Data Processing Addendum Overview

This Data Processing Addendum (“DPA”) overview describes the terms Grabr intends to apply when it processes Customer Personal Data on behalf of a cloud customer. It is a public overview/template. It becomes binding only when incorporated into a signed order, enterprise agreement, or written acceptance between the parties. It is not a signed DPA by itself.

Customer is the organization or individual that owns the Grabr workspace and determines the purposes of Customer Content processing.

Grabr / Provider (Grabr, operated by an individual in Bangladesh) processes Customer Personal Data to provide the cloud service.

Self-hosted deployments are outside this DPA unless separately agreed; the self-host operator is generally the controller for that instance.

Grabr will process Customer Personal Data only to provide the service, on documented instructions from Customer (including configuration and connected integrations), and as required by law. If a legal requirement prevents following an instruction, Grabr will notify Customer unless legally prohibited.

Grabr will ensure personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive appropriate guidance for handling personal data.

Grabr will implement appropriate technical and organizational measures as described in the Security Overview, including encryption of connected-account secrets at rest, access controls, and transport security for production traffic.

Customer authorizes Grabr to engage subprocessors listed at /legal/subprocessors. Grabr remains responsible for subprocessors’ performance to the extent required by applicable law and any signed DPA.

Customer acknowledges that processing may occur outside Bangladesh through subprocessors. The parties will cooperate in good faith on transfer safeguards required by applicable law for enterprise arrangements.

Taking into account the nature of processing, Grabr will provide reasonable assistance with data-subject requests, security incidents affecting Customer Personal Data, and information needed for Customer’s compliance assessments, subject to confidentiality and reasonable cost recovery for disproportionate requests.

Grabr will notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data in the cloud service, and will provide information reasonably available to help Customer meet legal obligations.

Upon termination of cloud services, Customer may export available content through product features where offered. Grabr will delete or de-identify Customer Personal Data within a commercially reasonable period after a validated deletion request or account closure, except where retention is required by law or needed for secure backups, dispute resolution, or fraud prevention. Some deletions are currently handled manually rather than through a fully automated self-serve erasure flow.

Upon reasonable written request no more than once annually year (unless a breach or regulatory requirement justifies more), Grabr will provide available security information or summaries reasonably necessary to demonstrate compliance. On-site audits require mutual agreement on scope, timing, confidentiality, and cost.

Liability under a signed DPA is subject to the limitations in the Terms unless a superseding enterprise agreement states otherwise.

To request an executable DPA package, email supportgrabber@gmail.com with your legal entity name and workspace details.