Data Processing Agreement

Snapfritz (snapfritz.com) · under Art. 28 GDPR · Last updated: September 2026

This agreement applies between you as a customer of Snapfritz (controller, the “customer”) and STAYFRITZ SPAIN, S.L., CIF B26591909, Avenida Central, 18, 07184 El Toro, Calvià, Mallorca, Spain (processor, “we”). It supplements the Terms of Service (the terms).

1. Scope and conclusion

• This agreement is part of the terms. It is concluded when they are accepted, on every plan including Free, and needs no separate signature; it is concluded in electronic form (Art. 28(9) GDPR).
• The customer is whoever is the contracting party under section 3 of the terms, so for a company account the company or organisation. The owners of the organisation act for the customer.
• The agreement applies where we process personal data on the customer's behalf when Snapfritz is used. Where a natural person uses Snapfritz purely for personal or household purposes, the GDPR does not apply to that use (Art. 2(2)(c) GDPR) and this agreement has no effect.
• For data we process for our own purposes – account and sign-in, billing, security and abuse prevention, legal obligations – we are the controller ourselves; the Privacy Policy applies to that.

2. Subject matter, nature and purpose of processing

We process the data to provide Snapfritz under the terms: receiving PDF forms (upload, email forwarding, browser extension, API), recognising their text, identifying the fields with the help of an AI model, proposing values from the stored details, placing confirmed values and signatures into the PDF, storing documents, sharing and providing them within the team, learning confirmed answers for recurring forms, keeping a log and sending email notifications.

Nature of processing: collection, storage, retrieval, matching, alteration, transfer to sub-processors, provision and erasure. We do not process the data for any other purpose.

3. Types of data and data subjects

• Data: contents of uploaded documents and forwarded emails (sender, subject, attachments); the text and fields recognised from them, with their values; stored details of the organisation and its members (such as name, address, contact details, position, tax number, VAT ID, IBAN) and images of signatures; learned answers; log data (time, action, acting person, IP address); team data (memberships, roles, invitations, shares).
• Special categories: forms may contain data under Art. 9 GDPR, such as health or social security data. Whether such data is processed is determined solely by the customer through the documents it brings in.
• Data subjects: members of the organisation and people invited to it; customers, employees, business partners and other people whose data appears in the documents; senders of forwarded emails.

4. Duration

The agreement applies for as long as we process personal data on the customer's behalf, that is, until erasure under section 11. Termination is governed by the terms.

5. Instructions

• We process the data only on documented instructions from the customer (Art. 28(3)(a) GDPR), including with regard to transfers to third countries, unless EU or Member State law requires us to process it; in that case we inform the customer of that requirement beforehand, unless the law prohibits this.
• The instructions are set out in the terms and in this agreement. In detail, the customer and its members give them by using the functions of Snapfritz, such as uploading, sharing, signing and deleting. An owner gives further instructions in text form to hola@stayfritz.es; they must be feasible within the scope of Snapfritz.
• If we believe an instruction infringes data protection law, we inform the customer without delay (Art. 28(3), second subparagraph, GDPR) and may suspend carrying it out until the customer confirms or changes it.

6. Confidentiality

People at our company with access to the data are bound to confidentiality or are under a statutory obligation of confidentiality (Art. 28(3)(b) GDPR). They access the customer's content only as far as necessary for operation, fixing faults or support at the customer's request.

