Data Processing Addendum

Last updated: 14 October 2026

This addendum sets out how baseray processes personal data on behalf of its business customers, as Article 28 of the GDPR requires. It forms part of our terms and applies automatically to every business customer, from the moment it uses the service. No signature is needed. If you need a copy signed by both parties, write to [email protected].

1. Definitions

• Customer, you: the business that accepted our terms.
• baseray, we, us: the provider of the baseray service.
• Customer Personal Data: personal data that you or your members put into the service and that we process on your behalf. Annex 1 describes it.
• GDPR: Regulation (EU) 2016/679. Other terms, such as controller, processor, personal data breach and supervisory authority, have the meaning the GDPR gives them.
• Sub-processor: a company we engage to process Customer Personal Data.

2. Who controls which data

• You are the controller of Customer Personal Data: who you invite to your workspace and with which role, the lead lists and saved buildings your members create, and any personal data your members type into the service. We process it as your processor.
• We are the controller of the data we compile and publish: the building data and the data about registered businesses in the app, the API, exports and on public pages. When you receive that data, you become an independent controller for your own use of it, such as contacting a business. This addendum does not cover that data; our terms, our acceptable use policy and the law do.
• We are also the controller of each person’s own account: sign-in, security, sessions, billing, product analytics and logs, as our privacy policy describes.

3. Your instructions

We process Customer Personal Data only on your documented instructions. These are our terms, this addendum and the way you and your members use the service, for example when you invite someone, create a list or connect an AI assistant. We tell you if we believe an instruction breaks the GDPR or other data protection law.

We process Customer Personal Data outside your instructions only where EU or member state law requires it. In that case we tell you first, unless that law forbids it.

4. Your obligations

• You have a lawful basis for the Customer Personal Data you put into the service and you give the people concerned the information the law requires.
• You do not put special categories of personal data (Article 9 GDPR) or data about criminal convictions into the service.
• Your instructions comply with the law.

5. Confidentiality

Everyone at baseray who can access Customer Personal Data is bound by confidentiality and uses it only to provide the service.

6. Security

We protect Customer Personal Data with technical and organisational measures appropriate to the risk (Article 32 GDPR). Annex 2 summarises them, and our security page describes them in more detail. We may improve these measures, but we will not reduce the overall level of protection.

7. Sub-processors

• You give us a general authorisation to engage sub-processors. The current list is on our sub-processors page, which names those that process Customer Personal Data.
• Each sub-processor is bound by a written contract with data protection obligations that offer the same level of protection as this addendum. We remain responsible to you for its work.
• We announce a new sub-processor of Customer Personal Data on that page at least 30 days before it starts. Write to [email protected] to receive these announcements by email.
• You may object to a new sub-processor on reasonable data protection grounds within those 30 days. We will then look for a solution with you. If there is none, you may end the affected subscription before the change takes effect, and we will refund fees you prepaid for the period after it ends.

8. Transfers outside the EU

We store Customer Personal Data in the EU, in Microsoft Azure’s Poland Central region. Some sub-processors process it outside the European Economic Area: Cloudflare carries traffic through its global network, and Resend, a US company, sends workspace invitation emails. For every such transfer we rely on the EU-US Data Privacy Framework where the recipient is certified, or on the Standard Contractual Clauses approved by the European Commission (Decision (EU) 2021/914). You authorise these transfers.

9. Helping you meet your obligations

• Requests from individuals. The service lets you handle most requests yourself: workspace owners and administrators can remove members and withdraw invitations, and members can delete lists and saved buildings. Where you need more, we help you by appropriate technical and organisational measures. If someone contacts us about Customer Personal Data, we refer them to you and do not answer on your behalf unless you ask us to.
• Assessments and authorities. We give you the information you reasonably need for a data protection impact assessment, a prior consultation with a supervisory authority or a request from an authority.

10. Personal data breaches

We notify you without undue delay, and where possible within 48 hours, after we become aware of a personal data breach affecting Customer Personal Data. We write to the email address of the workspace owner. The notice describes, as far as we know at that time, what happened, the categories and approximate number of people and records concerned, the likely consequences and the measures taken or proposed. We add information as we learn it, help you meet your own obligations to notify, and take reasonable steps to limit the harm.

11. Deletion and return

• You can delete Customer Personal Data at any time: delete lists and saved buildings, withdraw invitations, remove members, or delete the whole workspace. Deleting a workspace removes its data from our database at once and cannot be undone.
• When the contract ends, you choose whether we return or delete Customer Personal Data. Ask at [email protected]: we send a copy in a common machine-readable format (CSV or JSON) if you want one, then delete the data from our database within 30 days of your request.
• Copies in our database backups are deleted automatically as the backups roll over, at most 7 months after the deletion.
• We keep a copy only where EU or member state law requires it. This addendum continues to protect any such copy.

12. Information and audits

• We make available the information you need to show that we meet Article 28 GDPR: this addendum, our security page and answers to a reasonable security questionnaire, once a year.
• If that is not enough, you may audit our compliance, yourself or through an independent auditor bound by confidentiality. Give us at least 30 days’ written notice, keep to our business hours and minimise disruption. Audits take place at most once every 12 months, unless a supervisory authority requires one or a personal data breach has occurred. Each party bears its own costs.

13. Liability and duration

• Each party’s liability under this addendum is subject to the limitation of liability in our terms (section 16), to the extent the law allows.
• This addendum applies as long as we process Customer Personal Data for you.

14. Precedence

For the processing of Customer Personal Data, this addendum prevails over our terms. Where Standard Contractual Clauses apply, they prevail over this addendum. This addendum is governed by the same law and courts as our terms (section 20). It is available in English, Romanian and Czech; if the versions differ, the English version prevails.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption in transit: every connection to baseray.ai, app.baseray.ai and api.baseray.ai uses HTTPS.
• Encryption at rest: the disks that hold our databases are encrypted by Microsoft Azure.
• Backups: the database is copied every day to separate, zone-redundant storage in the same region, encrypted at rest and kept for at most 7 months. Restoring from these copies has been tested.
• Hosting in the EU, in Microsoft Azure’s Poland Central region.
• Passwords are stored as bcrypt hashes; API keys and OAuth tokens as SHA-256 hashes. Neither can be read back.
• Two-factor authentication with an authenticator app is available for every account.
• Sign-in attempts are rate-limited. Sessions end after 120 minutes without activity unless you choose to stay signed in.
• Every request is checked against the workspace’s membership and roles. Only owners and administrators can manage members and billing.
• AI assistants connect through OAuth 2.1 with PKCE; access tokens expire after one hour and refresh tokens rotate on every use.
• Card details are entered directly at Stripe and never reach our servers.
• Internal admin access is limited to a short list of named staff accounts.
• Configuration secrets are kept in a secrets manager, not in the code.