Data processing agreement

Effective date and last updated: 18 October 2026

This Data Processing Agreement ("DPA") forms part of the Harmoniq Terms and Conditions (https://harmoniq.ro/en/legal/terms) or other written agreement (the "Agreement") between:

(1) the company, institution or other organisation that has contracted for the Harmoniq service to manage its own staff and operations ("Customer", "Controller"); and

(2) SYNCDEV S.R.L., Romanian Trade Register no. J2014000164361, EUID ROONRC.J2014000164361, CUI / fiscal identification code 33129339, registered office at Str. Fetițelor nr. 4, camera nr. 1, 820035 Tulcea, Tulcea County, Romania ("SYNCDEV", "Harmoniq", "Processor").

This DPA is intended to satisfy Article 28(3) and (4) of Regulation (EU) 2016/679 ("GDPR"). The parties may sign it electronically or accept it as part of the online Agreement. Customer's account Owner accepts it on Customer's behalf at signup.

1. Definitions and precedence#

"Customer Personal Data" means personal data processed by SYNCDEV on behalf of Customer through Harmoniq.

"Data Protection Law" means the GDPR, Romanian Law no. 190/2018, applicable rules implementing Directive 2002/58/EC, and any other data-protection law applicable to the processing.

"Data Subject", "personal data", "processing", "controller", "processor", "personal data breach" and "supervisory authority" have the meanings given in the GDPR.

"Subprocessor" means another processor (sub-processor) engaged by SYNCDEV to process Customer Personal Data.

"Account Owner" means the Customer user who holds the owner role of the company account in Harmoniq.

If this DPA conflicts with the Agreement on protection of Customer Personal Data, this DPA prevails. If European Commission Standard Contractual Clauses used for an international transfer conflict with this DPA, those clauses prevail for that transfer.

2. Roles and scope#

Customer determines the purposes and essential means of processing Customer Personal Data in managing its staff, organisation, performance, internal communication and, where it uses the customer-relationship (CRM) module, its relationship with its own customers. Customer is the controller and SYNCDEV is the processor.

SYNCDEV is a separate controller for its own prospect/customer relationship, the public website and its forms, signup and the free trial, SaaS-account administration, subscription billing, direct support relationship, platform security and legal compliance, as described in the Harmoniq Privacy Policy (https://harmoniq.ro/en/legal/privacy). This DPA does not apply to that independent-controller processing.

The public demo companies on the website contain invented data only and hold no Customer Personal Data.

The details of processing required by Article 28(3) GDPR are in Annex 1.

3. Customer instructions#

SYNCDEV will process Customer Personal Data only:

• to provide, secure, maintain and support the Harmoniq service;
• as configured or initiated by Customer and its authorised users through the service;
• as described in the Agreement, this DPA and its Annexes;
• to provide a feature expressly enabled by Customer, such as the AI assistant, SMS notifications or the company API; and
• under other documented written instructions accepted by SYNCDEV.

The Agreement, this DPA, Customer's configuration and authorised use of a feature constitute documented instructions.

SYNCDEV will not sell Customer Personal Data, use it for its own advertising, combine it with data from other customers, or use it to train artificial-intelligence models.

If Union or Member State law requires processing outside Customer's instructions, SYNCDEV will inform Customer before processing unless the law prohibits that notice on important grounds of public interest.

SYNCDEV will inform Customer without undue delay if, in its opinion, an instruction infringes Data Protection Law. SYNCDEV may suspend the affected processing while the parties clarify or amend the instruction.

4. Customer obligations#

Customer warrants and undertakes that:

• it has a valid lawful basis for each processing purpose and has provided all information required by Articles 13 and 14 GDPR, including informing its employees about its use of Harmoniq and, where it uses the CRM module, its own customers;
• its instructions comply with Data Protection Law;
• it collects and uses only personal data that is adequate, relevant and necessary;
• it has the rights and authority needed to upload, disclose or instruct processing of the data and content;
• it processes the personal numeric code (CNP) and health data only under the conditions of Section 10;
• it will not use Harmoniq for unlawful discrimination or solely automated decisions prohibited by Article 22 GDPR;
• it will not upload special-category data other than the health data described in Annex 1, criminal-offence data or children's data unless strictly necessary, expressly agreed with SYNCDEV, and supported by all required legal conditions and safeguards;
• it configures roles, permissions, managers' reach, retention periods, notifications, communications, CRM marketing consents and integrations lawfully;
• it enables the AI assistant only after assessing the transmission of data to the AI provider described in Annex 3 and informing Data Subjects;
• it responds to Data Subjects and authorities as controller; and
• its authorised users keep passwords, authentication codes and API or integration keys secure.