7. Technical and organisational measures

We take the measures required by Art. 32 GDPR. Currently these are in particular:

• Encryption: transmission exclusively via HTTPS/TLS. Files in object storage (Cloudflare R2) are encrypted at rest.
• Sign-in: without a password, by emailed code or link or with Google, with limited sign-in attempts. We store session tokens, sign-in codes, links in emails, invitations and API keys only as a check value (hash). Sessions expire after 30 days; the session cookie cannot be read by scripts, is sent only over encrypted connections and is bound to the domain.
• Access control: every access is checked on the server. Organisations are separated from each other; within an organisation, access depends on the document, shares and role. API keys have limited permissions and stop working when their holder leaves the organisation.
• Servers and data flows: the application, database and text recognition run on a server of Hetzner Online GmbH in Nuremberg. We send the AI model (Anthropic) only the recognised text with positions and the file name, not the PDF, the stored details or the signature; Anthropic does not use this content for training.
• Administration: only a few administrators have access to the servers, using SSH keys.
• Traceability: a log records the important steps on every document and the changes to the team.
• Erasure and export: the customer can delete documents, members and the whole organisation itself and export its data.
• Review: we review the measures regularly and adapt them to the state of the art. We may change them as long as the level of protection does not decrease.

8. Sub-processors

The customer authorises the use of the following sub-processors:

• We bind every sub-processor by contract to data protection obligations that essentially correspond to those of this agreement (Art. 28(4) GDPR) and are liable to the customer for it as for our own conduct.
• We announce any new or replacement sub-processor by email to the owners at least 30 days before it is used. The customer may object within that period on data protection grounds. If we cannot resolve the objection, the customer may terminate the contract with effect from when the new sub-processor is used; we refund amounts paid in advance for the time after that pro rata.

9. Transfers to third countries

Data is transferred to countries outside the European Economic Area only under the conditions of Art. 44 et seq. GDPR: on the basis of the adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the basis of the European Commission's standard contractual clauses (Module 3, processor to processor).

10. Assisting the customer

• Data subject rights: we assist the customer with appropriate technical and organisational measures in responding to requests from data subjects (Art. 12–22 GDPR). Much of this the customer does itself in Snapfritz: changing details, deleting documents, exporting data. If a data subject contacts us, we forward the request to the customer where we can identify it and do not answer it without the customer's consent.
• Further obligations: taking into account the nature of processing and the information available to us, we assist the customer with the security of processing, with notifications and communications after personal data breaches, with data protection impact assessments and with prior consultations (Art. 32 to 36 GDPR).
• Personal data breaches: if we become aware of a breach affecting the customer's data, we notify the owners by email without undue delay, with the information under Art. 33(3) GDPR as far as it is available to us; we provide missing information later.

11. Erasure and return

• During the term, the customer can export its data at any time under Settings → Account and download the PDFs in each document.
• If an owner deletes the organisation, we erase its data immediately and permanently, including the stored files. If the contract ends in another way, we erase the data within 30 days of its end. We erase copies in backups no later than 30 days after that. This does not apply where EU or Member State law requires us to store the data.
• Data we process as a controller ourselves (section 1) is kept in accordance with the Privacy Policy, such as the invoices held by Stripe.

12. Evidence and audits

• On request, we provide the customer with the information needed to demonstrate compliance with the obligations under Art. 28 GDPR.
• The customer, or an auditor appointed by it who is bound to confidentiality and is not our competitor, may carry out audits, including inspections. They must be announced in text form at least 30 days in advance, take place during normal business hours and must not disrupt operations disproportionately. For sub-processors, their current certificates or audit reports are generally sufficient.
• The customer bears the costs of an audit unless it reveals a material breach of this agreement.

13. Liability

Liability towards data subjects is governed by Art. 82 GDPR. Between the customer and us, section 11 of the terms applies.

14. The customer's obligations

• The customer is responsible for the lawfulness of the processing, in particular for being entitled to bring the documents and data into Snapfritz and for the data subjects being informed.
• It decides whom it invites to the organisation and with which role, and ensures that access is secure (its members' email and Google accounts and the API keys).
• It informs us without delay if it notices errors or irregularities in the processing.

15. Final provisions

• In the event of conflicts between this agreement and the terms, this agreement prevails on matters of data protection.
• Changes to this agreement are governed by section 13 of the terms; changes of sub-processors by section 8 of this agreement.
• The law under section 14 of the terms applies. The German version prevails; the English version is for information.