Skip to content
TaskBerry

Data Processing Agreement (DPA)

Effective date: 1 August 2026

This DPA applies to every Pro account, automatically

If you are on Pro, this Data Processing Agreement is already in force for your account. It forms part of our terms and it takes effect the moment you put another person's data into TaskBerry. You do not have to request it and you do not have to sign anything first.

Until August 2026 this page told you to email us for one. That was the wrong way round: Article 28 GDPR requires a written agreement whenever you act as controller and we process personal data on your behalf, and that happens the first time you write a client name on a label or paste a colleague's e-mail into the assistant. Making it conditional on a request meant most people who needed it did not have it.

Section 5a of our Privacy Policy sets out which data falls under which role.

A countersigned copy for your own records

Some finance and procurement departments need a signed document on file even when the agreement is already in force. Email gydo@groeienmetgydo.nl with:

  • Your company name (legal entity)
  • Your KvK number and, where applicable, VAT/BTW number
  • The email address to which the countersigned DPA should be sent

You get it back within one business day. This is paperwork for your records, not the thing that makes the agreement apply.

What our DPA covers

Our DPA mirrors the structure recommended by the European Commission and used by major SaaS processors. It addresses, among other points: subject-matter and duration of processing; categories of personal data and data subjects; controller instructions; confidentiality; security measures; engagement of sub-processors; international transfers (SCCs); assistance with data-subject rights; assistance with breach notification; deletion or return of data at the end of the agreement; and audit rights.

Retention

How long we hold each category of data is set out in Section 7 of our Privacy Policy, which forms part of this DPA by reference. The two periods most likely to matter to you: AI conversation transcripts are kept 90 days, and the daily session summaries derived from them are kept 12 months, both from the date of the conversation. Contact details and other people's names are filtered out of a summary before it is stored, within the limits set out in Section 4 of the Privacy Policy. On termination we delete your data as described in Section 7; encrypted backups roll out over about 30 days after that.

Sub-processors

The current list of sub-processors used to deliver TaskBerry is maintained in Section 5 of our Privacy Policy and forms part of the DPA by reference. We will notify every Pro account at least 30 days before any new sub-processor begins processing personal data on our behalf. This used to say "customers with a signed DPA", which was left over from the version of this page that made you ask for one. The DPA now applies automatically and there is nothing to sign, so the notice cannot be conditional on a signature.

One notice is running right now. On 1 August 2026 we added Anthropic Ireland, Limited to Section 5 as a pre-disclosed sub-processor for the AI assistant, as a second option alongside Google Gemini. It is not processing anything and no account is on it. Under the 30 days above, the earliest date it could start is 31 August 2026. Section 12 of the Privacy Policy keeps the same dates in a table you can check.

Two differences are worth knowing before that date rather than after. Anthropic relies on Standard Contractual Clauses alone, without the additional Data Privacy Framework certification that Google and Stripe have. And where Anthropic's abuse systems flag a conversation, it holds that conversation for up to 2 years, against Google's 55 days. Section 4 of the Privacy Policy sets both out in full.

Contact

For DPA requests: gydo@groeienmetgydo.nl. For all other privacy enquiries: privacy@taskberry.app.