Data Processing Agreement

Version 2026-10-13. This version is under legal review and may be updated; we will notify workspace admins of any material change.

This Data Processing Agreement ("DPA") forms part of the End User License Agreement (Terms of Service) at /terms between the customer company that uses Alignify ("Customer") and PRIVATE ENTREPRENEUR KRAVCHENKO SVIATOSLAV EVGENOVYCH (ФОП Кравченко Святослав Євгенович), Kyiv, Ukraine, identification code 3621611616 ("Alignify"). A workspace owner or admin accepts it on behalf of the Customer in the product before connecting HubSpot. Alignify records who accepted, when, and which version.

1. ROLES AND SCOPE

1.1. For the CRM data the Customer connects to Alignify (for example HubSpot deals, contacts, companies, leads, tickets and their activities), the Customer is the controller and Alignify is the processor, as defined in Article 4 of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1.2. For account and billing data (users' names, emails, workspace and subscription details), Alignify is the controller, as described in the Privacy Policy at /privacy. This DPA does not cover that data.

1.3. This DPA applies where Alignify processes personal data on the Customer's behalf that is subject to the GDPR, the UK GDPR or other data protection laws with similar processor requirements.

2. DETAILS OF THE PROCESSING

• Subject matter: providing the Alignify Platform: reading CRM data through the HubSpot connection, analysing it with AI agents, storing agent runs and results, and writing approved updates back to HubSpot.
• Duration: for the term of the Customer's use of Alignify, and until deletion under section 9.
• Nature and purpose: collection through the HubSpot API, storage, structuring, AI analysis, display to the Customer's users, and updates to HubSpot that the Customer approves or explicitly automates.
• Categories of data subjects: the Customer's contacts, leads and customers recorded in its CRM, and the Customer's own staff named in CRM records.
• Categories of personal data: names, business contact details (email, phone, company, job title), CRM record fields, deal and ticket details, and notes, emails and call summaries stored in the CRM.
• Special categories: none are intended. The Customer should not store special-category data in the CRM fields it connects.

3. CUSTOMER INSTRUCTIONS

3.1. Alignify processes the Customer's personal data only on the Customer's documented instructions. The Terms of Service, this DPA, and the Customer's use and configuration of the product (connecting HubSpot, choosing agents, records, schedules and approvals) are the Customer's instructions.

3.2. Alignify informs the Customer if it believes an instruction infringes data protection law.

3.3. Alignify does not sell the Customer's personal data and does not use the Customer's CRM data, prompts or AI outputs to train AI models.

4. CONFIDENTIALITY

Alignify ensures that people authorised to process the Customer's personal data are bound by confidentiality obligations and access it only as needed to provide and support the service.

5. SECURITY MEASURES

Alignify implements appropriate technical and organisational measures (GDPR Article 32), including:

• Encryption in transit (TLS) for all connections to and between the service components.
• HubSpot access and refresh tokens encrypted at rest with AES-256-GCM.
• Encrypted database storage and encrypted backups, kept for up to 14 days.
• Strict tenant isolation: every record belongs to one workspace and every query is scoped to it.
• Role-based access (owner, admin, member, viewer), with step-up verification for sensitive account actions.
• An audit log of connections, agent runs, approvals and HubSpot updates.
• Human review before any CRM update, unless a workspace admin turns on automatic updates for a specific agent.
• Error monitoring with secrets and personal data scrubbed from diagnostic events.
• Least-privilege access for Alignify personnel to production systems.

6. SUB-PROCESSORS

6.1. The Customer gives Alignify general written authorisation to engage sub-processors. The current list, with purpose, data, location and transfer mechanism, is published at /subprocessors and forms part of this DPA.

6.2. Alignify imposes data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible to the Customer for its sub-processors' performance.

7. CHANGES TO SUB-PROCESSORS

7.1. Alignify gives at least 30 days' notice before adding or replacing a sub-processor, by updating /subprocessors and emailing workspace owners and admins.

7.2. The Customer may object on reasonable data protection grounds within those 30 days by writing to contact@alignifytech.com. If we cannot address the objection, the Customer may stop using the affected part of the service or terminate, and receives a pro rata refund of prepaid fees for the unused period.

8. INTERNATIONAL TRANSFERS

8.1. Alignify is established in Ukraine, and the service is currently hosted in the location stated at /subprocessors. Where personal data subject to the GDPR is transferred to Alignify outside the EEA, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply: Module 2 (controller to processor) between the Customer and Alignify, incorporated into this DPA by reference, with the Customer as data exporter and Alignify as data importer. For UK personal data, the UK International Data Transfer Addendum applies to those clauses.

8.2. For onward transfers to sub-processors, Alignify relies on Module 3 (processor to processor) of the Standard Contractual Clauses in each sub-processor's data processing terms, or on the EU-US Data Privacy Framework where the sub-processor is certified, as listed at /subprocessors.

8.3. For the clauses: the optional docking clause (Clause 7) applies; under Clause 9 the general written authorisation and 30-day notice in sections 6 and 7 apply; Clause 11 optional language does not apply; Clauses 17 and 18 are governed by and brought before the courts of Ireland. The annexes of the clauses are completed by sections 2 and 5 of this DPA and by /subprocessors.

9. DELETION AND RETURN

9.1. The Customer can export its workspace data and delete a workspace at any time in Settings, as described in the Privacy Policy. Deleting a workspace permanently deletes its CRM data, agent runs and results, disconnects HubSpot and asks HubSpot to revoke Alignify's access.

9.2. At the end of the service, Alignify deletes the Customer's personal data within 30 days, except where law requires it to be kept. Encrypted backups expire within 14 days after that.

10. ASSISTANCE

10.1. Alignify assists the Customer, taking into account the nature of the processing, with requests from data subjects (access, correction, deletion, objection and portability), with security, with data protection impact assessments and with prior consultations with supervisory authorities.

10.2. Alignify forwards to the Customer any data subject request it receives about the Customer's data and does not answer it unless the Customer instructs it to.

11. PERSONAL DATA BREACHES

Alignify notifies the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting the Customer's data, with the information the Customer needs to meet its own obligations, and takes reasonable steps to contain it.

12. AUDITS

Alignify makes available to the Customer the information necessary to demonstrate compliance with this DPA, including the sub-processor list and summaries of its security measures, and allows for and contributes to audits, including inspections, by the Customer or an auditor it appoints, on 30 days' written notice, during business hours, at most once a year unless a supervisory authority requires it or after a personal data breach, and subject to confidentiality.

13. ORDER OF PRECEDENCE AND CONTACT

13.1. If this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails. If it conflicts with the Standard Contractual Clauses, the clauses prevail.

13.2. Questions about this DPA, a signed copy, or objections: contact@alignifytech.com.

PRIVATE ENTREPRENEUR KRAVCHENKO SVIATOSLAV EVGENOVYCH (ФОП Кравченко Святослав Євгенович)

Address: Ukraine, 03148, Kyiv city, ZORGE RIKHARDA STREET, building 2