Customer is responsible for the accuracy, quality and legality of Customer Personal Data and the means by which it was obtained.

5. Confidentiality and personnel#

SYNCDEV will ensure that persons authorised to process Customer Personal Data:

• are subject to a contractual or statutory duty of confidentiality;
• receive access only where needed for their duties;
• receive appropriate privacy and security instructions; and
• process the data only as permitted by this DPA.

SYNCDEV's platform team accesses Customer Personal Data only for support at Customer's request and for security and operations. Support access to Customer's account (support impersonation) is possible only from the platform console, with two-factor authentication, through a single-use link valid for 60 seconds; the session is limited to at most 30 minutes, is used only for the authorised support purpose and is recorded in Customer's activity history. While impersonating, the application refuses the actions that only the person themselves may take, and the person's direct messages are not shown.

6. Security#

Taking account of the state of the art, implementation costs, nature, scope, context and purposes of processing, and the risk to individuals, SYNCDEV will implement and maintain appropriate technical and organisational measures under Article 32 GDPR.

The baseline measures are described in Annex 2. SYNCDEV may update measures to address risk and technology, provided the overall protection is not materially reduced.

Customer acknowledges that security is a shared responsibility. Customer must configure roles and permissions appropriately, enable or require two-factor authentication where needed, secure devices and credentials, maintain authorised-user lists, restrict API keys to the rights and IP addresses needed, and report suspected compromise promptly.

7. Personal data breaches#

SYNCDEV will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Notification is not conditional on the breach being confirmed or on an investigation being completed. Where feasible, SYNCDEV will send an initial notice within 24 hours of becoming aware. That 24-hour period is an operational target inside the overriding duty to notify without undue delay and never postpones notification beyond it.

The notice is sent by email to the Account Owner and, where applicable, to other contacts Customer has designated.

The notice will provide information available to SYNCDEV concerning:

• the nature of the breach, affected data and approximate number/categories of Data Subjects and records;
• likely consequences;
• measures taken or proposed to contain and remedy it;
• a contact point for follow-up; and
• information reasonably needed for Customer's Articles 33 and 34 GDPR assessment.

Where the facts are not yet established, SYNCDEV will send a preliminary notice with the information then available instead of waiting for the investigation to conclude, and will supplement it in phases as further information becomes available. Notification is not an admission of fault or liability.

SYNCDEV will take reasonable steps to contain, investigate and remediate the breach and will cooperate with Customer. Customer remains responsible for deciding whether and how to notify a supervisory authority or Data Subjects, unless law assigns that duty directly to SYNCDEV.

8. Data Subject requests#

Taking account of the nature of processing, SYNCDEV will provide reasonable technical and organisational assistance to help Customer respond to requests under Chapter III GDPR.

Harmoniq includes functions that help Customer respond to these requests:

• export of all data about one person in a structured archive (JSON files, one per kind of record, together with the attached files);
• rectification directly in the records in the application and, where Customer allows it, by the person themselves;
• requests filed by employees from their own account, with tracking of the 30-day statutory deadline;
• anonymisation of former employees, keeping the records the law requires Customer to keep, without identifying data;
• for Customer's customers in the CRM: data export, erasure that keeps the figures in anonymised form, and the history of marketing consents.

Customer remains responsible for applying the correct legal exceptions and confirming its response to the Data Subject.

If SYNCDEV receives a request concerning Customer Personal Data directly from a Data Subject, it will not respond on the merits unless authorised by Customer or required by law. Where the requester and Customer can be identified, SYNCDEV will direct the requester to Customer or forward the request without undue delay.

9. Compliance assistance#

Taking account of the nature of processing and information available to it, SYNCDEV will provide reasonable assistance with Customer's obligations under Articles 32 to 36 GDPR, including security, breach assessment, data protection impact assessments and prior consultation.

