Getint Data Processing Agreement

Getint Standard Processor Agreement, forming part of the Getint EULA. Version 1.6.

Data controller: The company or other legal entity that accepts the Main Agreement, starts a trial, purchases through a Marketplace, Stripe or another authorised channel, or otherwise uses the Services and on whose behalf Getint processes Personal Data ("Customer", "Controller" or "you"), including where the Customer acts as processor for another controller as described in Section 2.7.

This DPA supplements and forms part of the Main Agreement between Customer and Getint. “Main Agreement” means Getint’s EULA together with the applicable purchase, subscription, trial, Marketplace, Stripe, checkout, invoice, licence or other transaction record (each a “Purchase Record”). This DPA becomes binding automatically when Customer accepts the Main Agreement or when Getint first processes Personal Data on Customer’s behalf; no separate signature is required. Capitalised terms not defined here have the meaning given in the Main Agreement.

1. Definitions

1.1 "Applicable Data Protection Law". means all privacy and data protection laws and regulations applicable to the processing of Personal Data under this DPA, including (as applicable): the EU General Data Protection Regulation 2016/679 ("GDPR"); the UK GDPR and UK Data Protection Act 2018 ("UK GDPR"); the Swiss Federal Act on Data Protection ("FADP"); and any US state privacy laws applicable to the Customer's operations.

1.2 "Controller". has the meaning given in Applicable Data Protection Law and refers to the Customer in this DPA.

1.3 "Customer Data". has the meaning given in the Main Agreement: data, files, records, configurations and other content submitted to or processed through the Services by or for the Controller, including tenant configuration, operational logs and support materials processed by Getint on the Controller’s behalf. This DPA applies to Personal Data contained in Customer Data. The nature and categories of that Personal Data are determined by the Controller and its integration and support choices.

1.4 "Getint Platform". means Getint's proprietary integration service, provided as Shared SaaS, Dedicated SaaS or, to the extent Getint provides support or operates infrastructure, On-Premise, that connects, synchronises, and transforms data between work management systems (such as Jira, Asana, Monday.com, Salesforce, and similar platforms) as configured by the Controller.

1.5 "Personal Data". has the meaning given in Applicable Data Protection Law: any information relating to an identified or identifiable natural person that is included in Customer Data.

1.6 "Personal Data Breach". means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data processed by Getint.

1.7 "Processing". has the meaning given in Applicable Data Protection Law and includes any operation performed on Personal Data, whether automated or not.

1.8 "Services". means the integration and data synchronisation services provided by Getint to the Controller under the Main Agreement.

1.9 "Sub-processor". means any third party engaged by Getint to process Personal Data in connection with providing the Services.

1.10 "Hosting Region". means the geographic hosting location selected for the Customer tenant in the applicable Purchase Record or service configuration: Germany, United States or Australia. Germany is the default unless another Hosting Region is expressly selected.

1.11 "Regional Tenant Data". means Customer Data stored or generated within the Customer tenant, including ticket or work-item payloads and attachments, endpoint credentials and connection configuration, integration mappings, operational and audit logs, backups and disaster-recovery copies (subject to Section 3.3.4), and tenant telemetry or integration metadata. Regional Tenant Data does not include billing, account-management or commercial records, or data that the Controller voluntarily sends through email, a support ticket, videoconference or another communication channel outside the tenant.

2. Nature and Purpose of Processing

How the Getint Platform processes data

Getint operates an automated integration platform. Customer Data is retrieved from, transformed in and delivered between the systems configured by the Controller. The fields and content synchronised are determined by the Controller’s own mappings and configuration; Getint does not select, review or use them for its own purposes. Getint stores connection configuration and encrypted credentials, operational synchronisation logs (retained for 14 days by default, a period the Controller can change) and backups (retained for up to 30 days), as described in Section 3.7.4. Access by Getint personnel to the content of Customer Data is restricted as described in Section 3.2.2.

The Controller is responsible for: (a) establishing a lawful basis; (b) configuring integrations to transmit only necessary data; (c) providing required notices; and (d) not transmitting prohibited or specially regulated data unless the Main Agreement and this DPA expressly support it.

2.1 Subject matter. Getint processes Customer Data solely to provide the Services, including the connection, synchronisation, and transformation of data between the Controller's designated work management systems as configured in the Getint Platform.

2.2 Duration. Getint processes Customer Data for the duration of the Main Agreement, or until the Customer's tenant is terminated, whichever is earlier.

2.3 Nature of processing. Automated retrieval, transient processing, field transformation, routing and delivery of data between connected systems; storage of configuration, operational logs and backups as described in Section 3.7.4; and related support. Getint does not perform analysis, profiling or enrichment of Customer Data for its own purposes.

