Data Processing Agreement (DPA)

Version 2026-10-16

Between the workspace owner (the business that creates a TaskLock workspace, "Controller") and Shalom Dov-Ber Kirsh, Wild Digital Moments, Streleweg 18a, Top 20, 6460 Imst, Austria ("Processor").

This DPA forms part of the TaskLock Terms. It applies automatically when a workspace is created and lasts as long as the workspace exists, plus the export and deletion periods in section 9.

1. Subject, nature and purpose

The Processor stores and shows the content of the Controller's workspace and lets the Controller's people and their AI agents take, report and finish tasks through the TaskLock website and API (hosting, display, coordination). Purpose: to provide TaskLock under the Terms. Details in Annex 1.

2. Instructions

The Processor processes workspace personal data only on the Controller's documented instructions. The Terms, this DPA and the Controller's use of TaskLock's settings and API are the instructions. This covers transfers outside the EU/EEA too; there are none, except where a user of the Controller chooses to connect Telegram in their own account: then that user's task notifications go to Telegram Messenger Inc., outside the EU, on that user's consent. If EU or Austrian law requires other processing, the Processor tells the Controller first unless that law forbids it. The Processor tells the Controller at once if it thinks an instruction breaks data protection law.

3. Confidentiality

Only the Processor (one person) has access. Anyone the Processor later lets work with the data will be bound to confidentiality in writing first.

4. Security

The Processor takes the measures required by Art. 32 GDPR, listed in Annex 2, and keeps them up to date with the state of the art.

5. Sub-processors

The Controller gives general authorisation for the sub-processors in Annex 3. The Processor tells workspace owners by email at least 30 days before adding or replacing a sub-processor. The Controller may object; if no solution is found, the Controller may end the contract before the change. The Processor imposes the same data protection duties on every sub-processor by contract and stays liable for them.

6. Data subjects' rights

The Processor helps the Controller answer requests from data subjects (access, correction, deletion, restriction, portability, objection), mainly through the app (edit, delete, remove members) and, on request, with a JSON export. A request that reaches the Processor directly is forwarded to the Controller without delay.

7. Help with the Controller's duties

The Processor helps the Controller with security, breach notification, data protection impact assessments and prior consultation (Art. 32-36 GDPR), as far as the nature of the processing and the information available allow.

8. Personal data breaches

The Processor notifies the Controller (by email to the workspace owner) without undue delay after becoming aware of a breach affecting workspace data, aiming for 24 hours. The notice says what is known about the nature of the breach, the data and people affected, the likely consequences and the measures taken. The Processor adds information as it comes in.

9. End of processing

• When the workspace is deleted or the contract ends, the Controller can ask for an export (JSON) for 30 days. After that the Processor deletes all workspace data.
• If the workspace's only owner has not signed in for 12 months, the Processor emails a warning and then deletes the account under the Privacy notice, section 7, 30 days after the warning. A workspace that person owns alone is deleted with the account; the warning says so.
• If TaskLock is discontinued, the Processor tells the Controller by email at least 30 days before the service stops and deletes all workspace data no later than 60 days after that email. The Controller can ask for the export until then.
• In every case backup copies are deleted at the latest 14 days after the data. Where EU or Austrian law requires keeping data, the Processor keeps only that and only as long as required.

10. Audits and information

The Processor provides all information needed to show compliance with Art. 28 GDPR (this DPA, Annex 2, records of processing) and allows and contributes to audits, including inspections, by the Controller or an auditor it mandates. Audits need reasonable notice, happen during business hours and give no access to other customers' data. The Controller bears its own audit costs.

11. Liability and precedence

Liability follows Art. 82 GDPR and the Terms. If this DPA and the Terms conflict on data protection, this DPA wins.

Annex 1 — Processing details

Annex 2 — Technical and organisational measures (Art. 32)

• Encryption in transit: HTTPS only; session cookie marked Secure and HttpOnly.
• Credentials: passwords stored with PHP password_hash; session ids, agent tokens, admin keys, join codes and email links stored only as SHA-256 hashes, and shown once on creation.
• Access control: each workspace in its own file; every API and page request is scoped to one workspace and checked against the member's role (owner/admin/member) and teams; tests prove one workspace's token never sees another's.
• Operator access: only the Processor; the operator view shows counts, not task content.
• Attack protection: CSRF tokens on every form, Origin check, rate limits on sign-in, sign-up, reset, join and invite mails, no account enumeration, strict Content-Security-Policy, X-Frame-Options DENY.
• Integrity and availability: atomic writes (file lock, temporary file, fsync, rename); daily backups kept 14 days; restore steps in the runbook.
• Data minimisation: no analytics, no tracking, no third-party requests; no Claude or GitHub credentials stored; unconfirmed sign-ups deleted after 7 days; accounts inactive for 12 months deleted after a warning.
• Deletion: account and workspace deletion in the app; backups expire after 14 days.
• Server: hosted with World4You in Austria; data directory outside the web root and denied by the web server.
• Breach handling: written procedure (detect, assess within 24 hours, notify).

Annex 3 — Approved sub-processors

World4You's processing terms: https://www.world4you.com/unternehmen/avv

GitHub is not a sub-processor: issue data reaches TaskLock only from the Controller's own GitHub Action, TaskLock makes no calls to GitHub and holds no GitHub credential.