Employee performance evaluation and the processing of health data and the CNP may make a data protection impact assessment necessary at Customer. On request, SYNCDEV provides the information Customer reasonably needs for it, including a description of the processing, the data flows, the measures in Annex 2 and the Subprocessors in Annex 3, in line with Article 28(3)(f) GDPR.

Assistance included in standard product features is covered by the subscription fee. Substantial bespoke work may be charged at the agreed professional-services rate, provided SYNCDEV gives advance notice and the charge does not prevent Customer from meeting a statutory obligation.

10. Processing that needs particular care#

10.1. Health data#

Harmoniq may hold health data if Customer records it: medical-leave types and the certificates attached to leave requests, and occupational-medicine check results and documents in the occupational health and safety (SSM) records. Customer decides whether to record them and processes them only to the extent required by its obligations in the field of employment, social security and social protection law, under Article 9(2)(b) GDPR. Customer restricts access to this data through roles and permissions in Harmoniq. The signals shown to managers never use medical leave.

10.2. Personal numeric code (CNP)#

Customer processes the CNP only under the conditions of Article 4 of Law no. 190/2018 and employment law, to meet its obligations as employer. In Harmoniq, the CNP is encrypted in the database, searching by CNP uses a separate cryptographic index, it does not appear in lists, logs or the change history, and the full value is visible only to users to whom Customer has granted the dedicated sensitive-data permission.

10.3. Automatically calculated scores#

Harmoniq calculates performance scores, levels and bonuses from the formulas and rules Customer defines and shows signals to managers (for example, a score falling three periods in a row, overdue training or expired SSM checks). Missing data is never counted as zero, and every result keeps the formula version and the input data used. Harmoniq takes no decisions. Before any decision that produces legal or similarly significant effects for a person (for example, pay, sanctions or termination of employment), Customer ensures human intervention and the person's ability to express their point of view and contest the decision, and informs employees about how scores are calculated, as required by Article 22 GDPR.

10.4. Anonymous surveys#

Answers to anonymous surveys are kept sealed until the survey closes, then recorded all at once, in random order, without any link to the identity or time of the answer; results are shown only from five answers. The content of a text answer may still identify its author, and Customer takes this into account when writing questions and using results.

10.5. AI assistant#

The AI assistant works only if Customer's plan includes it and Customer has switched it on in the company settings; it does not work in demo companies or while someone is signed in as another person. The assistant acts as the user who uses it and only within that user's rights and reach. Changes the assistant proposes are saved only after the user confirms them, with every check applied again.

People's names, email addresses and phone numbers leave for the AI provider only as pseudonyms (for example «C1», «P1», «E1», «T1») and are put back on SYNCDEV's servers; organisation and unit names and figures leave as they are; in free texts (comments, notes) known names are replaced by pseudonyms. Pseudonymisation reduces risk but does not make the data anonymous: a free text may contain other identifying elements. Conversations are kept for at most two hours in the service's temporary cache, then deleted. Usage is recorded as metadata only (who, when, feature, volume), never the text sent or received. The assistant's answers are suggestions the user must check.

If Customer uses the platform's AI account, the AI provider is a Subprocessor of SYNCDEV (Annex 3). If Customer connects its own AI account, requests are sent, on Customer's instruction, to the provider Customer has chosen and contracted directly, with the key Customer configured (stored encrypted); that provider is not a Subprocessor of SYNCDEV, and its terms on retention, training and transfer of data are those of Customer's contract with it.

11. Subprocessors#

Customer gives SYNCDEV general written authorisation to use the Subprocessors in the current Subprocessor Register. The register is Annex 3 and is published, with the same information and the date of the last change, at https://harmoniq.ro/en/legal/subprocessors.

Before a new Subprocessor begins processing Customer Personal Data, SYNCDEV will:

• carry out a proportionate privacy and security assessment;
• enter a written contract imposing data-protection obligations no less protective than the relevant obligations in this DPA;
• update the register; and
• give Customer at least 30 days' prior notice by email to the Account Owner and on the register page, unless an urgent replacement is necessary to protect security, prevent service interruption or comply with law; in that case SYNCDEV notifies Customer as soon as possible and Customer keeps its right to object.

