This Data Processing Agreement ("DPA") forms part of the WrapSnap Terms of Service and applies when WrapSnap processes Personal Data on your behalf in connection with the Service.
1. Definitions
"Personal Data", "Processing", "Controller", "Processor", "Data Subject" have the meanings set out in UK GDPR and EU GDPR.
2. Roles
You are the Controller of Personal Data uploaded to the Service (e.g. your customers' information). WrapSnap is the Processor. WrapSnap is also a Controller of account-related data (your email, billing, usage).
3. Subject matter + duration
Processing occurs throughout the term of your subscription and for 60 days afterwards (then deletion). The categories of data are: contact details, quote content, communication metadata.
4. Security measures
WrapSnap implements technical and organisational measures including:
- Postgres row-level security on every tenant-scoped table
- 5-layer tenant isolation defence
- Magic-link authentication with optional 2FA
- Encryption in transit (TLS 1.3) + at rest (AES-256)
- Audit log on every action
- UK-hosted data residency
- Regular dependency security scanning
- Restricted internal access on a need-to-know basis
5. Sub-processors
We use the sub-processors listed in our Privacy Policy §4. We will notify you 30 days before adding or removing a sub-processor; you may object in writing.
6. International transfers
Personal Data may be accessed from Poland (our data controller location) under the UK→EU adequacy decision. No data is transferred outside the UK/EU.
7. Assistance with Data Subject requests
We will help you fulfil your obligations to Data Subjects. Email privacy@wrapsnap.app with the request and we will respond within 5 working days.
8. Data Breach notification
We will notify you of any personal data breach within 72 hours of becoming aware, with details of the nature, categories, approximate number of records, likely consequences, and remedial measures taken.
9. End of processing
Upon termination of the subscription, all Personal Data is deleted within 60 days unless you request earlier deletion or export.