2.4 Purpose. To execute data synchronisation operations between the source and destination systems specified by the Controller, and to provide associated technical support and error diagnostics.

2.5 Categories of Personal Data. Any and all categories of personal data that the Controller chooses to transmit through the Services via its integration configuration. The Controller determines the specific data types; Getint does not prescribe or limit them. Typical categories include, without limitation: names, job titles, work email addresses, project and task metadata, and any other fields present in the Controller's connected systems. See Annex I for further detail.

2.6 Categories of data subjects. Employees, contractors, and other individuals whose personal data is stored in the Controller's connected work management systems, as configured by the Controller. See Annex I for further detail.

2.7 Customer acting as processor. Where the Customer acts as a processor on behalf of one or more third-party controllers (for example, a service provider synchronising data with its client’s systems), Getint acts as the Customer’s sub-processor and references to the “Controller” in this DPA mean the Customer. The Customer remains Getint’s sole point of contact, is responsible for obtaining and passing on any instructions, authorisations and notices required from those controllers, and warrants that its instructions to Getint are consistent with theirs and that it is authorised to engage Getint.

3. Getint's Obligations as Processor

3.1 Documented Instructions

3.1.1 Getint shall process Customer Data only on the documented instructions of the Controller, which are constituted by: (a) this DPA; (b) the Main Agreement; and (c) the Controller's integration configuration settings as applied in the Getint Platform. Getint shall promptly inform the Controller if, in Getint's opinion, any instruction infringes Applicable Data Protection Law.

3.1.2 If Getint is required to process Customer Data by Union or Member State law to which Getint is subject, Getint shall inform the Controller of that requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.2 Confidentiality

3.2.1 Getint shall ensure that persons authorised to process Customer Data are subject to enforceable obligations of confidentiality and have received appropriate data protection training.

3.2.2 Infrastructure Administration and Data Access. Where Getint operates or supports infrastructure used to provide the Services, including a dedicated or customer-specific machine or cloud environment, authorised personnel may access and administer that infrastructure without separate approval from the Controller as reasonably necessary to provision, monitor, maintain, secure, update, restart, repair, back up, restore or adjust capacity. Such administration does not authorise personnel to intentionally inspect the content of Customer Data. Unless the Main Agreement establishes a different procedure, personnel access to the content of Customer Data or tenant logs for support or investigation requires the Controller’s prior authorisation, except where required by law or reasonably necessary to address an actual or suspected security incident, prevent material harm, or maintain the security or integrity of the Services. Access must be limited to authorised personnel and the purpose for which it is required.

3.2.3 For ordinary support, the Controller may provide diagnostic information or authorise access to Customer Data where needed. Information voluntarily submitted through email, support, conferencing or other business-communication channels may be processed by the providers and in the locations used for those channels.

3.3 Security

3.3.1 Getint shall implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including as required by Article 32 GDPR. Getint's current security measures are described in Annex II to this DPA.

3.3.2 Getint maintains a documented information security programme and holds a SOC 2 Type II report, which Getint will make available to the Controller on request, subject to reasonable confidentiality terms. A report applies only to the scope and period stated in it.

3.3.3 Getint encrypts Customer Data in transit using TLS 1.2 or higher and at rest, including backups, using AES-256 in Getint-hosted environments. In customer-hosted deployments, encryption at rest depends on the Controller’s infrastructure. Optional features such as log masking may vary by Deployment Model and configuration.

3.3.4 Regional hosting. For a Getint-hosted tenant, Getint stores production Customer Data in the Hosting Region selected for that tenant, subject to the exceptions and transfer provisions in this DPA. Data may transit through networks outside that region, and authorised administration or support may constitute processing from another location without changing the storage location. To ensure business continuity if the Hosting Region becomes unavailable, backup and disaster-recovery copies may be stored in a location other than the Hosting Region; such copies remain encrypted and subject to this DPA, and any resulting transfer is made in accordance with Section 6.

3.4 Sub-processors

3.4.1 The Controller grants Getint general written authorisation to engage Sub-processors to process Customer Data in connection with the Services. Getint's current Sub-processors are listed in Annex III and in the list published in Getint’s documentation at https://docs.getint.io (the “Sub-processor List”).

