Data Processing Agreement
Last updated: October 2, 2026
Business customers can ask for a countersigned copy at privacy@easydash.app.
This Data Processing Agreement (“DPA”) forms part of the EasyDash Terms of Service (the “Terms”) between EasyDash ApS, CVR 46552539, Amagerfælledvej 146, 2. 9, 2300 København S, Denmark (“EasyDash”, the “Processor”) and the customer who has accepted the Terms (the “Customer”, the “Controller”).
It applies whenever EasyDash processes personal data on the Customer’s behalf while providing the Service, as required by Article 28 of Regulation (EU) 2016/679 (the “GDPR”). The Customer accepts this DPA by accepting the Terms. No signature is needed, but EasyDash will countersign a copy on request.
1. Definitions
Terms such as personal data, processing, controller, processor, data subject, personal data breach and supervisory authority have the meanings given in Article 4 GDPR.
Customer Data means any personal data contained in the files, spreadsheets and connected data sources the Customer or its users upload to or connect with the Service, and in the dashboards generated from them.
Sub-processor means any third party EasyDash engages to process Customer Data.
Service means the EasyDash service as described in the Terms.
2. Roles and scope
2.1 For Customer Data, the Customer is the controller and EasyDash is the processor.
2.2 For the Customer’s own account data (the name and email address of the Customer’s users, billing details, and usage of the EasyDash website), EasyDash is an independent controller. That processing is governed by the EasyDash Privacy Policy, not this DPA.
2.3 The subject matter, nature, purpose, duration, categories of data and categories of data subjects are set out in Annex I.
3. Processing on documented instructions
3.1 EasyDash processes Customer Data only on the Customer’s documented instructions, including with regard to transfers to third countries, unless EU or Danish law requires otherwise. In that case EasyDash will inform the Customer of the legal requirement before processing, unless the law prohibits it.
3.2 The Terms, this DPA, and the Customer’s use and configuration of the Service (uploading files, connecting sheets, setting sync schedules, sharing or embedding dashboards, inviting team members, deleting dashboards) are the Customer’s complete documented instructions.
3.3 EasyDash will tell the Customer promptly if it believes an instruction infringes the GDPR or other EU or Danish data protection law.
4. Confidentiality
EasyDash ensures that every person authorised to process Customer Data is bound by an obligation of confidentiality, contractual or statutory.
5. Security
5.1 EasyDash implements the technical and organisational measures described in Annex II. They are designed to give a level of security appropriate to the risk.
5.2 EasyDash may update those measures over time, provided the overall level of security is not reduced.
6. Sub-processors
6.1 The Customer gives EasyDash general authorisation to engage sub-processors. The sub-processors in use on the date of this DPA are listed in Annex III.
6.2 EasyDash will give the Customer at least 30 days’ notice before adding or replacing a sub-processor, by email to the account owner and by updating the list on our sub-processors page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for the unused period.
6.3 EasyDash imposes data protection obligations on each sub-processor that are no less protective than those in this DPA. EasyDash remains fully liable to the Customer for its sub-processors’ performance of those obligations.
7. Assistance with data subject requests
7.1 Taking into account the nature of the processing, EasyDash will help the Customer, by appropriate technical and organisational measures and as far as possible, to respond to requests from data subjects exercising their rights under Chapter III GDPR.
7.2 If EasyDash receives a request directly from a data subject about Customer Data, it will forward the request to the Customer without undue delay and will not respond itself, except to confirm that the request has been passed on.
7.3 Much of this is self-service: the Customer can edit or delete the source data, delete a dashboard (which deletes its stored file), or ask for the account to be deleted by emailing privacy@easydash.app.
8. Assistance with security, breaches and impact assessments
8.1 EasyDash will help the Customer comply with Articles 32–36 GDPR, taking into account the nature of the processing and the information available to EasyDash.
8.2 Personal data breaches. EasyDash will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will include, as far as then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. EasyDash will provide further information as it becomes available.
8.3 EasyDash will provide reasonable information the Customer needs to carry out a data protection impact assessment or prior consultation with a supervisory authority, where required.
