Data processing agreement
English translation
Provided for convenience. In case of any discrepancy the Czech version prevails.
Article 1 — Parties and purpose
1.1. This data processing agreement under Art. 28 GDPR is an integral annex to the terms of service of the killBottleneck hosted services and is concluded automatically together with the service contract.
1.2. Controller: the customer of the hosted service. Processor: Tengo s.r.o., company ID 03339165, Dolní Valy 205, 262 72 Březnice, Czech Republic.
1.3. The processor processes on behalf of the controller the personal data contained in the controller's killBottleneck instance, solely for the purpose of operating the hosted service (hosting, backups, updates, AI features, support) for the term of the service contract.
Article 2 — What is processed
2.1. Categories of data subjects: users of the controller's instance (employees, collaborators, guests), and possibly other persons mentioned in the content of maps and tasks (e.g. contact persons of the controller's customers).
2.2. Categories of data: identification and contact details of users (name, e-mail), the content of maps, nodes, tasks and comments, time entries, operational metadata of the instance. In the Private plan also files in task attachments; in the Cloud Lite plan attachments are not uploaded (only links are stored).
2.3. Special categories of data (Art. 9 GDPR): the service is not intended for processing sensitive data; the controller undertakes not to store them in the instance unless agreed with the processor in writing in advance.
Article 3 — Controller's instructions
3.1. The processor processes data only on documented instructions from the controller. The instructions are given by the service contract, this agreement and the actions of the controller and its users in the application (what they enter, edit, delete, export).
3.2. If EU or Czech law requires the processor to carry out other processing, the processor informs the controller in advance, unless that law prohibits it.
3.3. If the processor considers an instruction to be contrary to the GDPR, it notifies the controller without undue delay.
3.4. The processor does not use the content of the instance for its own purposes, in particular not for training AI models or for analysis beyond the provision of the service. The content of maps is never stored in the AI service logs.
Article 4 — Confidentiality
4.1. Only persons who strictly need access to operate the service have access to the data, bound by confidentiality (contractually or by law). Currently only the processor's infrastructure administrator has access to the production servers.
Article 5 — Security (Art. 32 GDPR)
5.1. The processor has adopted in particular the following technical and organisational measures:
- instance isolation — each customer has their own container (Cloud Lite) or their own virtual server (Private); instances do not share data,
- encryption in transit — all communication over TLS/HTTPS,
- backups — daily backups, stored off the host server (off-site, in the EU), with limited retention,
- access control — access to the production infrastructure only by the infrastructure administrator, through secured channels (SSH with keys),
- AI without content logging — the content of maps is not stored in the AI service logs,
- updates — regular updates of the application and systems are carried out by the processor.
5.2. The processor continuously adapts the measures to the state of the art and the risks; it provides their current description to the controller on request.
Article 6 — Sub-processors
6.1. The controller grants general authorisation to engage sub-processors. Current list:
| Sub-processor | Role | Location |
|---|---|---|
| Hetzner Online GmbH (Germany) | operation of servers and backups | EU (Nuremberg; backups in the EU) |
| Cloudflare, Inc. (USA) | DNS and network proxy in front of the instances | global network; safeguards: EU–US Data Privacy Framework (active certification verified, August 2026) + SCC in the Cloudflare DPA |
| Sendinblue SAS / Brevo (France) | sending e-mail notifications of the instance to users | EU |
| AKI.IO GmbH (Germany) | AI computations of the assistant (text replies, reading images); the content of a request is processed and not retained (zero retention), and is not used for training | Germany (datacentres in Germany); data processing agreement under Art. 28 GDPR |
Payments via Stripe do not concern the content of the instance — there Tengo s.r.o. acts as controller (see the Privacy policy).
6.2. The processor notifies the controller of a change or addition of a sub-processor by e-mail at least 30 days in advance. The controller may object on legitimate grounds; if the parties find no solution, the controller may terminate the service contract as of the date the new sub-processor is deployed, with a refund of the proportional part of the prepaid amount.
6.3. The processor imposes on sub-processors data protection obligations comparable to this agreement and is liable to the controller for their performance.
Article 7 — Transfers outside the EU/EEA
7.1. Processing takes place in the EU (Hetzner servers in Germany, AI computations on the processor's hardware in the Czech Republic or at the sub-processor AKI.IO GmbH in Germany, backups in the EU). The exception is the Cloudflare network layer under art. 6.1; the transfer is covered by safeguards under Chapter V GDPR.
Article 8 — Assistance to the controller
8.1. The processor assists the controller, to an extent appropriate to the nature of the processing:
- in handling data subject requests (access, erasure, portability…) — the controller handles most of them itself in the application or by export; what cannot be done that way, the processor arranges on request at support@killbottleneck.com,
- in ensuring security, incident notification and data protection impact assessments (DPIA) by providing the information available to it.
8.2. For assistance significantly exceeding normal operations (e.g. repeated extensive research) the processor may charge reasonably incurred costs; it informs the controller of their expected amount before providing the assistance.
Article 9 — Security incidents
9.1. If the processor discovers a personal data breach concerning the controller's instance, it notifies the controller without undue delay, no later than 48 hours after discovery, to the customer account e-mail.
9.2. The notification contains a description of the incident, the likely consequences and the measures taken, to the extent known; information may be provided in phases.
9.3. Contact for reporting security issues to the processor: security@killbottleneck.com.
Article 10 — Audit
10.1. The processor provides the controller with the information necessary to demonstrate compliance with Art. 28 GDPR — primarily in the form of written answers and documentation (description of measures, list of sub-processors, summary of backup procedures).
10.2. If the written materials do not provide sufficient assurance, the controller may carry out an audit, including an inspection, under the following reasonable conditions (the processor is a small company): at most once every 12 months (except in the case of a serious incident), with notice of at least 30 days, during working hours, without disrupting operations and the security of other customers (no access to other instances) and at the controller's expense. The auditor must not be a competitor of the processor and signs a confidentiality undertaking.
Article 11 — Termination and deletion
11.1. After the service contract ends, the processor provides the controller with a data export (PocketBase database backup) in accordance with the terms of service.
11.2. After the contract ends, the processor retains the instance data for 90 days (possibility of renewing the service under art. 11.5 of the terms; 30 days for the trial) and then deletes them; on the controller's express instruction it deletes them earlier. Copies in rotating backups expire automatically no later than the end of the backup cycle (currently 14 days). Data the processor is required by law to retain are an exception.
11.3. On the controller's request the processor confirms the deletion in writing.
Article 12 — Final provisions
12.1. This agreement lasts for the term of the service contract; the confidentiality and deletion obligations survive its termination.
12.2. The liability of the parties is governed by the terms of service (limitation of liability, art. 10 of the terms), unless the GDPR mandatorily provides otherwise.
12.3. The agreement is governed by the law of the Czech Republic. In the event of a conflict between this agreement and the terms of service, this agreement prevails in matters of personal data protection.