Customer may object during the notice period, at dpa@harmoniq.ro, on reasonable and documented data-protection grounds. The parties will work in good faith on a commercially reasonable solution, such as avoiding the affected feature. If no reasonable solution is available, either party may terminate only the affected optional feature or, where the Subprocessor is necessary for the core service, Customer may terminate the Agreement before the Subprocessor begins processing. Termination rights do not create a refund beyond amounts required by the Agreement or mandatory law.

SYNCDEV remains responsible to Customer for each Subprocessor's performance of its processor obligations to the extent required by Article 28(4) GDPR.

12. International transfers#

Customer Personal Data is hosted in the European Economic Area (EEA). SYNCDEV will not transfer Customer Personal Data outside the EEA or allow access from a third country except:

• on Customer's documented instruction; or
• where a valid Chapter V GDPR transfer mechanism and required supplementary measures are in place.

Depending on the recipient, the mechanism may be an applicable adequacy decision, the recipient's valid participation in the EU-US Data Privacy Framework for covered data, or the European Commission Standard Contractual Clauses adopted by Decision (EU) 2021/914. At the date of this DPA, the only Subprocessors where a transfer outside the EEA may take place are the AI providers in Annex 3, and only for Customers who have switched the AI assistant on.

Where Standard Contractual Clauses are required:

• the appropriate controller-to-processor or processor-to-processor module applies;
• Annexes 1 to 3 of this DPA may supply the corresponding factual annex information to the extent complete;
• the optional docking clause applies;
• Romanian law governs the clauses where a Member State law must be selected;
• Romanian courts are the selected forum where permitted; and
• SYNCDEV will carry out and document a transfer impact assessment and supplementary safeguards where needed.

SYNCDEV will make information about the relevant safeguard available to Customer on request, subject to necessary confidentiality redactions.

13. Return, export and deletion#

During the Agreement and the closure period described below, the Account Owner may download at any time, from the "Company data and account" page, the complete export of Customer Personal Data in a structured, commonly used, machine-readable form: a ZIP archive with one CSV file (UTF-8) for each table holding Customer's data, together with every uploaded file (documents, photos, attachments). The export contains CNPs in clear, as they are Customer's data, and leaves out passwords, two-factor secrets, access tokens and notification keys. Customers with access to the company API can also read their data through the API. The structures, formats, identifiers and known technical limitations are set out in the Data Export and Switching Register at https://harmoniq.ro/en/legal/switching.

On termination or Customer's written deletion instruction, Customer chooses return (through the export) or deletion, unless the Agreement already records that choice. Closing the account is initiated by the Account Owner personally, from the application. Subject to security and identity verification:

• the subscription is cancelled on closure and Customer's users no longer have access to the application;
• for 30 days after closure, the Account Owner can download the complete export or reopen the account; the Account Owner receives a warning seven days before deletion;
• after the 30 days, active Customer Personal Data is permanently deleted, together with uploaded files and configured custom domains; only a deletion record is kept, with the number of records deleted, without the content of the data;
• encrypted backups expire through rotation, so that no copy is older than about 90 days (Annex 2); they are used only for restoration after an incident;
• if a backup is restored, deletions and anonymisations recorded after the backup date are re-applied before the service is reopened; and
• SYNCDEV will provide reasonable confirmation of completed deletion on request.

The invoices SYNCDEV issues to Customer for the subscription are kept by SYNCDEV, as controller, together with Customer's billing details, for the period required by accounting and tax law. Under the current Article 25 of Romanian Accounting Law no. 82/1991, the general retention period for supporting accounting documents is five years from 1 July of the following year, subject to other specific statutory periods and documented legal holds.

If Union or Member State law applicable to SYNCDEV requires storage after Customer's deletion instruction, SYNCDEV will isolate the data, process it only for that legal purpose, protect it and delete it when the requirement ends. Where legally permitted, SYNCDEV will inform Customer of the requirement.

The end of the free trial, suspension, downgrade or non-payment does not itself instruct permanent deletion. During those non-destructive states the account may be restricted, but Customer's data is not deleted, as described in the Agreement.

14. Demonstrating compliance and audits#

SYNCDEV will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.