9. Deletion or return at the end of the Service
9.1 When the Customer deletes a dashboard, EasyDash deletes the stored source file and compiled data for that dashboard from the live system.
9.2 When the Customer’s account ends, EasyDash deletes all Customer Data within 30 days, unless EU or Danish law requires EasyDash to keep it. Before that, the Customer can export its dashboards through the Service.
9.3 Deleted data may persist in encrypted backups until those backups expire on the provider’s rolling schedule, which is at most 7 days. Backups are not used to restore individual customer records.
10. Information and audits
10.1 EasyDash will make available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR.
10.2 The Customer may audit EasyDash’s compliance, or have an independent auditor bound by confidentiality do so, once per year and on at least 30 days’ written notice. The first step is a written questionnaire, which EasyDash will answer in full. An on-site or remote inspection follows only if the questionnaire does not reasonably answer the Customer’s question, or if a supervisory authority requires it. The Customer bears its own audit costs.
10.3 Where a sub-processor is involved, EasyDash may satisfy an audit request by providing that sub-processor’s current third-party certifications or audit reports (for example SOC 2 or ISO 27001).
11. International transfers
11.1 EasyDash stores Customer Data in the European Economic Area, except that the email sub-processor keeps email content and delivery logs in the United States for 30 days. Some sub-processors are established in, or may access data from, countries outside the EEA, as shown in Annex III.
11.2 Every such transfer rests on one of the following: an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, for recipients certified under it), or the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914, incorporated into EasyDash’s agreement with that sub-processor.
12. Liability and precedence
12.1 Each party’s liability under this DPA is subject to the limitations in the Terms, except where the GDPR does not permit such a limitation.
12.2 If this DPA conflicts with the Terms on the processing of Customer Data, this DPA prevails.
13. Duration, governing law and changes
13.1 This DPA lasts as long as EasyDash processes Customer Data for the Customer.
13.2 This DPA is governed by Danish law. The courts of Copenhagen have exclusive jurisdiction, without prejudice to the rights of data subjects or supervisory authorities. The competent supervisory authority for EasyDash is Datatilsynet.
13.3 EasyDash may update this DPA where required by law or by a change in sub-processors (following section 6.2). Other material changes follow the notice procedure for changes to the Terms.
Annex I · Description of the processing
Subject matter
Hosting and processing of files and spreadsheet data the Customer supplies, in order to generate, store, sync, display and share dashboards.
Nature of processing
Collection (upload, or read from a connected Google Sheet, Google Analytics property or Search Console site), storage, parsing and statistical profiling, AI-assisted layout generation, compilation into chart data, display, sharing by link or embed, scheduled re-sync, and deletion.
Purpose
Providing the Service to the Customer as described in the Terms.
Duration
For as long as the Customer keeps the relevant dashboard or account, plus the deletion period in section 9.
Categories of data subjects
Whoever appears in the Customer’s data. This is typically the Customer’s own clients, customers, employees, suppliers or other business contacts. It also includes the Customer’s team members invited to the account, and people who view dashboards the Customer shares.
Categories of personal data
Determined solely by the Customer. Typically names, business contact details, identifiers, and commercial or financial figures linked to a person. For invited team members: name and email address. For viewers of shared dashboards: technical data such as IP address and, where the viewer consents, product analytics.
Special categories
None intended. Under section 5 of the Terms, the Customer must not upload special-category data (Art. 9 GDPR) or data relating to criminal convictions (Art. 10) without prior written agreement with EasyDash.
Frequency
Continuous while the Service is in use. Connected sheets re-sync on the schedule the Customer sets.
Annex II · Technical and organisational measures
Hosting and encryption
Customer Data is stored in Supabase (Postgres database and file storage) in AWS region eu-west-1, Ireland.
Data is encrypted at rest (AES-256) and in transit (TLS 1.2 or higher).
The processing worker runs on Railway in Google Cloud region europe-west4, the Netherlands. The web application’s server functions run on Vercel in region dub1, Ireland.
Access control
Row-level security in the database restricts every signed-in user to their own records.
Service-role credentials that bypass those policies are held only by server-side components (the processing worker and a small number of server routes). They are never sent to a browser.
