Data Processing Agreement
When you upload research data containing personal data, such as interview transcripts, recordings or survey answers, you are the controller and we process it only on your behalf. This agreement sets out the commitments GDPR article 28 requires. It is part of our Terms of Service and applies automatically. You do not need to sign anything.
1. Parties and scope
This Data Processing Agreement ("DPA") is between the customer who accepted the Terms of Service (the "Controller") and [FULL LEGAL NAME], NIF [NIF], [STREET, POSTCODE CITY, SPAIN] (the "Processor"). It applies to personal data contained in content the Controller uploads to or creates in Codex ("Customer Personal Data"). Account and billing data, for which the Processor is itself a controller, is covered by the Privacy Policy instead.
2. Details of the processing
| Subject matter | Hosting and operating the Codex qualitative data analysis service. |
|---|---|
| Duration | For the term of the Terms of Service, plus the deletion period in section 9. |
| Nature and purpose | Storage, display, indexing and search, transcription, AI-assisted analysis at the Controller's request, sharing with people the Controller authorises, backup, export and deletion. |
| Types of personal data | Whatever the Controller uploads, typically names, contact details, demographic information, opinions, experiences, voice recordings and images in interviews, focus groups, surveys, field notes and documents. This may include special category data (GDPR art. 9) if the Controller chooses to upload it. |
| Data subjects | Research participants, respondents, and other people mentioned in or depicted by the Controller's content. Also the Controller's collaborators. |
3. Processing only on instructions
The Processor processes Customer Personal Data only on the Controller's documented instructions. These consist of the Terms of Service, this DPA and the Controller's use and configuration of the Service. The only exception is where EU or Member State law requires otherwise, in which case the Processor informs the Controller first unless that law forbids it. The Processor immediately informs the Controller if it believes an instruction infringes data protection law. It never uses Customer Personal Data for its own purposes, such as advertising, profiling or training AI models.
4. Confidentiality
Anyone the Processor authorises to process Customer Personal Data is bound by confidentiality. Customer content is accessed only when needed to provide support the Controller requested, to keep the Service secure, or to comply with the law.
5. Security (GDPR art. 32)
The Processor maintains at least the following technical and organisational measures:
- Encryption in transit (TLS) for all connections between users and the Service.
- Per-project access control enforced on every request. Private object storage served only through permission-checked endpoints. Database records are readable only by authorised project members.
- Passwords stored only as salted hashes. Sessions held in HTTP-only cookies. Rate limiting on authentication and public endpoints.
- Hosting in EU data centres. Internal services (database, cache, search) are not exposed to the internet and run with separate credentials.
- Public share links that are unguessable, expire, can be revoked and can be password-protected. Access attempts are logged for the project owner.
- Regular backups with a tested restore procedure, and backup retention limited to 30 days.
- Error monitoring that is self-hosted in the EU and configured not to send user identifiers.
- Least-privilege administrative access, and dependency updates monitored automatically.
6. Sub-processors
The Controller gives general authorisation for the Processor to engage the sub-processors below. The Processor imposes on each of them data protection obligations equivalent to this DPA (GDPR art. 28(4)) and remains responsible for their performance. AI providers receive Customer Personal Data only when the Controller or its users run an AI feature.
| Sub-processor | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| [EU HOSTING PROVIDER, e.g. Hetzner Online GmbH] | Hosting of the application, database, file storage, search index, cache, AI gateway and error monitoring | European Union | Data stays in the EU |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | AI features: text analysis, transcription and embeddings for content you submit to an AI feature | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses; API data is not used for model training |
| Anthropic PBC / Anthropic Ireland Ltd | AI features: text analysis for content you submit to an AI feature | United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses; API data is not used for model training |
| Stripe Payments Europe, Ltd. | Payment processing and invoicing for paid plans | Ireland (with transfers to Stripe, Inc., United States) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Mailgun Technologies, Inc. (EU region) | Transactional email: email verification and password resets | European Union (EU region), with access from the United States | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
The Processor will announce any new or replacement sub-processor at least 30 days in advance by updating this page and emailing account owners on paid plans. The Controller may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Controller may terminate the affected service and receive a pro-rata refund of prepaid fees.
7. International transfers
Customer Personal Data is stored in the EU. Where a sub-processor processes it outside the EEA, the transfer is covered by an adequacy decision (including the EU–U.S. Data Privacy Framework for certified recipients) or by the European Commission's Standard Contractual Clauses, with supplementary measures where needed.
8. Assistance to the Controller
- Data subject requests. The Service lets the Controller find, export, correct and delete content itself. If a data subject contacts the Processor directly, the Processor forwards the request to the Controller without undue delay and does not answer it itself unless instructed to.
- Personal data breaches. The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware of a breach affecting Customer Personal Data. The notice includes the information available under GDPR art. 33(3).
- Impact assessments. The Processor gives reasonable help with data protection impact assessments and prior consultations (GDPR arts. 35 and 36), taking into account the nature of the processing and the information available to it.
9. Deletion and return of data
The Controller can export its content at any time, and delete individual projects or its whole account. Deletion takes effect immediately in the live system. Deleted data is removed from backups as they rotate, within 30 days. When the agreement ends, the Processor deletes remaining Customer Personal Data in the same way, unless EU or Member State law requires it to be kept.
10. Information and audits
The Processor makes available the information needed to demonstrate compliance with GDPR art. 28. It allows for and contributes to audits by the Controller, or by an independent auditor the Controller appoints, at most once a year unless a supervisory authority requires otherwise or a breach has occurred. Audits require 30 days' written notice, take place during business hours, are bound by confidentiality and must not compromise other customers' data. The Controller bears its own costs.
11. Controller's responsibilities
The Controller is responsible for the lawfulness of the processing it instructs. This includes having a legal basis, informing data subjects, obtaining any required consent or ethics approval, and deciding whether to use AI features on the content in question.
12. General
If this DPA conflicts with the Terms of Service on the protection of Customer Personal Data, this DPA prevails. Liability under this DPA is subject to the liability section of the Terms of Service, except where the law does not allow that limitation. To request a countersigned copy, write to [privacy@your-domain].