauses (Decision 2021/914) is incorporated by reference. Transfers to sub-processors in third countries rely on the EU–US Data Privacy Framework or Standard Contractual Clauses (Module 3).

9. Assistance, breaches and audits

9.1 The Processor assists the Customer with data-subject requests, DPIAs and consultations to the extent the Service allows (export, deletion, correction in the UI). 9.2 Security incidents: the Processor notifies the Customer without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting Customer personal data. The notice includes the information available to support the Customer's own notification obligations (e.g. GDPR Art. 33, US state breach laws, FTC Safeguards Rule notification). 9.3 Audits: the Processor makes available the information needed to demonstrate compliance (this DPA, Annex 1, a security questionnaire answer once a year). On-site audits only with 30 days' notice, at the Customer's cost, once a year, unless there has been a breach.

10. Deletion and return

On termination the Customer can export its data for 30 days. The Processor then deletes Customer personal data within 30 days, and from backups within 30 days, unless EU or member-state law requires storage. Automatic file deletion during the term follows the Customer's retention setting.

11. Liability and precedence

Liability under this DPA is subject to the limitations in the Terms, to the extent permitted by law. If this DPA conflicts with the Terms, the DPA prevails. If it conflicts with the SCCs, the SCCs prevail.

Annex 1 — Technical and organisational measures (summary)

• Encryption in transit (TLS 1.2+) and at rest (AES-256, managed by hosting providers).
• Private storage buckets. Downloads only via short-lived signed URLs (≤5 min).
• Upload links: 256-bit random tokens, stored only as SHA-256 hashes, expire (45 days) and rotate on each reminder. Pages are excluded from search indexing.
• Row-level security: each Customer can access only its own records.
• Access control: least privilege, MFA on all admin accounts (hosting, database, email, payments, code repository). No shared credentials.
• File type and size allow-list. Uploads are stored inert and never executed or rendered by the Service.
• Logging of uploads, downloads and admin actions. Monitoring and alerting.
• Backups by the database provider. Restore procedure tested at least twice a year.
• Configurable retention and automatic deletion. Secure deletion on termination.
• Written incident-response procedure. Breach notice within 48 h.
• Vendor management: sub-processors under DPAs, reviewed yearly.
• Personnel: confidentiality obligations, security awareness.