Data Processing Agreement
Last updated 16 October 2026
This Data Processing Agreement (“DPA”) is part of the Terms of Service between your organisation (the “Customer”) and Fronko (“Fronko”). It applies when Fronko processes personal data on the Customer’s behalf, and sets out the terms required by Article 28 of the EU and UK General Data Protection Regulation (“GDPR”). It takes effect when the Customer accepts the Terms; no signature is needed. If you need a signed copy, email [email protected].
1. Roles
The Customer is the controller of the personal data in its cards, files and leads (“Customer Data”). Fronko is its processor. Fronko is the controller of account details and its own business records, as described in the Privacy Policy.
2. Details of the processing
| Subject matter and purpose | Providing the Service: publishing digital business cards, collecting and delivering leads, storing files, counting card visits, and sending data to integrations the Customer connects |
|---|---|
| Duration | For as long as the Customer uses the Service, then until deletion under section 9 |
| Data subjects | The Customer’s people (users and card holders), and the people who visit its cards and send their details (leads) |
| Personal data | Names, job titles, contact details, photos and links on cards; names, email addresses, phone numbers and messages in leads; anonymous visit statistics |
| Special categories | None intended. The Customer must not use the Service to collect special category data |
3. Instructions
Fronko processes Customer Data only on the Customer’s documented instructions: the Terms, this DPA and the Customer’s use and configuration of the Service. Fronko will tell the Customer if it believes an instruction breaks data protection law. Fronko never sells Customer Data or uses it for its own purposes, and its staff can’t browse cards or leads in its admin tools.
4. Confidentiality
Everyone at Fronko who can access Customer Data is bound by a duty of confidentiality.
5. Security
Fronko takes appropriate technical and organisational measures to protect Customer Data, including encryption in transit, encryption of secrets at rest, hashed passwords, private file storage with short-lived links, least-privilege access, two-factor authentication and audit logging for staff, and regular backups. The Security page describes them.
6. Subprocessors
The Customer authorises Fronko to use the subprocessors on the Subprocessors page. Fronko imposes data protection terms on each that are at least as protective as this DPA, and stays responsible for them. Fronko updates that page before adding or replacing a subprocessor; the Customer may object on reasonable data protection grounds within 30 days, and if we can’t resolve the objection, may end the affected part of the Service and receive a refund of prepaid fees for it.
7. Assistance
Taking into account the nature of the processing, Fronko helps the Customer respond to requests from data subjects (the Service lets the Customer find, correct, export and delete Customer Data itself) and meet its obligations on security, breach notification, data protection impact assessments and prior consultation.
8. Personal data breaches
Fronko notifies the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data, with the information the Customer reasonably needs to meet its own obligations, and takes reasonable steps to contain it.
9. Deletion and return
The Customer can export its data and delete it at any time. When the Customer deletes its organisation, Fronko deletes Customer Data from the live service straight away and from backups within their retention period, unless the law requires Fronko to keep it.
10. Information and audits
Fronko makes available the information needed to show it meets this DPA, and allows for audits by the Customer or an auditor it appoints, on reasonable notice, at the Customer’s cost, no more than once a year unless a breach or a regulator requires it. Fronko may first answer with written information and its security documentation.
11. International transfers
Where Customer Data is transferred outside the European Economic Area, the UK or Switzerland to a country without an adequacy decision, the transfer is covered by the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), which are incorporated by reference.
12. General
Each party’s liability under this DPA is subject to the limits in the Terms. If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.