This agreement and its technical and organisational measures are available in German and English. The English translation is shown here.
The German version of this agreement, including its TOM annex, prevails. Translations are provided for convenience.
1. Parties and incorporation
This agreement under Article 28 GDPR is concluded between the customer subscribing to the Workspace (the “Customer”) and the following provider as processor (the “Provider”):
d1 group, e-business GmbH
Zwischen den Hölzern 1a
59514 Welver
Deutschland
The Customer is identified by the Workspace subscription's contract and order details. This agreement forms part of the contract upon conclusion of a Workspace subscription insofar as the Provider processes personal data on the Customer's behalf. This version applies to contracts concluded from its publication onwards. Existing customers can obtain the DPA on request. Individually agreed data processing agreements retain priority. A signed copy is available from [email protected].
The Customer acts as controller. Where the Customer is itself a processor, the Provider acts as a further processor; the Customer ensures that it is authorised to engage the Provider and communicates the relevant instructions of its controller.
2. Subject matter, purpose and duration
The subject matter is the provision of Teamwide for collaboration in Workspaces and boards. Processing includes collecting, storing, organising, displaying, editing, transmitting, exporting and deleting data supplied by the Customer, as well as executing agents and integrations activated by the Customer. Its purposes are collaboration, communication, permission management and technical provision of the requested features.
This agreement applies for the duration of the instructed processing, including retention of a read-only Workspace. Cancelling a subscription alone does not delete the Workspace: after the paid period, it remains readable under the Terms and Conditions. This agreement continues until return or deletion under section 10 is completed.
Processing for the Provider's own purposes, particularly contract administration, billing, compliance with its own legal obligations and operation of the public website, is explained in the privacy notice and falls outside this processing on behalf of the Customer.
3. Types of data and categories of data subjects
Processing on behalf of the Customer may concern names and business contact details, Workspace membership, roles, invitations, sharing permissions and preferences, as well as content in boards, notes, comments, images and files. It may also include configured integrations, API keys, agent settings, inputs, chat histories, outputs and tool results where the Customer uses those features.
Technical data may include user, Workspace and object identifiers, timestamps, session and access information, IP addresses, and status, error and execution information where necessary for the requested service and its security. The Provider's own processing purposes remain distinct as set out in section 2.
Data subjects include the Customer's employees, contractors and members, invited or external collaborators, and clients, contacts and other individuals whose data the Customer processes in Teamwide. The Customer determines the actual content and categories of individuals.
Special categories of personal data under Article 9 GDPR and data under Article 10 GDPR are not intended for routine use. Before such processing, the parties agree on the requirements and any necessary additional safeguards; the Customer ensures that a suitable legal basis exists.
4. Customer responsibilities and instructions
The Customer determines the purposes and means of its processing and is responsible for its lawfulness, information to data subjects and authority to transmit the data. It assigns appropriate permissions, keeps its contact details current and reviews sharing settings and activated integrations.
The Provider processes data only on documented instructions from the Customer, including instructions concerning transfers to third countries. Instructions arise from this contract, actions and settings initiated by the Customer, and additional documented instructions from authorised persons, for example by email to [email protected]. Oral instructions must be confirmed in text form promptly.
Where Union or Member State law requires the Provider to process data, the Provider informs the Customer of that requirement beforehand unless the law prohibits disclosure on important grounds of public interest. If the Provider considers an instruction to infringe data protection law, it informs the Customer immediately and suspends execution of that instruction pending clarification.
5. Confidentiality and security
The Provider ensures that persons authorised to process data are bound by confidentiality commitments or an appropriate statutory duty of confidentiality. Access is permitted only to the extent necessary and within lawful instructions. These obligations continue after the person's engagement ends.
The Provider implements the technical and organisational measures required by Article 32 GDPR, taking account of the state of the art, implementation costs, the nature, scope, context and purposes of processing, and risks to data subjects. These include risk-appropriate confidentiality, integrity, availability and resilience, the ability to restore access following incidents, and regular evaluation of the measures' effectiveness.
The TOM annex in section 13 describes the measures in place. The Provider may adapt them to technical developments and changing risks provided the agreed level of protection is maintained. It makes material changes and the information needed to assess them available to the Customer.
6. Subprocessors
The Customer gives general written authorisation to engage the subprocessors named in the subprocessor list for the services described there. The list supplements this agreement. Other services described there that act as independent controllers do not become subprocessors by being listed.
The Provider informs the Customer at least 30 days before adding or replacing a subprocessor by email to the registered administrative contact. The notice identifies the provider, service, processing location and, where applicable, safeguards for third-country transfers. Within that period, the Customer may object on substantiated data protection grounds by contacting [email protected].
Following an objection, the parties examine suitable remedies or a reasonable alternative. The new subprocessor is not used for the affected Customer data until the objection is resolved. If no viable solution is available, either party may end the affected service before the proposed engagement; return and deletion are governed by section 10.
The Provider contractually imposes the same data protection obligations on subprocessors as those it owes under this agreement, particularly sufficient safeguards. It remains responsible to the Customer for the subprocessor's performance of those obligations. On request it provides the information and relevant contractual provisions necessary to demonstrate compliance; unrelated trade secrets may be redacted.
7. Processing locations and international transfers
The Teamwide application, storage of boards and files, and self-hosted services for agent execution and web research run on Hetzner servers in Falkenstein, Germany. The subprocessor list describes the involvement of other providers.