3.4.2 Getint shall: (a) select Sub-processors that provide sufficient guarantees to implement appropriate technical and organisational measures such that processing will meet the requirements of Applicable Data Protection Law; (b) engage each Sub-processor under a written contract imposing data protection obligations that provide at least the level of protection required by Article 28(4) GDPR, which, for providers offering standard data processing terms (such as major cloud providers), may be those standard terms; and (c) remain fully liable to the Controller for the performance of each Sub-processor’s data protection obligations, subject to Section 7.

3.4.3 Getint will inform the Controller of any intended addition or replacement of a Sub-processor by updating the Sub-processor List at least fourteen (14) days before the change takes effect. The Sub-processor List shows the date of its last update. On request to support@getint.io, Getint will also send email notice of such updates to an address designated by the Controller. The Controller may object in writing on reasonable, documented data-protection grounds before the change takes effect; if no objection is raised, the change is deemed accepted. If the parties cannot resolve a timely objection, Getint may avoid using the Sub-processor for the Controller where reasonably feasible, or either party may terminate the affected Service. Where a replacement is urgently required for security or service-continuity reasons, Getint may engage it immediately and will update the Sub-processor List as soon as practicable, and the objection right above applies.

3.5 Data Subject Rights

3.5.1 Taking into account the nature of the processing, Getint shall assist the Controller by appropriate technical and organisational measures, insofar as reasonably possible, to enable the Controller to fulfil its obligations to respond to data subject requests (access, rectification, erasure, restriction, portability, objection). Given the nature of the Services:

(a) Getint does not maintain a separate record of Customer Data indexed by data subject. Personal Data is held in Getint’s systems only within connection configuration, operational synchronisation logs and backups, which expire as described in Section 3.7.4. Data subject requests concerning synchronised content are therefore primarily actioned in the Controller’s source and destination systems. (b) On the Controller’s request, Getint will delete the operational logs of the Controller’s tenant, or of a specific integration, before their scheduled expiry. Residual copies in backups expire as described in Section 3.7.2.

3.5.2 Getint shall promptly forward to the Controller any request it receives directly from a data subject concerning Customer Data and shall not respond to it except on the Controller’s instructions. Getint shall reasonably cooperate with, and provide technical information to assist, the Controller in responding to data subject requests.

3.6 Compliance Assistance

3.6.1 Taking into account the nature of the processing and information available to Getint, Getint will provide reasonable assistance required under Applicable Data Protection Law concerning security, breach notifications, data protection impact assessments and consultations. Assistance beyond standard service functionality or information may be subject to reasonable fees agreed in advance.

3.7 Deletion and Return of Data

3.7.1 At the end of the relevant Services, Getint will, at the Controller’s choice and subject to the Main Agreement, return or delete Customer Data within a reasonable period, unless retention is required by law. Return is limited to export functionality and formats then generally available for the Service.

3.7.2 Residual copies in backups are retained for no longer than thirty (30) days and are then deleted through Getint’s ordinary rotation. Until deletion they remain protected under this DPA and will not be restored except for continuity, recovery, security or legal purposes.

3.7.3 Getint may retain Customer Data beyond the periods above only to the extent required by applicable Union or Member State law, and only for the duration required by such law.

3.7.4 Retention during the Services. Operational synchronisation logs, which may contain synchronised content, are retained for 14 days by default; the Controller may change this period in the Getint Platform within the limits made available there. Backups of Getint-hosted environments are retained for up to 30 days and are then deleted through ordinary rotation. Connection configuration and encrypted credentials are retained for as long as the relevant integration exists in the Controller’s tenant.

3.8 Audit and Demonstrable Compliance

3.8.1 Getint shall make available to the Controller all information reasonably necessary to demonstrate compliance with this DPA and cooperate with audits or inspections conducted by the Controller or a third-party auditor mandated by the Controller.

3.8.2 Compliance review will ordinarily be satisfied through Getint’s SOC 2 Type II report, security documentation and written responses. If that information is reasonably insufficient to demonstrate compliance, or where required by a supervisory authority or following a material Personal Data Breach, the Controller may conduct an audit, remotely or on-site, itself or through an independent auditor bound by confidentiality. As Getint’s production infrastructure is operated by its hosting provider, an on-site audit takes place at premises reasonably designated by Getint and does not extend to Sub-processors’ facilities, which are covered by their own independent audit reports. Audits require at least thirty (30) days’ written notice unless a supervisory authority requires otherwise, may occur no more than once per calendar year except where required by a supervisory authority or following a material Personal Data Breach, take place during normal business hours without unreasonable disruption, and are at the Controller’s cost. Audits must not compromise Getint’s security, confidential information or other customers’ data. Getint will take reasonable steps to remedy any material non-compliance identified.

