This Data Processing Addendum ("DPA") forms part of the OBM Terms of Service between the customer accepting them ("Customer", the controller) and ProjoMania ("Processor", "we"). It applies whenever the backup archives Customer stores with OBM Pro contain personal data protected by the GDPR, UK GDPR, or similar laws. It is incorporated automatically — no signature is needed for it to bind both parties; countersigned copies are available on request at [email protected].
1. Roles and scope
Customer is the controller (or a processor acting for its own clients) of the personal data contained in the Odoo databases it backs up. ProjoMania processes that data strictly as a processor. This DPA does not cover Customer's own account data (name, email, billing), for which ProjoMania is a controller under its Privacy Policy.
2. Details of processing
- Subject matter: backup archives of Customer's self-hosted Odoo databases (database dumps and filestore contents).
- Duration: the term of the service agreement, and thereafter for as long as Customer's archives remain stored with us (see section 10).
- Nature and purpose: creating backups via the Odoo API on Customer's configured schedules; automated integrity verification (checksums, archive-structure checks); encrypted storage; retention enforcement; restores and restore drills on Customer's instruction; making archives available for download.
- Categories of data subjects and personal data: whatever Customer's Odoo databases contain — typically Customer's own customers, suppliers, employees and users, and typically contact details, transaction and HR records, and documents in the filestore. Customer, not ProjoMania, determines the contents. Customers whose databases contain special-category data remain responsible for the lawfulness of storing it in backups.
- No content access: ProjoMania does not open, read or analyze archive contents beyond automated verification, and its personnel access stored archives only where strictly necessary to provide the service (e.g. debugging a failed restore at Customer's request) or where required by law.
3. Customer's instructions
ProjoMania processes the data only on Customer's documented instructions. The service's controls are those instructions: configuring schedules, retention rules, pins, restores, drills, share links, downloads and deletion. We will inform Customer if, in our opinion, an instruction violates data-protection law, and we may suspend that instruction until resolved. If law requires us to process beyond instructions, we will tell Customer beforehand unless legally barred.
4. Confidentiality
Persons we authorize to process the data are bound by contractual or statutory confidentiality obligations and receive access on a need-to-use basis only.
5. Security measures
Taking into account the state of the art and the nature of the data, we implement at minimum:
- TLS 1.2+ encryption in transit — between Customer and OBM, OBM and Customer's Odoo instances, and OBM and storage;
- encryption at rest for backup archives (Backblaze B2, EU region);
- application-layer encryption of Odoo master passwords, which are never logged or displayed back;
- SHA-256 checksums recorded at ingest and re-checked on verification, protecting integrity;
- logical tenant separation, role-based access control, and per-action audit logs visible to Customer;
- hashed credentials (bcrypt-class), rate limiting, and administrative access restricted to named operations personnel;
- hardening, patching and monitoring of the infrastructure we operate;
- tested procedures for restoring availability (the product's own restore drills apply to our tooling as well).
6. Sub-processors
Customer authorizes the following sub-processors:
- Backblaze, Inc. — object storage for backup archives (EU region).
- Cloudflare, Inc. — DNS, TLS termination and network security.
- Paddle — merchant of record for payments (processes billing data, not archive contents).
- GitHub, Inc. — code hosting; does not receive archive contents.
We will give at least 30 days' notice (email or in-app) before adding or replacing a sub-processor that processes archive contents. If Customer reasonably objects on data-protection grounds and we cannot offer an alternative, Customer may terminate the affected service with a pro-rata refund of prepaid, unused fees. We remain liable for our sub-processors' performance and flow down equivalent data-protection obligations to them.
7. Assistance to Customer
Taking into account the nature of the processing, we will assist Customer with reasonable technical and organizational measures in responding to data-subject requests (access, deletion, etc. — usually satisfied by Customer restoring or deleting data in its own Odoo and letting retention expire old archives, or by deleting specific archives in OBM), and with Customer's obligations regarding security, breach notification and data-protection impact assessments, insofar as the information is available to us.
8. Personal data breach
If we become aware of a personal data breach affecting Customer's archives, we will notify Customer without undue delay, and in any case within 72 hours of becoming aware, with the nature of the breach, likely consequences, measures taken, and a contact point — supplementing the notice as facts develop. Notification is not an admission of fault.
9. International transfers
- Backup archives are stored in the EU (Backblaze B2, EU region) and are not moved outside it by us.
- Control-plane metadata (instance URLs, database names, schedules, checksums, activity logs — and encrypted master passwords) is processed on infrastructure operated by ProjoMania outside the EU. For personal data within that metadata (e.g. URLs or database names containing personal identifiers), the parties incorporate the EU Standard Contractual Clauses (Module Two: controller → processor) by reference, with Customer as data exporter and ProjoMania as data importer; the details of processing in section 2 serve as Annex I and the measures in section 5 as Annex II.
- We will not disclose Customer data to any authority without legal compulsion, and we will notify Customer of any such demand unless legally barred.
10. Return and deletion
During the term, Customer can download archives at any time. After termination or expiry the account becomes read-only and archives remain stored and downloadable — we do not delete them on an automatic timer, and we give notice before any deletion we initiate. Customer may instruct deletion at any time, in the application (deleting individual archives, databases or the account) or by writing to us; we then permanently delete the archives and stored instance credentials within 30 days and purge them from our own infrastructure backups on a rolling basis (at most 30 further days). On written request we confirm deletion in text form.
11. Audits
We will make available information reasonably necessary to demonstrate compliance with this DPA — documentation of our measures, sub-processor terms, and summaries of any third-party attestations we hold. Where that is insufficient under Customer's law, Customer may audit (directly or via an independent auditor bound to confidentiality) at most once per year, on 30 days' notice, during business hours, without access to other customers' data, and at Customer's expense.
12. Liability and order of precedence
Liability under this DPA is subject to the limitations in the Terms of Service. If this DPA conflicts with the Terms regarding processing of personal data, this DPA prevails; mandatory data-protection law prevails over both.
13. Governing law
This DPA follows the governing law and forum of the Terms of Service, except where the Standard Contractual Clauses referenced in section 9 mandate otherwise for themselves.
14. Contact
Data-protection matters, sub-processor objections, countersigned copies: [email protected].