Cloudflare provides network, security and intermediary services through international infrastructure; data may be processed outside the EEA. Stripe processes payment and billing data according to its respective role. Payment processing is distinct from processing board content.
External AI services are integrated through the Customer's selection and configuration using its own API keys. Their use may send inputs, selected content and results to the respective provider. Selection, processing locations, contractual relationships and retention also depend on that provider's terms. Where the Provider engages such a service as a subprocessor, section 6 additionally applies; a direct engagement by the Customer does not replace any necessary data protection assessment.
Transfers by the Provider to third countries take place only on documented instructions or under the legal obligation described in section 4 and in compliance with Chapter V GDPR. Where necessary, a valid adequacy decision or appropriate safeguards, in particular standard contractual clauses with the required assessment and supplementary measures, are used. The Provider supplies the necessary supporting information. This agreement does not itself constitute a transfer safeguard under Chapter V.
8. Data subject rights and assistance
Taking account of the nature of processing, the Provider assists the Customer through appropriate technical and organisational measures, insofar as possible, in responding to requests under Chapter III GDPR, including access, rectification, erasure, restriction and portability. It forwards requests concerning Customer data to the Customer without undue delay and responds only on the Customer's instructions unless an independent legal obligation applies.
Taking account of the nature of processing and the information available to it, the Provider assists the Customer with obligations under Articles 32 to 36 GDPR. This includes security assessments, personal data breach notifications and communications, data protection impact assessments and prior consultation with the supervisory authority. The Customer remains responsible for its decisions and statutory deadlines.
9. Personal data breaches
On becoming aware of a personal data breach affecting data processed on behalf of the Customer, the Provider notifies the Customer without undue delay using the registered administrative contact. Notification does not depend on all details already being established.
Where available, the Provider supplies the nature of the incident, affected data and categories of individuals including approximate scale, likely consequences, measures taken or proposed, and a contact point. Missing information is supplied without undue delay as it becomes available. The Provider assists with investigation, containment, remediation and documentation of the incident and the Customer's required notifications.
10. Return and deletion
After all services relating to processing end, the Provider, at the Customer's choice, returns all personal data processed on its behalf in an agreed commonly used format and then deletes it, or deletes it directly. Existing copies must also be deleted unless Union or Member State law requires their retention. The parties coordinate the steps needed for secure completion; the Provider confirms completion on request.
The Customer may use the available export and deletion features and send additional instructions to [email protected]. Cancelling a subscription alone is not an instruction to delete the Workspace that remains readable. If the Customer also wishes to end that service, it initiates deletion or instructs the Provider accordingly.
Data subject to statutory retention is restricted to that purpose and deleted when the retention period expires. Where isolated backup copies still exist during completion, they remain protected until deletion and are not used for other purposes; deletion instructions must be reapplied following a restoration. Copies independently made by the Customer or authorised recipients remain their responsibility.
11. Evidence and audits
The Provider makes available all information necessary to demonstrate compliance with this agreement and Article 28 GDPR. It allows and contributes to audits, including inspections, by the Customer or an independent auditor appointed by the Customer.
The parties reasonably coordinate scope, timing and security arrangements, protecting other customers' data and confidential information. This must not exclude or unreasonably delay urgent audits, particularly following a specific incident or a regulatory requirement. Statutory rights to inspection and information remain unrestricted.
12. Liability, precedence and contact
Liability between the parties is governed by the main contract insofar as mandatory data protection law does not provide otherwise. Rights of data subjects, particularly under Article 82 GDPR, and responsibility for subprocessors remain unaffected. In a conflict concerning processing on behalf of the Customer, this agreement prevails over the general terms; overriding individual agreements remain effective.
Changes to this agreement require agreement in written or electronic form. Publication of a new version alone does not amend an existing agreement. The current version may be used for new contracts. The contact for instructions, data protection enquiries and a signed copy is [email protected].
13. Annex – Technical and organisational measures (TOM)
This annex forms part of the agreement. It describes the technical measures of the supplied application and its operation as of the stated date. The obligations in section 5 additionally apply.
Hosting and network connections. The application, database, board files, agent execution and self-hosted web research run at Hetzner in Falkenstein, Germany. Browser connections use HTTPS. Cloudflare provides the public TLS endpoint; the connection to the application server uses an encrypted tunnel. The application enforces HTTPS and uses secure session cookies.
Identity and authentication. Passwords for local user accounts are stored as bcrypt hashes. Users can enable two-factor authentication with time-based one-time codes. Recovery codes support access if the second factor is lost.
Permissions and separation. Workspace and board access is checked against account membership, roles and board sharing permissions. Read and edit permissions are separate. Published boards become accessible through deliberately configured sharing; additional password protection is available for public links. The Customer manages members and sharing settings according to its needs.
Credential protection. Stored AI API keys are encrypted at field level in the database. Sensitive parameters, including passwords, keys and tokens, are covered by application log filtering.
Availability and backups. Ongoing data backups to our own servers in the cluster.
Operational checks and changes. Technical health checks monitor application availability and its database and Redis connections. Application logs include request identifiers to help investigate errors. Releases use versioned container images; changes are checked through automated tests before publication and for availability and version after deployment.
Data management. The application provides features for managing and deleting boards and Workspaces. Associated permissions and linked application objects are removed according to their dependencies when deleted. Additional return and deletion instructions are handled under section 10.