Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service between the organisation that holds a RenewBud workspace (the "Controller", "you") and MM Sistemas e Informática (CNPJ 42.188.885/0001-44), which operates RenewBud (the "Processor", "we"). It applies whenever we process personal data on your behalf through RenewBud, and is written to meet Article 28 of the UK GDPR.

1. Subject matter and duration

We process personal data on your behalf only to provide the RenewBud service, for as long as your workspace is active and until the data is deleted under section 10.

2. Nature and purpose of processing

Storing and displaying the renewal and contract records you enter, sending renewal questions and reminders by email in your organisation's name to the people you name as responsible, recording their answers, and producing reports for you.

3. Categories of data subjects

Your employees and team members, including the people you name as responsible for a renewal, and contacts at your suppliers if you choose to record them.

4. Types of personal data

Names, work email addresses, job roles or departments, the decisions people record and any reasons or notes, and technical records of sign-ins and changes (time, IP address, browser). RenewBud is not designed to hold pupil data or special category data, and you agree not to enter any.

5. Our obligations

• We process the personal data only on your documented instructions, which are these terms and the way you configure and use the service, unless UK law requires otherwise.
• Everyone who can access the data on our side is bound by a duty of confidentiality.
• We take the security measures described in section 6.
• We help you respond to requests from individuals exercising their data protection rights, and with data protection impact assessments where they relate to RenewBud.
• We will tell you if we believe an instruction breaks data protection law.

6. Security measures

• Encrypted connections (HTTPS) for all access to RenewBud.
• Passwords stored as one-way hashes; sensitive settings and two-step verification secrets encrypted at rest.
• Individual logins with roles that limit what each person can see and change, and two-step verification available for every account.
• Each workspace's data kept separate from every other workspace's.
• An activity log of changes made in the workspace, and of any access by our support staff.
• Protection against automated sign-ups and repeated sign-in attempts.

7. Where data is processed, and sub-processors

The RenewBud application and its database are hosted in the United Kingdom. Your contracts and the details of your staff are stored in the United Kingdom. Stripe and Cloudflare never receive them: Stripe only handles billing details for paid plans, and Cloudflare only sees the IP address and browser of someone opening a sign-in or contact form.

You give us general authorisation to use the sub-processors listed here:

Sub-processor	Purpose	Location
Hostinger	Hosting of the application and database	United Kingdom
Hostinger (email)	Delivery of the emails RenewBud sends	Hostinger's mail servers, which may be outside the UK
Stripe	Card payments for paid plans (billing contact details only)	Stripe's systems, including in the United States
Cloudflare (Turnstile)	Checking that sign-in, sign-up and contact forms are used by a person (IP address and browser details only)	Cloudflare's global network, including in the United States

Each sub-processor is bound by data protection terms no less protective than this DPA, and we remain responsible to you for their work. Before adding or replacing a sub-processor we will tell workspace owners by email at least 30 days in advance, so you can object. If we cannot resolve your objection, you may close your workspace.

8. International transfers

We do not move the application or its database outside the UK. Where a sub-processor processes personal data outside the UK, it does so under safeguards recognised by UK data protection law, such as the UK International Data Transfer Agreement or Addendum, or to a country covered by UK adequacy regulations.

9. Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 72 hours, with what we know about what happened, what data is affected and what we are doing about it, and we will keep you updated.

10. Deletion or return of data

You can export your records to Excel or CSV at any time. When you close your workspace or ask us to delete it, we delete its data within 30 days; copies in backups are overwritten within a further 30 days. We keep only what the law requires us to keep, such as billing records.

11. Information and audits

On request we will give you the information reasonably needed to show that we meet this DPA, and answer reasonable questions from you or your auditor, no more than once a year unless there has been a breach.

12. Contact

Questions about this DPA, or requests for a signed copy: privacy@renewbud.com.