Data Processing Addendum
Last updated: 6 October 2026
This addendum forms part of the Terms of Service between Business117 OÜ and the customer, and applies whenever we process personal data on the customer’s behalf. It is made under Article 28 of the General Data Protection Regulation (GDPR).
The short version
You are the controller of the personal data in your workspace. We are your processor: we handle it only to provide the Service, as you instruct, keep it secure, and tell you quickly if something goes wrong.
You can see who helps us run the Service, object to new providers, audit how we meet these commitments, and take your data with you when you leave.
1. Roles and scope
1.1 “Customer Personal Data” means personal data that the customer or its users put into the Service or connect to it, and that we process on the customer’s behalf.
1.2 The customer is the controller of Customer Personal Data, and Business117 OÜ is its processor. Terms not defined here have the meaning given to them in the GDPR.
1.3 The customer is responsible for having a lawful basis for the processing and for the instructions it gives.
2. Details of the processing
2.1 Subject matter and purpose: providing the Service, including hosting, storage, retrieval, analysis, communication and AI-assisted features, as the customer uses and configures it.
2.2 Duration: the term of the customer’s agreement, plus the 30-day period after it ends during which data can be exported.
2.3 Categories of data subjects: the customer’s users, staff, clients, prospects, suppliers and partners; shareholders and beneficial owners; people screened in background checks; and other people whose data the customer chooses to process.
2.4 Types of personal data: identification and contact details; communications; business, project and booking records; financial transaction data that contains names; ownership and beneficial-ownership information; background-check results; and any other personal data the customer chooses to process. The customer should process special categories of data, or data about criminal convictions, only where it has a legal basis to do so.
3. Our obligations
3.1 We process Customer Personal Data only on the customer’s documented instructions. The Terms of Service and the customer’s use and configuration of the Service are its instructions. We tell the customer if we believe an instruction breaks data protection law.
3.2 We ensure that everyone authorised to process Customer Personal Data is bound by confidentiality.
3.3 We implement the security measures described in the annex below.
3.4 We help the customer, taking into account the nature of the processing, to respond to requests from data subjects and to meet its obligations on security, breach notification, data protection impact assessments and prior consultation.
3.5 We notify the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach that affects Customer Personal Data, with the information the customer needs to meet its own obligations.
3.6 When the agreement ends, the customer can export Customer Personal Data for 30 days. After that we delete it, unless the law requires us to keep it. Copies in backups are removed in the normal backup cycle.
3.7 We make available the information needed to demonstrate compliance with this addendum, and we allow audits by the customer or an auditor it mandates, on reasonable notice, at the customer’s cost and no more than once a year, unless a breach or a supervisory authority requires otherwise.
4. Sub-processors
4.1 The customer authorises us to use sub-processors. The current list is in section 4 of our Privacy Policy.
4.2 We give at least 30 days’ notice of a new sub-processor by email to the workspace owner. The customer may object on reasonable data protection grounds; if we cannot resolve the objection, the customer may end the affected service and receive a refund of fees paid in advance for the unused period.
4.3 We impose data protection obligations on each sub-processor that are no less protective than this addendum, and we remain responsible to the customer for their performance.
5. International transfers
5.1 Where Customer Personal Data is transferred outside the European Economic Area, we ensure that a transfer mechanism recognised by the GDPR is in place, such as an adequacy decision or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914).
6. Requests from authorities
6.1 We handle requests from authorities for Customer Personal Data as described in section 8 of the Terms of Service: we disclose only what the law requires, and we inform the customer first unless the law prohibits it.
7. Liability and precedence
7.1 The limitations of liability in the Terms of Service apply to this addendum to the extent the GDPR allows.
7.2 If this addendum and the Terms of Service conflict on the processing of personal data, this addendum prevails.
Annex: security measures
Encryption of data in transit (TLS) and at rest (AES-256), provided with our hosting providers.
Separation of each customer’s data at the database level, so that one workspace cannot read another’s.
Role-based access in each workspace (owner, admin, member, viewer), with per-person control over which pages can be opened.
Two-step login by email code or authenticator app, which a workspace can require for all its members; an automatic lock after a chosen idle time; and the ability to lock a member out or log them out everywhere.
An audit trail of logins, access changes and other security-relevant events, which the customer can filter and export.
Credentials for connected systems hidden from ordinary members, with access to them limited to owners and admins and recorded in the audit trail.
Read-only access to connected accounting and analytics systems and databases; AI tools that can only read the customer’s own workspace.
Hosting with providers that hold independent security certifications, such as SOC 2 Type 2 and ISO 27001, with regular backups managed by them.
Access by our personnel limited to what is needed to operate, secure and support the Service.
The Data Processing Addendum, answered
What is the Data Processing Addendum?
The GDPR Article 28 contract that governs how we process personal data on your behalf. It is part of the Terms of Service, so there is nothing separate to sign.
It applies whenever Business117 OÜ processes personal data that you or your users put into Engine117 or connect to it. Where it and the Terms differ on personal data, the addendum wins.
It is written so that an organisation subject to the GDPR can use Engine117 for personal data without negotiating a separate agreement.
Are we the controller or the processor?
You are the controller of the personal data in your workspace. Business117 OÜ is your processor and handles it only on your instructions.
Your instructions are the Terms of Service and the way you use and configure the Service. We tell you if we believe an instruction breaks data protection law.
You remain responsible for having a lawful basis for the processing.
In practice, that means you decide what personal data goes into the workspace and why, and we provide the tools and keep it safe.
Can we object to a new sub-processor?
Yes. We email the workspace owner at least 30 days before adding one, and you can object on reasonable data protection grounds.
If we cannot resolve the objection, you can end the affected service and get back what you paid in advance for the unused period. The current list is in section 4 of the Privacy Policy.
What happens if there is a data breach?
We tell you without undue delay, and in any case within 48 hours of becoming aware of it, with the information you need to meet your own obligations.
We also help you respond to requests from the people whose data you hold, and with your obligations on security, breach notification and data protection impact assessments.
Can we audit you?
Yes. You, or an auditor you appoint, can audit how we meet the addendum, on reasonable notice and at your own cost, up to once a year.
More often is possible when a breach or a supervisory authority requires it. We make available the information needed to show compliance. Write to legal@engine117.com to arrange an audit.
What security measures does the addendum commit to?
Encryption in transit (TLS) and at rest (AES-256), each customer’s data separated at database level, role-based access, two-step login and an activity log.
Access in each workspace is role-based (owner, admin, member or viewer), with per-person control over which pages can be opened, and a workspace can require two-step login for everyone. The full list is in the annex.
What happens to our data when we leave?
You have 30 days after the agreement ends to export it. After that we delete it, unless the law requires us to keep it.
Copies in backups are removed in the normal backup cycle. The addendum itself lasts for the term of your agreement plus that 30-day export period.
Do you help with data subject requests?
Yes. We help you respond to requests from the people whose data you hold, such as access and erasure, taking into account the nature of the processing.
We also help with data protection impact assessments and prior consultation where you need them.
Are the people who handle our data bound by confidentiality?
Yes. Everyone we authorise to process your personal data is bound by confidentiality.
Access is limited to what is needed to provide, secure and support the Service.