No more than once per 12-month period, unless a breach, supervisory-authority request or credible material non-compliance justifies more, Customer may audit compliance. The parties will use the least disruptive method:

• documentation, available reports and written responses;
• a scoped remote review; and
• an on-site inspection only where the earlier evidence is insufficient.

Customer must give at least 30 days' notice unless an urgent legal reason prevents it. Auditors must be independent, qualified, not direct competitors of SYNCDEV, and bound by confidentiality. An audit may not compromise another customer's data, system security or privileged information. Customer bears its costs; SYNCDEV bears its ordinary cooperation costs, but may charge pre-agreed reasonable costs for unusually burdensome bespoke work.

Audit restrictions do not limit a competent supervisory authority's powers.

15. Records and cooperation with supervisory authorities#

SYNCDEV will maintain records required of a processor under Article 30(2) GDPR and cooperate with competent supervisory authorities as required by Articles 31 and 58 GDPR.

16. Liability#

Liability between the parties is governed by the Agreement, subject to Articles 82 and 83 GDPR and any liability that cannot lawfully be excluded or limited. Nothing in the Agreement or DPA deprives a Data Subject of rights or remedies under Data Protection Law.

17. Duration and termination#

This DPA begins when SYNCDEV first processes Customer Personal Data under the Agreement and continues until that processing ends, including the closure and deletion period. Provisions that must logically survive, including confidentiality, retained-data restrictions, audits relating to the term and international-transfer protections, remain effective for as long as relevant data is retained.

SYNCDEV may amend this DPA by publishing a new version, announced in advance to the Account Owner as provided in the Agreement; an amendment may not reduce the level of protection of Customer Personal Data.

18. Governing law and contact#

This DPA is governed by Romanian law, without prejudice to mandatory GDPR rights and the jurisdiction provisions of any applicable Standard Contractual Clauses.

Contact for this DPA, Subprocessor notices, incidents and audits: dpa@harmoniq.ro. For other data-protection questions: privacy@harmoniq.ro. SYNCDEV has not appointed a data protection officer.

Annex 1 — Details of processing#

A. Subject matter#

Provision of the Harmoniq multi-tenant SaaS service for human-resources and performance management, to the extent enabled and used by Customer: people and organisation (employee records, placements in units, departments, positions and teams, custom fields), user accounts, roles, managers' reach, delegation and deputies, approvals, notifications (in-app, email, browser and, if Customer enables them, SMS), calendar, leave and absences, performance (metrics, formulas, scorecards, scores, levels, bonuses, evaluation grids, objectives, signals), learning (courses, tests, enrolments, certificates), internal communication (feed, announcements with read confirmation, groups, kudos, polls, events, photo albums, direct messages), knowledge base, documents with expiry alerts, service and material requests, SSM records, internal audits and action plans, photo reporting, surveys (including anonymous ones), CRM (Customer's customers, deals, activities, feedback, consents), reports and exports, imports, the company API, the AI assistant, GDPR tools and support.

B. Duration#

For the term of the Agreement, the 30-day period after the account is closed and the backup expiry cycle of at most about 90 days, as well as any lawful retention period described in Section 13.

C. Nature and purpose#

Collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, calculation (for example, scores from formulas defined by Customer), transmission to Customer-authorised recipients, restriction, export, pseudonymisation, anonymisation and deletion, solely to provide, secure, support and improve the contracted service on Customer's instructions.

"Improve" does not authorise training a provider's AI model on Customer Personal Data. Any such use requires a separate lawful instruction and appropriate notice or consent where applicable.

D. Categories of Data Subjects#

• Customer's employees, contractors, interns and former employees;
• Customer's authorised users, including managers, administrators and the Account Owner;
• candidates, if Customer records them;
• Customer's customers (individuals) and the contact persons of its customer organisations, in the CRM module;
• contact persons of Customer, its suppliers and its partners; and
• persons whose names, images or other identifiers appear in content uploaded by Customer (documents, photos, messages, comments, notes).

