Back to home
Plenetic

Data Processing Agreement (DPA / AVV)

Version 2026-10-14

This Data Processing Agreement is part of the contract between the customer organization (controller) and Plenetic GmbH (processor) under Art. 28 GDPR. It applies when Plenetic processes personal data in the signed-in workspace on the customer’s instructions. Accepting the Terms of Service concludes this DPA for that organization.

1. Subject matter, duration, nature, and purpose

Plenetic hosts and processes the personal data the customer stores in the workspace so the customer can use the service (CRM, tasks, documents, email, calendar, and related tools, including optional AI features). Processing lasts for the term of the contract. After the contract ends, the customer can export the workspace for 30 days. Plenetic then deletes the workspace data, except where the law requires a longer retention.

2. Types of data and data subjects

Data types depend on what the customer stores. They typically include business contact details, communications, documents, calendar entries, and account data of the customer’s users. Data subjects are the customer’s users and the people described in the customer’s records (for example contacts and leads). Plenetic does not ask for special categories of personal data under Art. 9 GDPR, and the service is not designed to record them. Absence entries do not include a reason and do not store a sick note or other attachment. The customer must not use the service to process Art. 9 data.

3. Instructions

Plenetic processes personal data only on the customer’s documented instructions, including with regard to transfers to third countries. The Terms of Service, this DPA, and the customer’s use of the product are those instructions. If EU or Member State law requires Plenetic to process the data in another way, Plenetic tells the customer before processing, unless that law forbids it on important grounds of public interest. Plenetic will inform the customer without undue delay if an instruction appears to breach the GDPR or other EU or Member State data-protection law.

4. Confidentiality and security

People authorized to process the data are bound to confidentiality. Plenetic applies the measures in the annex below, under Art. 32 GDPR.

5. Subprocessors

The customer authorizes Plenetic to use the subprocessors listed at /subprocessors. Plenetic will tell the customer at least 30 days before adding or replacing a subprocessor, by updating that page and, where Plenetic has a billing contact, by email. The customer may object in writing within 15 days of that notice. If the objection is not resolved, the customer may stop using the affected feature or end the contract before the change takes effect. Plenetic imposes the same data-protection obligations as in this DPA on each subprocessor by contract. Plenetic remains fully liable to the customer for its subprocessors’ performance of those obligations. Mailbox and calendar providers that a user connects, and services the customer has engaged under a separate contract, are not Plenetic subprocessors.

6. Data subject rights, breaches, and audits

Plenetic assists the customer, taking into account the nature of the processing, with requests from data subjects and with the customer’s duties on security, breach notification, data-protection impact assessments, and prior consultation of a supervisory authority, insofar as the customer cannot do so itself. Plenetic notifies the customer without undue delay after becoming aware of a personal-data breach affecting the customer’s data. Plenetic makes available the information necessary to demonstrate compliance with this DPA and allows for and contributes to audits, including inspections, by the customer or an auditor the customer mandates. The customer gives reasonable notice. The audit takes place during business hours, covers only this processing, and is run so that the service and other customers’ data stay protected.

7. Deletion and return

During the 30 days after the contract ends, the customer can export workspace records and document files. When that period ends, Plenetic deletes the workspace, including stored files. Backups age out on their normal cycle. Aggregated token-usage figures that contain no prompt or message text may be kept for billing.

8. International transfers

Application hosting and storage run on Amazon Web Services in the EU region eu-north-1 (Stockholm). AI prompts and answers are sent through OpenRouter’s EU API to OpenAI and Azure only, with no fallback to other hosts. Each request sets zero data retention and denies provider data collection. OpenRouter’s data processing agreement includes the EU standard contractual clauses (Module 2, controller to processor) and an EU-only addendum for payloads sent through that EU API. Under that addendum, OpenRouter processes those prompts and answers in the EU/EEA and does not intentionally make them accessible from outside it, except where the law requires it. OpenRouter deletes them promptly after the response, except for transient processing, abuse detection, and records the law requires. OpenRouter does not guarantee OpenAI’s or Microsoft’s own retention. OpenRouter account and operations data may be processed in the United States under those clauses. OpenRouter is not certified under the EU–US Data Privacy Framework. Stripe transfers data to Stripe, Inc. under the EU–US Data Privacy Framework and standard contractual clauses. Plenetic transfers personal data outside the EEA only under an adequacy decision (Art. 45 GDPR) or with appropriate safeguards (Art. 46 GDPR).

9. Rights and obligations of the customer

The customer is responsible for the lawfulness of the processing and for the data it stores in the workspace, including informing data subjects. The customer does not submit special categories of personal data (Art. 9 GDPR) to the AI assistant. The customer may give instructions in text form, may verify Plenetic’s compliance as set out in section 6, and tells Plenetic without undue delay if it finds errors or irregularities in the processing.

Annex: technical and organizational measures

Confidentiality • Access to a workspace requires an authenticated user of that organization. Data is separated by organization in the application, and permissions are set per module and role. • At Plenetic, only one administrator, a managing director, can access customer workspaces or run a data export on a customer’s behalf. Administrator actions are logged and kept for 12 months. • People with access are bound to confidentiality. Encryption • Traffic is encrypted in transit (HTTPS). Databases and file storage are encrypted at rest. Integrity • Write actions proposed by the AI assistant are applied only after a user confirms them, and that confirmation is logged for 12 months. • Application logs are written so that secrets are redacted. Customer content is not written to those logs. Availability and recovery • The service runs on managed AWS infrastructure in eu-north-1. Database backups are kept on a 30-day rotation in the same region and allow the database to be restored. Data minimization and deletion • OpenRouter is instructed to delete AI prompts and answers promptly after the response, except for transient processing, abuse detection, and what the law requires. OpenRouter does not guarantee OpenAI’s or Microsoft’s own retention. Our trace copies are kept for 14 days and deleted when the workspace is deleted. • Access logs are kept for 7 days and application logs for 30 days. Review • Plenetic reviews these measures when the service or the risks change, and at least once a year. • Subprocessors and their roles are published at /subprocessors.