Data Processing Agreement (DPA)

Last updated: 2026-10-15

This DPA forms an integral part of the Agreement between Cleaniro (“Processor”) and Customer (“Controller”). It governs the processing of personal data on behalf of Controller in connection with the Services.

1. Subject matter and duration

This DPA applies for the duration of the Agreement and covers the processing of personal data of Controller’s End Users (cleaners, managers, admins) within the Cleaniro platform.

2. Nature and purpose of processing

The Processor processes personal data solely to provide the Services described in the Agreement: scheduling, time tracking, quality control, reporting, and related operational management functions.

3. Categories of data subjects and personal data

Data subjects:

• Cleaners (Controller’s employees or contractors)
• Managers, team leaders, admins (Controller’s staff)
• Optionally: end clients of Controller (site contacts)

Categories of personal data:

• Identity: name, contact details, role
• Employment: schedule, hours worked, locations
• Time tracking: clock-in/out, breaks
• Location: GPS coordinates at clock-in/out (where activated)
• Quality: inspection results, incident reports, photos
• Authentication: hashed passwords

Special categories: none processed by Cleaniro by default. Controller commits not to enter special category data (health, beliefs, etc.) unless agreed in writing.

4. Processor obligations

The Processor shall:

1. Process personal data only on documented instructions from the Controller, including with regard to international transfers, unless required by law.
2. Ensure that persons authorized to process the data are bound by confidentiality.
3. Implement appropriate technical and organizational measures (see Annex 1).
4. Engage subprocessors only under the conditions of Article 7.
5. Assist Controller in fulfilling its obligations regarding data subject rights, security, breach notification, impact assessments, and consultations with supervisory authorities.
6. Notify Controller without undue delay (within 72 hours) of any personal data breach.
7. At the choice of Controller, delete or return all personal data after the end of the Services, and delete existing copies unless legal retention applies.
8. Make available to Controller all information necessary to demonstrate compliance and allow for audits.

5. Controller obligations

The Controller shall:

1. Ensure it has a lawful basis for the processing of personal data.
2. Inform End Users (cleaners, managers) about the processing, including the use of GPS where applicable.
3. Ensure compliance with labor law regarding time tracking and location monitoring of employees.
4. Provide only personal data necessary for the Services.
5. Not enter special category data without written agreement.

6. Data subject rights

The Processor will assist the Controller, by appropriate technical and organizational measures, in responding to requests from data subjects. The Processor will forward any such requests received directly to the Controller without undue delay.

7. Subprocessors

The Controller authorizes the Processor to engage subprocessors as listed at cleaniro.com/subprocessors.

The Processor will:

• Maintain an up-to-date list publicly accessible
• Inform Controller of intended additions or replacements with at least 30 days’ notice
• Impose data protection obligations on subprocessors equivalent to those in this DPA
• Remain fully liable for subprocessors’ performance

Controller may object to changes within 30 days; if objection cannot be resolved, Controller may terminate the affected Service.

8. International transfers

Primary processing takes place within the European Economic Area. Where subprocessors process data outside the EEA, the Processor relies on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The EU-US Data Privacy Framework where applicable
• Additional technical and organizational measures where necessary

9. Security measures

See Annex 1.

10. Audits

Controller may, at its own cost and with at least 30 days’ written notice, audit the Processor’s compliance with this DPA, no more than once per calendar year, except after a personal data breach. Audits must respect the confidentiality and operational continuity of the Processor. Third-party audit reports (e.g. ISO 27001, SOC 2 when obtained) may substitute on-site audits at the Processor’s discretion.

11. Liability

Liability is governed by the Agreement. The cap on liability applies cumulatively to the Agreement and this DPA.

12. Term and termination

This DPA terminates automatically upon termination of the Agreement. Article 4(7) (deletion/return) survives termination.

13. Governing law

This DPA is governed by Belgian law. Disputes fall under the courts of the Antwerp arrondissement.

Annex 1 — Technical and Organizational Measures

Encryption

• TLS (encrypted connection) in transit
• AES-256 at rest (Supabase managed)

Access control

• Each company’s data separated at database level (row-level security per company)
• Role-based access control (RBAC) within a company
• Least privilege principle
• Log of changes (including hours, access and roles, company data) that users cannot change or delete from within the app

Infrastructure

• Database and primary processing: Supabase EU (Frankfurt)
• Hosting of the website and the app: Vercel (EU region, Frankfurt, where available)
• Daily automated backups (by Supabase)

Operational

• Vulnerability monitoring and patching
• Incident response procedure
• Confidentiality obligations for all personnel and subprocessors
• Annual review of measures

Data lifecycle

• Data segregation per tenant (Customer)
• 30-day export window after termination
• Full deletion within 90 days (subject to legal retention)

Annex 2 — List of Subprocessors

See current list at cleaniro.com/subprocessors (also reproduced below at signature date):