Production access is limited to EasyDash’s founder. Provider accounts are protected by multi-factor authentication.
Password-protected share links use signed tokens, and a dashboard can be shared or embedded only when the Customer turns that on.
Embeds can be restricted to domains the Customer names.
Data minimisation towards the AI provider
To generate a layout, EasyDash sends OpenAI a description of the columns (names, data types, value ranges, number of distinct values) and example labels from columns with only a few distinct values.
Rows from the file are not sent.
OpenAI does not use API data for training by default and keeps it for up to 30 days for abuse monitoring.
Google data
Access to Google Sheets is limited to the individual files the user chooses in Google’s file picker (
drive.file). Access to Google Analytics and Search Console is read-only (analytics.readonly,webmasters.readonly) and limited to the report the user connects for each property or site. Nothing in the user’s Google account is ever modified.OAuth tokens are encrypted with AES-256-GCM, stored in the database under row-level security, and used only to re-sync the sheets and reports the user connected.
Change and development controls
Every code change goes through version control, automated linting, type-checking and tests before it reaches production.
Database schema changes are tracked migrations, replayed and checked against production.
Availability and resilience
The database provider takes daily backups and keeps them for 7 days.
Scheduled jobs are monitored, and a missed run raises an alert.
Deletion
Deleting a dashboard removes its stored file and compiled data.
Deleting an account removes all Customer Data within 30 days.
Personnel
Anyone given access to production is bound by confidentiality in writing before access is granted.
Incident response
Suspected breaches are investigated immediately and notified under section 8.2.
Annex III · Sub-processors
The sub-processors in use on the date of this DPA. The same list is kept current on our sub-processors page.
Supabase, Inc.
What they do for us
Database, file storage and sign-in
Data they touch
All customer data
Where the data is processed
Ireland (EU), AWS eu-west-1
Transfer safeguard
Stored in the EU. Standard Contractual Clauses in Supabase’s DPA cover support access from outside the EU.
Railway Corporation
What they do for us
Processes files and syncs connected sheets
Data they touch
All customer data, in transit through processing
Where the data is processed
The Netherlands (EU), Google Cloud europe-west4
Transfer safeguard
Processed in the EU. Railway is a US company; Standard Contractual Clauses in Railway’s DPA.
Vercel Inc.
What they do for us
Hosts the web application and its server functions
Data they touch
Customer data shown in dashboards and passed through server functions
Where the data is processed
Ireland (EU), region dub1. Pages are delivered through Vercel’s global network.
Transfer safeguard
EU–US Data Privacy Framework, and Standard Contractual Clauses in Vercel’s DPA.
OpenAI
What they do for us
Suggests dashboard layouts from a description of your columns
Data they touch
Column descriptions and a few example labels. Never the rows.
Where the data is processed
United States
Transfer safeguard
Standard Contractual Clauses in OpenAI’s Data Processing Addendum.
Resend (Plus Five Five, Inc.)
What they do for us
Sends account and notification emails, receives the emails you send to our support addresses, and sends our replies
Data they touch
Recipient names and email addresses, and dashboard names in email content. For support mail: the full message you send to support@, hello@ or privacy@easydash.app, including your name, email address, subject, message text and attachments, and the replies we send you
Where the data is processed
Emails are sent from the EU (eu-west-1). Email content, including support mail we receive, and delivery logs are stored in the United States for 30 days. Account records are also stored there.
Transfer safeguard
EU–US Data Privacy Framework, and Standard Contractual Clauses in Resend’s DPA.
PostHog, Inc.
What they do for us
Product analytics, only with your consent
Data they touch
Usage events and technical data of people who consent. Never dashboard contents.
Where the data is processed
Germany (EU), PostHog EU Cloud
Transfer safeguard
Processed in the EU.
Not sub-processors under this DPA. Google (Sheets, Analytics, Search Console, Sign in with Google) and GitHub (sign-in) are services the Customer’s users choose to connect with their own accounts. EasyDash receives data from them; they do not process Customer Data on EasyDash’s behalf. Stripe processes billing data with EasyDash as controller, under the Privacy Policy.