Data Processing Agreement
Last updated: October 9, 2026
This Data Processing Agreement ("DPA") governs the processing of personal data by FinSpot as a data processor on behalf of the data controller, in compliance with Article 28 of the EU General Data Protection Regulation (GDPR). This DPA is incorporated by reference into the FinSpot Terms of Service.
1Parties
Data Controller: Override Technologies (privacy@finspot.live). Data Processor: FinSpot Frontend application and associated backend services, hosted on servers of Contabo GmbH in Germany (EU). This DPA is incorporated by reference into the FinSpot Terms of Service and governs the processing of personal data on behalf of the Controller.
2Scope and Nature of Processing
FinSpot processes personal data in connection with the personal finance management platform, including user account management, financial data storage and analysis, payment processing (via Stripe), AI-powered insights (optional), analytics, and email communications. Data categories include identity data, account data, financial data, payment data, technical data, usage data, and communication data. Processing purposes include service delivery, authentication, financial processing, payment facilitation, security, analytics, communication, and legal compliance.
3GDPR Article 28 Compliance
Pursuant to Article 28(3) GDPR, the Processor warrants that: (1) authorized persons are bound by confidentiality or statutory secrecy obligations; (2) sub-processors are engaged only with prior authorization and under the same data protection obligations; (3) appropriate technical and organizational security measures are implemented; (4) the Processor assists the Controller in fulfilling data subject rights; (5) sub-processing requires prior authorization, with general authorization given for subprocessors listed in SUBPROCESSORS.md; (6) data is deleted or returned at the Controller's choice upon service end; (7) the Processor enables audits and inspections.
4Technical and Organizational Measures
Technical measures: TLS 1.2+ for data in transit, AES-256 encryption at rest, role-based access control, secure authentication with optional MFA, network isolation and firewall rules, centralized logging via self-hosted SigNoz, nightly database backups encrypted before being copied off-site to an EU storage region, and regular vulnerability scanning (Dependabot, Trivy). Organizational measures: staff data protection training, documented incident response procedure, regular access privilege reviews, and background checks for staff with data access.
5Sub-processor Notification and Objection
The Processor notifies the Controller at least 30 days in advance of any new or changed sub-processor. The Controller has 14 days to object. If objected to, the Processor either does not engage the sub-processor or terminates the relevant service arrangement. The current sub-processor list is maintained in SUBPROCESSORS.md.
6International Data Transfers
All application data is hosted in the EU (Contabo GmbH, Germany). Where personal data is transferred outside the EU/EEA - to US sub-processors such as Stripe, OpenAI, Resend, Cloudflare and Backblaze - appropriate safeguards are in place including EU Standard Contractual Clauses (Commission Decision 2021/914), adequacy decisions under Article 45 GDPR (including the EU-U.S. Data Privacy Framework), and binding corporate rules where applicable. A copy of relevant transfer mechanisms is available on request.
7Data Subject Rights
The Processor assists the Controller in fulfilling obligations under Articles 15–22 GDPR: providing data copies (access), correcting inaccurate data (rectification), deleting data (erasure), suspending processing (restriction), exporting data in machine-readable format (portability), and ceasing processing (objection). Requests are responded to within 5 business days.
8Data Breach Notification
In the event of a personal data breach, the Processor notifies the Controller without undue delay and within 72 hours, describing the nature, affected data subjects and categories, likely consequences, and measures taken. The Processor cooperates in investigation and mitigation, and documents the breach. Notification is sent to privacy@finspot.live.
9Audit Rights
The Controller (or an appointed auditor) may conduct annual routine audits (virtual or document-based) and ad-hoc audits with 14 days' notice. Audits cover security measures, data processing records, sub-processor compliance, incident response documentation, and staff training. Non-compliance findings require corrective measures within 30 days (non-critical) or 7 days (critical).
10Data Retention and Deletion
Active account data is retained for the duration of the account. Deleted account data is fully and permanently deleted within 30 days. Accounting/tax records are retained for 5 years per Polish law. Usage logs are auto-purged after 90 days. Support communications are anonymized after 2 years. Upon service termination, all personal data is deleted or returned within 30 days.
11Liability and Contact
Nothing in this Agreement limits liability that cannot be excluded under applicable law. The Processor is liable for damages resulting from processing operations that infringe data protection law, unless not responsible for the event. Governing law: laws applicable to the Controller. Contact: privacy@finspot.live - response within one month for GDPR requests.
Contact & Questions
If you have questions about this Data Processing Agreement or GDPR compliance, please contact our Data Protection team.
privacy@finspot.live