3.8.3 Getint may require use of a standard security questionnaire or available assurance materials before agreeing to any customer-specific review. Information is provided subject to reasonable confidentiality, security and third-party disclosure restrictions.

3.9 US State Privacy Laws

3.9.1 To the extent US state privacy law applies to Customer Data, Getint acts as a processor or service provider on the Controller’s behalf. Getint will not sell or share Customer Data for cross-context behavioural advertising, retain, use or disclose it for a commercial purpose other than providing the Services and permitted business purposes under applicable law, or combine it with personal data received from another person except as permitted by applicable law. Getint will provide reasonable assistance for applicable consumer requests and compliance obligations, taking account of the nature of processing.

4. Controller's Obligations

4.1 Lawful basis. The Controller represents and warrants that it has, and will maintain throughout the duration of this DPA, a valid lawful basis for processing Personal Data and for instructing Getint to process such Personal Data on its behalf. Where an integration connects to a system operated by another organisation (such as a partner, client or supplier), the Controller warrants that it has obtained all authorisations required from that organisation to process its data through the Services.

4.2 Data minimisation. The Controller is solely responsible for configuring its integrations to transmit only the Personal Data necessary for the intended purpose. Getint cannot independently assess or enforce data minimisation principles as it does not select or review the data synchronised.

4.3 Sensitive data. The Controller shall not transmit special categories of personal data (as defined in Article 9 GDPR) or children's data through the Getint Platform without first: (a) confirming in writing to Getint that it has a valid legal basis for such processing; and (b) agreeing with Getint on any additional security or procedural measures required.

4.4 MNPI and confidential data. The Controller is solely responsible for ensuring that material non-public information, legally privileged information, or other highly sensitive data is not transmitted through the Getint Platform without appropriate authorisation. Given Getint's automated, non-reviewing processing model, the Controller bears responsibility for the configuration of data sources.

4.5 Log-data configuration. Where the Services provide a configurable log-data anonymisation or masking feature, the Controller is responsible for assessing whether it should be enabled having regard to the data selected for synchronisation, the risks of the processing and the Controller’s legal or regulatory requirements. The feature may require activation by the Controller and is not enabled by default unless stated in the applicable service configuration. Getint will make reasonably available information about the feature and its operation. This configuration responsibility does not exclude or reduce Getint’s obligations under Applicable Data Protection Law.

4.6 Accuracy of instructions. The Controller shall ensure that its instructions to Getint comply with Applicable Data Protection Law and that processing in accordance with such instructions will not cause Getint to violate any applicable law.

5. Personal Data Breach

5.1 Notification. Getint shall notify the Controller without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Data and shall provide further information in phases where it is not available at the same time.

5.2 Content of notification. Getint's notification shall include, to the extent available at the time: (a) a description of the nature of the breach, including the categories and approximate number of data subjects and records affected; (b) the name and contact details of Getint's data protection contact; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach.

5.3 Cooperation. Getint will take reasonable steps to investigate, contain and mitigate a Personal Data Breach and will provide reasonable cooperation to the Controller. Public statements and regulatory notifications will be coordinated where practicable, without restricting either party’s legal obligations.

5.4 Regulatory notifications. Nothing in this DPA prevents Getint from making any notification to a supervisory authority or regulatory body that Getint is independently required to make under Applicable Data Protection Law.

6. International Data Transfers

6.1 Hosting Region selection. The Controller may select Germany, the United States or Australia as its Hosting Region, subject to service availability and the applicable Purchase Record. Regional Tenant Data is hosted in the selected region as described in Section 3.3.4, except backup and disaster-recovery copies, which may be stored in another location as described there. Germany is the default where no different Hosting Region is recorded.

6.2 Production hosting. Getint uses third-party infrastructure providers to host the Services. The current providers, roles and relevant locations are identified in the Sub-processor information made available by Getint. Business communication and support providers may process information that the Controller separately submits through those channels.

6.3 Transfer mechanisms. Where the selected Hosting Region or an authorised support disclosure results in a restricted transfer under Applicable Data Protection Law, Getint will implement a valid transfer mechanism, including an applicable adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum or another lawful mechanism, together with supplementary measures where required.

