Data processing agreement (DPA)
Version 2027-01, in force from 20 October 2026 — Article 28 of the GDPR and the Swiss Federal Act on Data Protection (FADP)
This agreement forms part of the terms and conditions. It applies to the personal data that the Customer (the controller) records in its Fluidify workspace, processed by 7th World Ltd (the processor).
1. Subject matter and duration
The processor hosts and processes the Customer's data solely to provide the Service described in the terms and conditions, for the duration of the subscription and until the erasure provided for in clause 9.
2. Nature of the data and data subjects
| Data subjects | Data |
|---|---|
| The Customer's customers and prospects, and their contacts | identity, contact details, site addresses, correspondence, quotes, invoices, payments |
| The Customer's employees and users | identity, email, phone, role, time clocking and timesheets, certifications, signatures, photos taken during service jobs |
| Signatories of reports | name, position, signature |
The Service is not designed for sensitive data within the meaning of Article 9 of the GDPR; the Customer shall refrain from recording any.
3. Instructions
The processor processes the data only on documented instructions from the Customer, consisting of the terms and conditions, this agreement and the use of the Service. It informs the Customer if an instruction appears to it to infringe the regulations.
4. Confidentiality
The persons authorised to access the data (7th World Ltd operators) are bound by an obligation of confidentiality. Their access is limited to what support and operations require, and is logged.
5. Security
The processor implements, in particular:
- a dedicated virtual server per Customer, with no shared database;
- encryption of communications (HTTPS) and of backups;
- sign-in by single-use code, time-limited and revocable sessions, role-based permissions and an audit log;
- daily backups to a separate append-only server, and tested restores;
- application of security patches, and updates with automatic rollback.
6. Sub-processors
The Customer authorises the use of the following sub-processors:
| Sub-processor | Role | Location |
|---|---|---|
| Contabo GmbH | hosting of servers and backups | Germany (EU) |
| Gandi SAS | sending the Service's emails | France (EU) |
The processor informs the Customer by email of any addition or replacement at least 30 days in advance; the Customer may object by cancelling at no cost.
7. Assistance
The processor helps the Customer to respond to requests from data subjects exercising their rights (in particular through the Service's export and editing functions), to carry out an impact assessment where necessary, and to comply with its security obligations.
8. Personal data breach
The processor notifies the Customer of any personal data breach without undue delay, and no later than 48 hours after becoming aware of it, with the information available to enable the Customer to notify the supervisory authority.
9. End of the agreement
At the end of the subscription, the Customer has 15 days of read-only access to export its data. The server is then wiped; the encrypted backups are deleted no later than 12 months after closure.
10. Audit
The processor makes available to the Customer the information necessary to demonstrate compliance with this agreement. An audit may be requested once a year, with 30 days' notice, at the Customer's expense.
11. Transfers
Data is hosted in the European Union. 7th World Ltd is established in the United Kingdom, which benefits from an adequacy decision of the European Commission; access from the United Kingdom is governed by that decision. No other transfer outside the European Union takes place.