E. Categories of personal data#

• identity and contact data: first and last name, staff number, email, phone, address, date of birth;
• the CNP, encrypted and fully visible only with the dedicated permission;
• employment data: contracts, start and end dates, placements (unit, department, position, team), managers, delegations, custom fields (those marked sensitive are encrypted);
• account and security data: sign-in email, password hash, two-factor authentication, roles, permissions, sessions, last activity, history of actions;
• working time, leave and absences: requests, balances, approvals, including medical leave and the attached certificates;
• occupational health and safety: training, SSM records, including occupational-medicine check results;
• learning: enrolments, progress, test answers, grades, certificates;
• performance: metric values, scores, levels, calculated bonuses, evaluations with points and comments, objectives, signals;
• uploaded photos and documents, including the profile photo;
• internal communication: posts, comments, reactions, kudos, votes, event answers, read confirmations, views, the profile the person chooses to share, direct messages and their attachments (kept as long as Customer decides), survey answers (anonymous ones are not linked to the person), requests and their attachments;
• CRM data: identity and contact data of Customer's customers, deals, activities (calls, visits, purchases with amounts), feedback, complaints and ratings, marketing consents and their history;
• technical data: IP address and browser user agent in sessions and security logs, the API call log, browser-notification subscriptions;
• requests to the AI assistant and its answers, with people pseudonymised as described in Section 10.5; and
• any other personal data Customer chooses to enter consistently with this DPA.

F. Sensitive data#

Harmoniq may process health data (medical leave and the attached certificates, occupational-medicine check results), only under the conditions of Section 10.1 and under Article 9(2)(b) GDPR. Processing of other special categories under Article 9 GDPR, criminal-offence data under Article 10, or data about children is not expected. Such data may be processed only under an express written amendment covering necessity, lawful condition and additional safeguards.

G. Frequency#

Continuous or as initiated by Customer and its users.

H. Controller rights and obligations#

As stated in the Agreement, DPA and GDPR, including determining purposes and legal bases, giving notices, handling Data Subjects' rights, configuring features and issuing lawful instructions.

Annex 2 — Technical and organisational measures#

1. Access control#

• individual accounts and no shared privileged credentials;
• role- and permission-based access with least privilege; a manager sees only the people within their reach;
• nobody can grant anyone more rights than they hold themselves; the company account always keeps at least one Owner;
• delegations and deputy cover are time-limited and checked on every use;
• mandatory two-factor authentication (TOTP) for the platform team, set up through single-use links, and two-factor authentication for Customer's users, which Customer can make mandatory;
• controlled, time-limited support impersonation recorded in Customer's history (Section 5);
• API keys with limited rights (scopes), an optional IP allowlist and a record of every call;
• password confirmation before sensitive platform-team actions; and
• confidentiality obligations for persons with access.

2. Customer separation and application security#

• logical separation of customers through the customer identifier on every record, queries filtered automatically by customer and database constraints that include the customer identifier;
• an automated test suite that checks, for every page showing records, that one customer cannot access another customer's data; scheduled and background jobs run only in the context of one customer;
• authorisation checks at every protected action and resource;
• secure password hashing (bcrypt);
• input validation, cleaning of user-authored content before display, CSRF protection, a content security policy (CSP) and other security headers, rate limiting;
• uploaded files are kept in private storage, separate per customer, and served only through authorised routes; import files holding personal data are deleted when the import ends and in any case after one day; generated report files are kept for one day;
• AI assistant: pseudonymisation, rules confining it to the company's data in Harmoniq, screening of requests and answers, a monthly request limit per plan and a daily safeguard on the platform account; only the number of requests and tokens is kept, never their text;
• server-level protection: firewall, automatic blocking of abusive addresses and a platform lockdown switch for emergencies; and
• a dependency and vulnerability-management process.

3. Encryption and transmission#

• HTTPS for all traffic, with HSTS;
• HTTP-only, secure and same-site cookies;
• the CNP encrypted in the database, with a separate cryptographic index (HMAC) for searching;
• encryption of custom fields marked sensitive, two-factor secrets, API keys and integration credentials (for example, Customer's SMS account or its own AI account);
• encrypted backups; and
• key access restricted and separated from application data.

4. Logging and monitoring#

• a history of changes to staff data and of administrative actions, visible to Customer; the CNP and the values of sensitive fields never appear in logs or the change history;
• the company API call log;
• for the AI assistant only metadata is recorded (user, time, feature, volume), never the text sent or received;
• an audit log of platform-team actions, without the values of secrets;
• recording of system errors, grouped and redacted before storage, with an alert to the platform team;
• phone numbers are not recorded in logs; and
• retention schedules enforced by scheduled tasks.