6.4 Standard Contractual Clauses. Getint is established in the EEA. Where the Controller is established outside the EEA in a country without an adequacy decision and a transfer of Personal Data from Getint to the Controller requires a transfer mechanism, Module Four (processor to controller) of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (“SCCs”) is incorporated by reference, with the following elections: (a) the docking clause in Clause 7 applies; (b) the optional language in Clause 11(a) does not apply; (c) Clause 17: the law of Poland; (d) Clause 18: the courts of Gdańsk, Poland; and (e) Annexes I and II of this DPA complete the corresponding annexes of the SCCs. Where Getint transfers Personal Data to a Sub-processor in a third country without an adequacy decision, Getint ensures that Module Three of the SCCs, the EU-US Data Privacy Framework or another valid mechanism applies. Where UK GDPR requires it, the UK International Data Transfer Addendum (version B1.0) applies, completed with the information in this DPA. For transfers subject to the Swiss FADP, the SCCs apply with references to GDPR read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner as the competent authority where applicable.

6.5 Customer-hosted deployment. Where stated in the Purchase Record, the Software may be deployed in an environment controlled by the Controller. If Getint is responsible for operating or maintaining that infrastructure, authorised personnel may administer the infrastructure as described in Section 3.2.2 without separate approval. Such administration does not authorise intentional inspection of Customer Data. Licensing, implementation, maintenance and support terms are governed by the Main Agreement.

7. Liability

7.1 Governed by Main Agreement. Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations in the Main Agreement. Nothing limits liability to the extent it cannot lawfully be limited, including applicable rights of data subjects under Article 82 GDPR.

7.2 Allocation of responsibilities. Liability shall be assessed having regard to each party’s role, instructions, control and contribution to the event. The Controller remains responsible for deciding what data is processed, the lawful basis, transparency to data subjects, and its configuration of connected systems. This allocation does not reduce Getint’s mandatory processor obligations.

7.3 Regulatory fines. Getint shall not be liable for regulatory fines or penalties imposed on the Controller by a supervisory authority, except to the extent directly caused by Getint's material breach of its obligations under this DPA or Applicable Data Protection Law.

7.4 Third-party claims. This DPA does not create any indemnity separate from the Main Agreement.

8. Term and Termination

8.1 Duration. This DPA remains in force for as long as Getint processes Personal Data on behalf of the Controller under the Main Agreement.

8.2 Survival. Clauses 3.7 (deletion), 5 (breach notification), 7 (liability), and 9 (general) survive termination of this DPA and the Main Agreement.

8.3 Termination. Termination of the Main Agreement automatically terminates this DPA, except for provisions that survive. If Getint materially breaches this DPA and does not cure the breach within thirty (30) days after detailed written notice, the Controller may suspend the affected processing or terminate only the affected Service.

9. General

9.1 Governing law. This DPA is governed by the law and dispute-resolution provisions of the Main Agreement, without prejudice to mandatory rights and jurisdiction under Applicable Data Protection Law.

9.2 Precedence. If this DPA conflicts with the Main Agreement, this DPA prevails only to the extent necessary for the lawful processing and protection of Personal Data; otherwise the order of precedence in the Main Agreement applies. Applicable Data Protection Law prevails over both documents.

9.3 Amendments. Getint may amend this DPA where reasonably necessary to reflect changes in law, regulation, technology, security measures or processing activities. Getint will notify the Controller by email, in-product notice or other reasonable means at least thirty (30) days before an amendment takes effect, or within a shorter period where required by law. If an amendment materially reduces the protection of Personal Data or the Controller’s rights, the Controller may terminate the affected Service free of charge by notice given before the amendment takes effect; otherwise the amendment applies from its effective date. No amendment will reduce protections below the level required by Applicable Data Protection Law. Changes to Sub-processors follow Section 3.4.3.

9.4 Entire agreement. This DPA, together with its Annexes and the Main Agreement, constitutes the entire agreement between the parties with respect to the processing of Personal Data and supersedes all prior representations and agreements on that subject.

9.5 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions continue in full force and effect.

Automatic incorporation

This DPA is incorporated automatically into the Main Agreement as stated above. No separate execution is required. For Customers with an active subscription on 6 November 2026, this version applies from 7 December 2026; until then version 1.5 continues to apply.

This DPA is accepted electronically with the Main Agreement and does not require signatures. On request, the parties may execute a counterpart that identifies Customer, without changing the automatic effective date.

Annex I — Description of processing

Annex II — Technical and organisational security measures

Getint implements and maintains the following technical and organisational measures as part of its documented information security programme:

Annex III — Approved sub-processors

The following Sub-processors are currently approved. Getint maintains this list and the Sub-processor List and notifies changes in accordance with Section 3.4.3.

Note: Each provider above is engaged under its data processing terms, which include the obligations required by Article 28(4) GDPR. AWS processes Regional Tenant Data as the production hosting provider. Google, Microsoft, Atlassian and Customer.io do not host or process the production synchronisation flow; they may process separate business communications or support materials that the Controller chooses to submit through those channels.