Effective date: 2026-04-23
This Data Processing Addendum, or DPA, forms part of the agreement between the customer using Sundayboard as a controller or business and Sundayboard developer as a processor or service provider, to the extent Sundayboard processes personal data on the customer’s behalf.
Parties
- Customer: the person or organization using Sundayboard and determining the purposes and means of processing personal data submitted to the service.
- Processor: Sundayboard developer, operating from Israel.
Contact: support@sundayboard.com
Scope and role
This DPA applies when Sundayboard processes personal data on behalf of a customer in connection with the Sundayboard service.
The customer acts as controller or business for that customer data. Sundayboard developer acts as processor or service provider only for the limited purpose of providing and securing the service and performing related support and operational functions.
Subject matter and duration
Subject matter: processing of customer personal data submitted to Sundayboard through workspaces, boards, tasks, comments, files, integrations, support, and related service operations.
Duration: for as long as Sundayboard processes customer personal data on the customer’s behalf under the applicable service relationship, plus any limited retention period reasonably necessary for backup integrity, security, dispute resolution, or legal compliance.
Nature and purpose of processing
Sundayboard may process customer personal data to:
- Provide the service and its core features.
- Authenticate users and manage access.
- Store, synchronize, display, and transmit customer content.
- Provide support and troubleshoot issues.
- Maintain service security, logging, abuse prevention, and reliability.
- Enable customer-requested integrations and assistant features.
Categories of data subjects
Data subjects may include:
- Customer account holders.
- Customer employees, contractors, and collaborators.
- End users, clients, or contacts whose data the customer chooses to place in Sundayboard.
Categories of personal data
Personal data processed under this DPA may include:
- Identity and contact data.
- Account and authentication data.
- Workspace, task, scheduling, comment, file, and collaboration data.
- Technical, log, and security data.
- Integration data and metadata generated by customer-enabled features.
Customer instructions
Sundayboard will process customer personal data only:
- On documented instructions from the customer.
- As required to provide the service requested by the customer.
- As required by applicable law.
If Sundayboard believes an instruction violates applicable law, Sundayboard may suspend the instruction and notify the customer where legally permitted.
Confidentiality
Sundayboard will ensure that persons authorized to process customer personal data are subject to appropriate confidentiality obligations.
Security
Sundayboard will implement reasonable technical and organizational measures designed to protect customer personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
Because no system is perfectly secure, Sundayboard does not guarantee absolute security.
Subprocessors
The customer authorizes Sundayboard to use subprocessors as reasonably necessary to provide the service.
Current and optional subprocessors are described at Subprocessors.
Sundayboard will remain responsible for its subprocessors to the extent required by applicable law and contractual commitments.
Assistance
Taking into account the nature of the processing and the information available to Sundayboard, Sundayboard will provide reasonable assistance to the customer with:
- Data subject requests.
- Security obligations.
- Breach-related obligations.
- Privacy impact assessments where legally required and reasonably necessary.
Data subject requests
If Sundayboard receives a data subject request relating to customer personal data for which the customer is the controller, Sundayboard may direct the requester to the customer and may notify the customer where appropriate.
Personal data incidents
If Sundayboard becomes aware of a confirmed personal data incident affecting customer personal data, Sundayboard will notify the customer without undue delay after becoming sufficiently aware of the incident, taking into account the need to verify scope, impact, and integrity of the report.
Deletion and return
Upon customer request or termination of the relevant service relationship, Sundayboard will delete or return customer personal data in its possession or control, unless retention is required by law or reasonably necessary for security, backup integrity, or dispute resolution for a limited period.
International transfers
Customer personal data may be processed outside the customer’s jurisdiction. Where legally required, Sundayboard will implement appropriate safeguards for restricted international transfers.
Audit information
Given the nature of Sundayboard as an individual-developer-operated service, formal on-site audits are not offered by default. Sundayboard may provide reasonable information about privacy and security measures upon written request, subject to confidentiality, proportionality, feasibility, and protection of other users and system security.
Conflict
If this DPA conflicts with another written agreement governing processing of customer personal data between the same parties, this DPA controls only with respect to data protection obligations.
Contact
Questions about this DPA should be sent to support@sundayboard.com.