5. Availability, backup and recovery#

• production is hosted by Hetzner Online GmbH in Germany; the application, database, files, cache and queues, real-time messaging and mail server run in this EEA environment;
• an encrypted backup of the database and files every night; the last three days are kept on the server and the rest in an encrypted repository outside the production server, also in the EEA at Hetzner, with 14 daily and 12 weekly snapshots, so that no copy is older than about 90 days; the integrity of a part of the repository is checked every night;
• before each release a copy of the database is made on the server, of which the last ten are kept;
• the sealed answers of anonymous surveys that are still open are deliberately left out of backups, so that no copy can link an answer to a person;
• backup access is limited to authorised SYNCDEV personnel;
• SYNCDEV maintains a documented restore procedure and tests it periodically, at least annually and after a material infrastructure change, by restoring into a separate database rather than over production, recording each test and its result;
• after any restore into production, deletions and anonymisations recorded after the backup point are re-applied before the service is reopened, so that data already deleted does not return; and
• the SYNCDEV administrator owns recovery decisions, the restoration record and the incident escalation path.

6. Secure development and change management#

• code review for material changes;
• automated tests for authentication, authorisation, customer separation, reach, billing, export, deletion and anonymisation, run before every release;
• a check of the production configuration before every release;
• supported dependencies and security updates;
• separation of production credentials from source code and non-production environments;
• no production personal data in development or test environments; and
• rollback procedures for changes and incidents.

7. Data lifecycle#

• data minimisation and retention rules;
• structured export (per person and complete) and rectification functions;
• anonymisation of former employees and erasure of CRM customers keeping the figures, covering related records and uploaded files;
• a minimised deletion record, for re-application after a restore and for accountability;
• complete deletion of Customer's data 30 days after the account is closed;
• deletion by scheduled tasks of import and report files, AI conversations (after two hours) and direct messages older than the period Customer chooses; and
• anonymous surveys: answers sealed until closing, then recorded all at once, in random order, without identity or time of answer; results shown only from five answers.

8. Incident response#

• a documented incident triage, containment, investigation, evidence preservation, recovery and notification procedure;
• an incident register, with internal 24-hour and 72-hour deadlines tracked, and post-incident corrective actions;
• the responsible role is the SYNCDEV administrator and the operational incident address is dpa@harmoniq.ro;
• only authorised SYNCDEV personnel have administrative access to the server and backups;
• critical incidents are escalated outside normal working hours subject to available on-call coverage; no continuous overnight response time is promised; and
• Customer notification is made under Section 7 without undue delay after SYNCDEV becomes aware of a personal data breach and, where feasible, within the stated 24-hour operational target measured from that awareness, including by preliminary notice while the investigation continues.

Annex 3 — Subprocessor register#

Effective register date: 17 October 2026. The register is published and kept up to date at https://harmoniq.ro/en/legal/subprocessors.

1. Hetzner Online GmbH (Hetzner)#

• Service and purpose: production servers, database, file storage, cache and queues, real-time messaging, the mail server and the encrypted backup repository.
• Data: all Customer Personal Data stored or transmitted through the core service.
• Location: Germany, EEA.
• Status: essential.
• Transfer basis: no Chapter V transfer for the hosting service in Germany.
• Terms: https://www.hetzner.com/legal/terms-and-conditions/ and the data-processing agreement made available by Hetzner.

2. Sendinblue SAS (Brevo)#

• Service and purpose: SMTP relay for transactional email: invitations, sign-in, notifications, digests and Customer-initiated messages.
• Data: recipient and sender details, message content, delivery metadata and technical logs.
• Location: primarily France/Germany in the EEA; limited support or subprocessor access may occur in other countries identified by Brevo.
• Status: essential for email delivery.
• Transfer basis: adequacy decision where applicable; otherwise the European Commission Standard Contractual Clauses and supplementary safeguards under Brevo's data-processing terms.
• Terms: https://www.brevo.com/legal/termsofuse/

