Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is entered into between the customer using Bungaflow ("Data Controller" or "Controller") and Redor AS, organization number [pending registration], operating the Bungaflow platform ("Data Processor" or "Processor").

This DPA governs the Processor's processing of personal data on behalf of the Controller in accordance with the General Data Protection Regulation (GDPR), in particular Article 28. The DPA forms an integral part of the service agreement between the parties and supplements the Privacy Policy and Terms of Use.

2. Definitions

• Personal data: Any information relating to an identified or identifiable natural person.
• Processing: Any operation performed on personal data, including collection, storage, modification, retrieval, disclosure, or deletion.
• Controller: The party that determines the purposes and means of the processing of personal data (the customer — unit owner or organization admin).
• Processor: The party that processes personal data on behalf of the Controller (Redor AS / Bungaflow).
• Sub-processor: A third party engaged by the Processor to carry out specific processing activities.
• Data subject: The individual whose personal data is being processed.
• Supervisory authority: The independent public authority responsible for monitoring the application of data protection legislation (in Norway: Datatilsynet).

3. Subject matter and duration

The Processor processes personal data on behalf of the Controller for the purpose of providing the Bungaflow platform, including but not limited to: booking management, expense splitting, task management, messaging, maintenance logging, document storage, guest portal, AI assistant, and related features.

The processing lasts for as long as the Controller maintains an active account on the Bungaflow platform. Upon termination or deletion of the account, processing ceases and data is deleted in accordance with Section 12 of this agreement.

4. Types of personal data processed

The Processor processes the following categories of personal data on behalf of the Controller:

• Names and email addresses of unit members
• Booking data (dates, types, member associations)
• Expense data (amounts, descriptions, receipt images)
• Messages and guestbook entries
• Maintenance logs
• Task assignments
• Guest portal data (guest names, check-in information)
• WiFi passwords (encrypted with AES-256-GCM)
• AI chat conversations
• Push notification subscriptions
• Activity logs

5. Categories of data subjects

The processing concerns the following categories of data subjects:

• Unit members (administrators and lite members)
• Guests (via the guest portal)
• Organization members

6. Processor's obligations

The Processor shall:

• Process personal data only on documented instructions from the Controller, unless required by EU or member state law.
• Ensure that persons authorized to process personal data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:
  • TLS encryption for all data in transit
  • AES-256-GCM encryption for sensitive fields (e.g., WiFi passwords)
  • HSTS and Content Security Policy headers
  • Role-based access control (Admin / Lite member roles)
  • Automated CI/CD pipeline with security scanning
  • Database-level row security and cascade deletion policies
• Assist the Controller in fulfilling data subject requests, including the right to access, rectification, erasure, data portability, and restriction of processing.
• Assist the Controller in ensuring compliance with Articles 32–36 of the GDPR (security, breach notification, data protection impact assessments).
• At the Controller's choice, delete or return all personal data after the end of the service, and delete existing copies unless EU or member state law requires storage. Account deletion removes all unit data via cascade delete.
• Make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in GDPR Article 28.

7. Sub-processors

The Controller provides general authorization for the Processor to engage the following sub-processors:

The Processor shall inform the Controller of any intended changes regarding the addition or replacement of sub-processors, giving the Controller the opportunity to object to such changes within 14 days of notification.

8. International data transfers

Certain sub-processors (Resend, OpenAI, Vercel edge network) may process personal data outside the EU/EEA. Such transfers are safeguarded by the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs) adopted by the European Commission, in accordance with GDPR Chapter V.

9. Data breach notification

The Processor shall notify the Controller without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach, in accordance with GDPR Article 33. The notification shall include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and measures taken or proposed to address the breach.

10. Audit rights

The Controller has the right to audit, or have audited by an independent third party, the Processor's compliance with this DPA and applicable data protection legislation. The Processor shall make available all information necessary to demonstrate compliance and shall cooperate with such audits.

11. Liability

Each party is liable for damages caused by processing that infringes the GDPR in accordance with Article 82. The Processor's total aggregate liability under this DPA is limited to the total fees paid by the Controller to the Processor in the 12 months preceding the event giving rise to the claim.

12. Term and termination

This DPA enters into force when the Controller creates an account on the Bungaflow platform and remains in effect for as long as the Processor processes personal data on behalf of the Controller. Upon termination or deletion of the Controller's account, all personal data is deleted within 30 days. Deletion is carried out via cascade delete, which removes all associated unit data (bookings, expenses, members, messages, tasks, documents, etc.).

13. Contact

For questions regarding this Data Processing Agreement or the processing of personal data, please contact us at privacy@bungaflow.com.