Under the GDPR, the UK GDPR and PIPEDA, the organisation that collects personal data stays responsible for it when a provider processes it on its behalf. This page explains what we do as your provider, for companies in the EU, the UK and Canada: what we sign, where your data is processed, how it can lawfully reach us, and how we protect it. Every document named here is public, so you can read it before the first call.
What we are. An EU processor, under the GDPR
Amazing Soft is a software company in Bucharest, Romania, an EU member state. When we build or maintain an app or a system that holds your users’ data, we process it on your behalf, as a processor. You remain the controller. As a processor established in the EU, we are directly bound by the GDPR’s processor obligations, wherever you are based.
What we sign. A public data processing agreement
- The agreement applies automatically. Our data processing agreement is the contract Article 28(3) of the GDPR requires between a controller and a processor. It applies to every contract under our Terms of Service, without a separate signature.
- You can sign it as a separate document. Use the one-page accession form, or ask to sign the Commission’s standard contractual clauses between controllers and processors (Implementing Decision (EU) 2021/915), with which our agreement is aligned.
- The sub-processors are listed publicly. Each one is listed with its entity, country, purpose, data location and transfer mechanism.
- AI model providers do not train on your data. For your data, we use only commercial plans or APIs under which the provider contractually undertakes not to train models on the data we send. Every AI provider we use is on the sub-processor list.
Where your data is processed. The European Economic Area
Client data is processed in the European Economic Area. Our own servers are in Germany, and our code and project documentation are kept in our own GitLab instance there. Data leaves the EEA only to a sub-processor on the public list, or on your instructions, and always under Chapter V of the GDPR: an adequacy decision, the EU–US Data Privacy Framework or the Commission’s standard contractual clauses (Decision (EU) 2021/914). The list shows which one applies to each provider.
For UK companies. UK GDPR
For a company in the UK, sending personal data to us is a transfer under the UK GDPR. UK law treats EEA countries as providing adequate protection (Data Protection Act 2018, Schedule 21), so data can flow from the UK to us without additional safeguards. A transfer to us does not need a contractual instrument. If your own policies require one, we sign the UK International Data Transfer Addendum to the EU standard contractual clauses on request.
In the other direction, the European Commission renewed its adequacy decision for the UK in December 2025 (Implementing Decision (EU) 2025/2574).
For Canadian companies. PIPEDA compliance
Under PIPEDA, an organisation is responsible for personal information it transfers to a third party for processing. It must use contractual or other means to provide a comparable level of protection while the third party processes the information (PIPEDA, Schedule 1, clause 4.1.3).
Our data processing agreement is the contract under which we process your data. It limits processing to your instructions, binds us to confidentiality and security measures, governs sub-processors, and requires us to return or delete the data at the end (article 13). Whether it is sufficient for your PIPEDA accountability is your assessment. We answer the questions it raises.
- Transparency. The Office of the Privacy Commissioner’s guidelines on cross-border processing (2009) say organisations should make it plain to individuals that their information may be processed in a foreign country.
- Breaches. Under PIPEDA (section 10.1), the organisation in control of the information reports to the Commissioner, and notifies the individuals, any breach that creates a real risk of significant harm. We notify you within 48 hours of becoming aware of a breach affecting your data (data processing agreement, article 12.2), with what we know at that point.
- Québec. For organisations subject to Québec’s private-sector privacy law, as amended by Law 25, we provide the information a privacy impact assessment needs: the sub-processor list, our security measures and answers to your questionnaire.
- Additional terms. If your legislation requires additional contractual terms, such as a transfer annex, we sign them on request, provided they do not contradict our data processing agreement (article 11.3).
You remain accountable for the personal information you transfer to us for processing (PIPEDA, Schedule 1, clause 4.1.3). We do not give legal advice. We give you the documents and the answers your assessment needs.
For EU companies. The same rules as at home
For a company in the EU, sending data to us is not a transfer under Chapter V of the GDPR. The GDPR applies on both sides, and our data processing agreement covers the processing.
How we protect it. Security, with a named owner
- Accountable at the top. One of our Managing Partners is accountable for security and holds the PECB Chief Information Security Officer certification, issued in September 2026 and valid until September 2029, which you can verify with the issuer.
- Code and documentation in our own instance. Projects live in our self-hosted GitLab in Germany, not on individual laptops, so a project can be resumed if a device is lost.
- Measures in writing. The confidentiality and security obligations we accept as your processor are set out in our data processing agreement, which you can read before the first call.
- Breach notice. We notify you within 48 hours of becoming aware of a breach that affects your data, and we assist you with notifying the authority and the people affected.
- At the end of the contract. Your personal data is returned or deleted, at your choice, as the data processing agreement sets out.
Questions. Short answers
How does Amazing Soft support our PIPEDA compliance?
We give you what a provider can contribute to your PIPEDA accountability: a data processing agreement that governs how we process your data, a public sub-processor list, breach notice within 48 hours, and answers to your assessment. You remain accountable for the information you transfer to us (Schedule 1, clause 4.1.3).
Does the GDPR apply to a software company in Romania?
Yes. Romania has been an EU member state since 1 January 2007. As a processor established there, we are directly bound by the GDPR.
Can you sign the UK International Data Transfer Addendum?
Yes, on request, alongside our data processing agreement. A transfer from the UK to us does not require it, because UK law treats the EEA as adequate.
Where is our data stored?
In the European Economic Area. Our own servers are in Germany. Any provider outside the EEA is on our public sub-processor list, with the transfer mechanism used.
How quickly do you report a data breach?
We notify you without undue delay, and no later than 48 hours after we become aware of a breach that affects your data.
Do AI providers train models on our data?
No. We use only commercial plans or APIs under which the provider contractually undertakes not to train on the data we send.
Related: for companies in Canada and the US, for companies in the UK and the EU, and fixed price or time and materials.