Data Processing Agreement

Introduction and Scope

This Data Processing Agreement ("DPA") forms part of the Terms and Conditions at www.boum.it/legal/tc, which govern all Boumit LLC products and services (including professional services, software subscriptions, and support and maintenance plans), and applies wherever Boumit LLC ("Processor") processes personal data on behalf of a client ("Controller") in the course of delivering products or services subject to the EU General Data Protection Regulation (GDPR), UK GDPR, or other applicable data protection legislation.

This DPA covers all processing activities of Boumit LLC, including:

• Professional services engagements (consulting, implementation, development, support, outsourcing)
• Software products and SaaS subscriptions (including the Odoo WhatsApp Bridge and any future boum.it products)

This DPA is incorporated by reference into the applicable Terms. By accepting those Terms, the Controller also accepts this DPA as binding. Where the Controller requires a separately executed DPA, it may request one by contacting legal@boum.it.

In the event of conflict between this DPA and the Terms, this DPA prevails with respect to data protection matters only.

Definitions

• "Personal Data" — any information relating to an identified or identifiable natural person, as defined under applicable data protection law
• "Processing" — any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion
• "Controller" — the party that determines the purposes and means of Processing (the Client)
• "Processor" — the party that processes Personal Data on behalf of the Controller (Boumit LLC)
• "Sub-processor" — any third party engaged by the Processor to process Personal Data
• "Data Subject" — the individual to whom Personal Data relates
• "Security Incident" — any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data

Roles of the Parties

3.1 Controller Responsibilities

The Controller is solely responsible for:

• Determining the lawful basis for Processing under applicable law
• Ensuring that Personal Data provided to Boumit LLC is accurate, lawfully collected, and may be lawfully processed
• Responding to Data Subject requests where the Controller is the point of contact
• Providing appropriate notices to Data Subjects regarding the Processing

3.2 Processor Responsibilities

Boumit LLC, as Processor, shall:

• Process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law
• Inform the Controller if it believes an instruction infringes applicable data protection law
• Ensure that persons authorized to process Personal Data are bound by appropriate confidentiality obligations
• Assist the Controller in meeting its obligations regarding Data Subject rights, security, and breach notification, to the extent reasonably possible

Nature and Purpose of Processing

4.1 General

Boumit LLC may process Personal Data in connection with:

• Delivery of software products and SaaS services, including the Odoo WhatsApp Bridge (account management, authentication, usage analytics, and billing)
• Consulting, implementation, development, and technical support engagements
• Remote or on-site access to Client systems (e.g. ERP, CRM, databases) as necessary to perform contracted services
• Project management and operational coordination

4.2 Categories of Personal Data

Depending on the engagement or product, Personal Data processed may include:

• Contact information (name, email, phone, job title)
• Professional and organizational data (company name, role, department)
• Account and authentication data (email, OAuth tokens)
• System and application data (user accounts, access logs, configuration data)
• Billing and subscription data (processed via Stripe)
• Operational data (transactions, records, communications) as contained in Client systems accessed during service delivery

Note: The Odoo WhatsApp Bridge does not transmit or store WhatsApp message content, Odoo CRM records, or contact data on Boumit LLC servers. Sync mappings and templates remain local to the user's browser.

4.3 Categories of Data Subjects

• Client employees, contractors, and representatives
• End users of Client's systems or applications
• Third parties whose data is contained in Client systems accessed during service delivery

4.4 Duration

Processing continues for the duration of the applicable engagement or subscription. Upon termination, Section 9 applies.

Processing Instructions

Boumit LLC shall process Personal Data solely:

• As necessary to deliver the contracted products or services
• In accordance with the Controller's documented instructions as set out in the applicable Order Form, Statement of Work, or written agreement
• As required by applicable law, in which case Boumit LLC shall inform the Controller unless prohibited by law

The Controller acknowledges that engaging Boumit LLC to deliver a specific scope of services, or activating a software subscription, constitutes documented processing instructions for the purposes of this DPA.

Sub-processors

6.1 Authorized Sub-processors

The Controller provides general authorization for Boumit LLC to engage the following sub-processors:

6.2 Changes to Sub-processors

Boumit LLC shall inform the Controller of any intended addition or replacement of sub-processors by updating this list and providing at least 14 days' notice via email or website notice.

If the Controller objects on reasonable data protection grounds, it must notify Boumit LLC in writing within 14 days. The parties shall seek to resolve the objection in good faith. If unresolved, the Controller may terminate the affected service without penalty.

6.3 Sub-processor Obligations

Boumit LLC shall impose data protection obligations on sub-processors equivalent to those in this DPA and shall remain liable to the Controller for the performance of sub-processors' obligations.

Security

7.1 Technical and Organizational Measures

Boumit LLC implements appropriate measures to protect Personal Data, including:

• HTTPS/TLS encryption for all data in transit
• Access controls on a need-to-know basis
• Authentication via cryptographically signed tokens
• No storage of passwords or payment credentials on our servers
• Use of reputable cloud infrastructure providers (see Section 6.1) that maintain their own security certifications
• Regular review of access rights and security practices

Boumit LLC does not hold ISO 27001, SOC 2, or equivalent certifications. Measures are implemented in accordance with industry best practices appropriate to the nature and scale of the Processing.