3. Anthropic Ireland, Limited and its listed subprocessors (Anthropic)#

• Service and purpose: the AI assistant on the platform account (current provider): answers to questions about KPI and CRM data, proposed changes, summaries, list filters, message drafts, feedback analysis, setup drafts and the weekly digest.
• Data: users' requests and the data needed for that request, with people's names, email addresses and phone numbers replaced by pseudonyms; organisation and unit names, figures and free texts with known names replaced; limited technical metadata.
• Location: Ireland/EEA and other countries listed in Anthropic's current subprocessor register, which may include the United States.
• Status: optional; used only for Customers whose plan includes the AI assistant, who have switched it on and who use the platform's AI account.
• Transfer basis: adequacy decision where applicable, including the EU-US Data Privacy Framework for a certified recipient; otherwise Commission Standard Contractual Clauses and supplementary safeguards.
• Terms: https://www.anthropic.com/legal/commercial-terms

4. OpenAI Ireland Ltd. and its listed subprocessors (OpenAI)#

• Service and purpose: alternative provider for the AI assistant on the platform account, with the same functions as the current provider.
• Data: the same categories as in item 3, pseudonymised in the same way.
• Location: Ireland/EEA and other countries listed in OpenAI's current subprocessor register, which may include the United States.
• Status: optional; used only if SYNCDEV chooses this provider for the platform's AI account and only for Customers who have switched the AI assistant on.
• Transfer basis: adequacy decision where applicable, including the EU-US Data Privacy Framework for a certified recipient; otherwise Commission Standard Contractual Clauses and supplementary safeguards.
• Terms: https://openai.com/policies/data-processing-addendum/

5. Google Cloud EMEA Limited and its listed subprocessors (Gemini API)#

• Service and purpose: alternative provider for the AI assistant on the platform account, with the same functions as the current provider.
• Data: the same categories as in item 3, pseudonymised in the same way.
• Location: EEA and other countries listed in Google's current subprocessor register, which may include the United States.
• Status: optional; used only if SYNCDEV chooses this provider for the platform's AI account and only for Customers who have switched the AI assistant on.
• Transfer basis: adequacy decision where applicable, including the EU-US Data Privacy Framework for a certified recipient; otherwise Commission Standard Contractual Clauses and supplementary safeguards.
• Terms: https://cloud.google.com/terms/data-processing-addendum

Notes on the AI providers#

The platform's AI account uses one provider at a time from items 3 to 5, and the provider in use is shown to Customer in the AI assistant settings. A switch to another listed provider is announced to Customer at least 30 days in advance, by email to the Account Owner and on the register page, and Customer keeps its right to object under Section 11 and the option to switch the assistant off. SYNCDEV remains responsible for the Subprocessor relationship under Section 11. Customer Personal Data is not authorised for training a provider's model.

Recipients that are not Subprocessors of SYNCDEV#

As of the register date, Harmoniq does not use external content-delivery, error-tracking, search or caching services in production: search runs in the database, and real-time messaging, cache and queues run on the Hetzner servers, with no other third-party service involved. The application's fonts are hosted on the same servers.

• The provider of Customer's own AI account (Anthropic, OpenAI or Google): if Customer connects its own AI account, the assistant's requests go to the provider Customer has chosen and contracted directly, with the key Customer configured. Harmoniq sends the requests on Customer's instruction; that provider is not engaged by SYNCDEV.
• smslink.ro: SMS notifications use the account Customer has contracted directly with smslink.ro. Harmoniq sends the messages on Customer's instruction, with the credentials Customer configured.
• Stripe and SmartBill: used for SYNCDEV's own SaaS subscription payments and fiscal invoicing. They process data for SYNCDEV's separate-controller activities and are therefore listed in the Privacy Policy, not as Subprocessors of Customer Personal Data.
• ANAF, VIES and the National Bank of Romania: public services queried to check a company's tax identification number and for exchange rates; they receive at most the company's identification number, not Customer Personal Data.
• Web push: where a user enables browser notifications, the encrypted message is delivered through the push service their own browser vendor operates (Google, Mozilla or Apple, depending on the browser), using the subscription endpoint that browser issued. SYNCDEV holds no account with those services and sends no content in the clear: the payload is encrypted end-to-end, and the recipient is identified only by the browser-issued endpoint. They are recipients of that delivery, not processors of Customer Personal Data.