Data Processing Agreement

Last updated 2026-11-04

This Data Processing Agreement (“DPA”) is part of the Terms of Service between the customer (“controller”) and Try New Things AB, registration number 559438-2326 (“processor”). It applies whenever Brainpot processes personal data in the customer's workspace. It is accepted when the Terms are accepted; a countersigned copy is available on request from [email protected].

1. Subject and duration

The processor stores, protects and serves the controller's workspace content to the controller's authorised users and their connected AI tools, for as long as the controller uses Brainpot and until deletion under section 8.

2. Data and people

• Categories of data: whatever the controller's users put into pages and facts, typically names, roles, contact details and work information; plus member account data and change history.
• Data subjects: the controller's members, and people mentioned in its content, such as clients and partners.
• The controller should not store special categories of personal data (GDPR article 9) in Brainpot.

3. Instructions

The processor processes personal data only on the controller's documented instructions, which are these Terms, this DPA and the controller's use of the service's settings. The processor tells the controller if it believes an instruction breaks data protection law.

4. Confidentiality

Only staff who need access to run the service have it, and they are bound by confidentiality. Staff have no tool for viewing workspace content. Support access to content needs the controller's time-limited permission and is logged visibly to the controller.

5. Security

• TLS for all traffic. Content encrypted at rest with a separate key per workspace, itself encrypted with a key kept outside the database.
• Sign-in with passkeys and single-use email links; no passwords.
• Access checks on every request, including requests from AI tools, which never see more than the user behind them.
• Full version history and soft deletion, encrypted backups kept for 30 days, and audit logs of access changes.

6. Subprocessors

The controller approves the subprocessors listed on the security page. The processor gives at least 30 days' notice by email before adding or replacing one, and the controller may object and end the agreement if the change is not acceptable. The processor imposes the same data protection obligations on each subprocessor.

7. Assistance and breaches

• The processor helps the controller answer data subject requests; most can be handled directly with export, edit and delete in Brainpot.
• The processor notifies the controller of a personal data breach without undue delay and within 48 hours of becoming aware of it, with the information the controller needs to meet its own obligations.

8. Deletion and return

The controller can export all content at any time. When the agreement ends, the workspace becomes read-only for 90 days so it can be exported, and is then deleted together with its encryption key within 30 days, backups included, unless the law requires otherwise.

9. Audits

The processor makes available the information needed to show compliance with this DPA and answers reasonable written questions. On-site audits can be agreed with 30 days' notice, at the controller's cost, at most once a year.

10. Transfers

Personal data is stored and processed in the EU/EEA. Any transfer outside it happens only with safeguards approved under GDPR chapter V.

11. Liability and order

Liability follows the Terms. If this DPA and the Terms conflict on data protection, this DPA wins.