7.2 Acknowledgment

The Controller acknowledges that no security measure can guarantee absolute protection, and that the measures described are appropriate to the risk level associated with the Processing activities covered by this DPA.

Security Incidents

8.1 Notification

In the event that Boumit LLC becomes aware of a Security Incident affecting Personal Data processed on behalf of the Controller, Boumit LLC shall notify the Controller without undue delay and within 72 hours of becoming aware, to the extent reasonably practicable.

8.2 Content of Notification

Notification shall include, to the extent known:

• A description of the nature of the Security Incident
• The categories and approximate number of Data Subjects and records affected
• The likely consequences of the Security Incident
• Measures taken or proposed to address the incident

Information may be provided in phases as it becomes available.

8.3 Controller Responsibility

The Controller is solely responsible for notifying supervisory authorities and Data Subjects as required under applicable law. Boumit LLC shall provide reasonable assistance in meeting these obligations.

Data Retention and Deletion

9.1 During Engagement

Boumit LLC retains access to and copies of Personal Data for the duration of the engagement or subscription as necessary to deliver contracted services and maintain continuity.

9.2 Post-Engagement

Following termination or expiry:

• Boumit LLC shall retain working copies of Personal Data for up to 12 months for backup, dispute resolution, and continuity
• After this period, Personal Data shall be deleted or anonymized unless retention is required by applicable law

9.3 Deletion on Request

The Controller may request deletion of Personal Data at any time by written notice to legal@boum.it. Boumit LLC shall action such requests within 30 days, except where retention is required by applicable law or legitimate business necessity (e.g. invoice records, legal claims).

9.4 Confirmation

Upon request, Boumit LLC shall provide written confirmation that deletion has been completed.

Data Subject Rights

Where Boumit LLC receives a request directly from a Data Subject relating to Personal Data processed on behalf of the Controller, Boumit LLC shall:

• Promptly forward the request to the Controller
• Not respond to the request directly unless authorized by the Controller or required by law
• Provide reasonable assistance to the Controller in responding

The Controller is responsible for responding to Data Subject requests within the timeframes required by applicable law.

Data Protection Impact Assessments

Where required by applicable law, Boumit LLC shall provide reasonable assistance to the Controller in conducting Data Protection Impact Assessments (DPIAs) relating to Processing activities performed by Boumit LLC, taking into account the nature of the Processing and the information available.

Audit Rights

12.1 Information Requests

The Controller may request information demonstrating compliance with this DPA by submitting a written questionnaire to legal@boum.it. Boumit LLC shall respond within 30 days.

12.2 Limitation on On-Site Audits

Given the nature and scale of Boumit LLC's operations, on-site audits are not offered as a standard right under this DPA. Information provided in response to written questionnaires constitutes a reasonable and proportionate audit mechanism.

Where additional assurance is required, the parties may agree in writing on a specific audit scope, format, and cost allocation. Any such audit shall be conducted at the Controller's expense, with at least 30 days' advance notice, no more than once per calendar year, and in a manner that does not unreasonably disrupt operations.

International Data Transfers

13.1 Transfers by Boumit LLC

Where Boumit LLC transfers Personal Data to sub-processors located outside the EEA or UK, it shall ensure appropriate transfer mechanisms are in place, including:

• EU Standard Contractual Clauses (SCCs) as adopted by the European Commission
• UK International Data Transfer Agreements (IDTAs) where applicable
• Adequacy decisions where available

13.2 Transfers by Controller

Where the Controller transfers Personal Data to Boumit LLC from the EEA, UK, or Switzerland, this DPA, incorporating the relevant SCCs by reference, constitutes the transfer mechanism for such transfers.

13.3 Standard Contractual Clauses

To the extent that Processing under this DPA involves transfer of Personal Data from the EEA to a third country without an adequacy decision, the EU Standard Contractual Clauses (Module 2: Controller to Processor) adopted by European Commission Decision 2021/914 are hereby incorporated by reference and form part of this DPA. In the event of conflict between the SCCs and this DPA, the SCCs prevail.

Liability

Each party's liability under this DPA is subject to the limitations set forth in the applicable Terms. To the extent that applicable data protection law imposes liability that cannot be contractually limited, such mandatory provisions shall prevail.

Term and Termination

This DPA remains in effect for as long as Boumit LLC processes Personal Data on behalf of the Controller. It terminates automatically upon expiry or termination of all applicable engagements and subscriptions, subject to survival of Sections 8, 9, 13, and 14.

Governing Law

This DPA is governed by the laws of the State of Wyoming, United States, subject to mandatory provisions of the GDPR or UK GDPR where applicable to EU/UK Data Subjects.

Updates

Boumit LLC may update this DPA from time to time to reflect changes in applicable law or sub-processors. Material changes will be communicated with at least 14 days' notice. Continued use of Boumit LLC products or services following notice constitutes acceptance of the updated DPA.

Contact

For any questions regarding this DPA: