Data Processing Agreement

Version 1.0

Last updated: 18 April 2026

This Data Processing Agreement (“DPA”) forms part of, and is subject to, the Setorio Terms of Service available at setor.io/terms (the “Agreement”) between:

Setorio, a sole proprietorship (eenmanszaak) operated by R. Saraiva, registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 91736838, established in Diemen, the Netherlands (“Setorio”, “we”, or “Processor”);

and the Customer who has accepted this DPA by registering for a paid Setorio workspace or by separate written agreement (“Customer”, “you”, or “Controller”).

Setorio and the Customer are individually a “Party” and collectively the “Parties”.

Recitals

The Customer has engaged Setorio to provide the Setorio software-as-a-service platform for client subscription management and client portals (the “Service”).
In providing the Service, Setorio Processes Personal Data on behalf of the Customer relating to the Customer's own clients and end-users.
The Parties wish to set out their respective rights and obligations under the General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and the Dutch Implementation Act (Uitvoeringswet AVG).
This DPA satisfies the requirements of Article 28(3) GDPR.

1. Definitions

Capitalised terms not defined in this DPA have the meanings given in the Agreement or, where applicable, the GDPR. The following definitions apply:

1.1 “Personal Data” means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR, that is Processed by Setorio on behalf of the Customer in connection with the Service.
1.2 “Processing” has the meaning given in Article 4(2) GDPR. “Process”, “Processed” and similar terms have corresponding meanings.
1.3 “Data Subject” means an identified or identifiable natural person whose Personal Data is Processed under this DPA, including the Customer's clients, end-users, and authorised representatives.
1.4 “Sub-processor” means any third party engaged by Setorio to Process Personal Data on behalf of the Customer.
1.5 “Personal Data Breach” has the meaning given in Article 4(12) GDPR.
1.6 “Supervisory Authority” means the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or any other competent supervisory authority under the GDPR.

2. Scope and Roles

2.1 This DPA applies to all Processing of Personal Data carried out by Setorio on behalf of the Customer in connection with the Service.

2.2 For the purposes of the Personal Data covered by this DPA: the Customer acts as Controller and Setorio acts as Processor.

2.3 Setorio acts as an independent Controller for Personal Data of the Customer's own administrative contacts (e.g. account holders, billing contacts) collected to perform the Agreement. The Setorio Privacy Policy at setor.io/privacy governs that Processing and is not subject to this DPA.

2.4 A description of the Processing carried out under this DPA, including subject matter, duration, nature, purpose, types of Personal Data and categories of Data Subjects, is set out in Annex A.

3. Customer Obligations

3.1 The Customer warrants that it has and will maintain throughout the term of the Agreement a valid lawful basis under Article 6 GDPR (and, where applicable, Article 9 GDPR) for the Processing of Personal Data instructed under this DPA.

3.2 The Customer is responsible for: (a) the accuracy, quality and legality of the Personal Data; (b) providing all required notices and obtaining all required consents from Data Subjects; and (c) the lawfulness of its instructions to Setorio.

3.3 The Customer shall not instruct Setorio to Process Personal Data in a manner that infringes the GDPR or other applicable data protection laws.

3.4 The Customer shall not upload or transmit through the Service any special categories of Personal Data within the meaning of Article 9 GDPR or data relating to criminal convictions and offences within the meaning of Article 10 GDPR, unless expressly agreed in writing in advance.

4. Setorio's Obligations as Processor

4.1 Documented instructions

4.1.1 Setorio shall Process Personal Data only on documented instructions from the Customer, including transfers of Personal Data to a third country, unless required to do so by Union or Member State law to which Setorio is subject. The Customer's documented instructions consist of: (a) the Agreement; (b) this DPA; and (c) any subsequent written instructions agreed by the Parties.

4.1.2 Setorio shall promptly inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection law.

4.2 Confidentiality

4.2.1 Setorio shall ensure that any person authorised to Process Personal Data is bound by an appropriate obligation of confidentiality, whether by statute, employment contract or written confidentiality undertaking.

4.3 Security of Processing

4.3.1 Setorio shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR. The measures in place at the Effective Date are described in Annex B.

4.3.2 Setorio may update its security measures from time to time, provided the level of security is not materially diminished.

4.4 Sub-processors

4.4.1 The Customer grants Setorio a general written authorisation to engage Sub-processors for the Processing of Personal Data, subject to this Section 4.4.

4.4.2 The Sub-processors engaged at the Effective Date are listed in Annex C.

4.4.3 Setorio shall maintain an up-to-date list of Sub-processors at setor.io/dpa#sub-processors. Setorio shall notify the Customer of any intended changes by updating that list and providing notice through the Service or by email at least thirty (30) days before the change takes effect.

4.4.4 The Customer may object to an intended new Sub-processor on reasonable data protection grounds within fifteen (15) days of notification by giving written notice to dpa@setor.io. If Setorio is unable to make a commercially reasonable change to avoid using the objected-to Sub-processor, the Customer may, as its sole remedy, terminate the Agreement with respect to the affected services by written notice.

4.4.5 Setorio shall enter into a written contract with each Sub-processor imposing data protection obligations no less protective than those in this DPA. Setorio remains fully liable to the Customer for the performance of each Sub-processor's obligations.

4.5 Assistance to the Customer

4.5.1 Taking into account the nature of the Processing, Setorio shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests from Data Subjects exercising their rights under Chapter III GDPR.

4.5.2 If Setorio receives a request from a Data Subject relating to Personal Data Processed on behalf of the Customer, Setorio shall promptly forward the request to the Customer and shall not respond to the Data Subject directly except to confirm receipt or to direct the Data Subject to the Customer.

4.5.3 Setorio shall assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR (security, breach notification, data protection impact assessments and prior consultation), taking into account the nature of the Processing and the information available to Setorio.

4.6 Personal Data Breach notification

4.6.1 Setorio shall notify the Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting the Customer's Personal Data.

4.6.2 The notification shall, to the extent possible at the time, describe: (a) the nature of the Personal Data Breach; (b) the categories and approximate number of Data Subjects and records concerned; (c) the likely consequences; and (d) the measures taken or proposed to address the breach. Where information is not available at the time of initial notification, Setorio shall provide it in subsequent updates without undue delay.

4.6.3 Setorio's notification of, or response to, a Personal Data Breach shall not be construed as an acknowledgement by Setorio of any fault or liability with respect to the Personal Data Breach.

4.7 Audits

4.7.1 Setorio shall make available to the Customer all information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR.

4.7.2 Setorio shall allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer, subject to the conditions in Sections 4.7.3 and 4.7.4.

4.7.3 Audits shall be limited to once per calendar year (except where required following a Personal Data Breach or by a Supervisory Authority), conducted on at least sixty (60) days' prior written notice, during normal business hours, in a manner that does not unreasonably interfere with Setorio's operations, and subject to confidentiality obligations.

4.7.4 The Customer bears the cost of any audit it requests, except where the audit reveals a material breach of this DPA by Setorio, in which case Setorio bears the reasonable documented costs of the audit.

5. International Data Transfers

5.1 Setorio Processes Personal Data within the European Economic Area (“EEA”). The primary hosting region is the European Union (Vercel EU Functions and Supabase eu-west-2).

5.2 Where a Sub-processor Processes Personal Data outside the EEA, Setorio shall ensure that such transfer is governed by an appropriate transfer mechanism under Chapter V GDPR, including the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where required, supplementary measures following the Schrems II decision (CJEU C-311/18).

5.3 Information about the location of each Sub-processor and the applicable transfer mechanism is included in Annex C.

6. Return and Deletion of Personal Data

6.1 Upon termination or expiry of the Agreement, Setorio shall, at the Customer's choice, return or delete all Personal Data Processed on behalf of the Customer, and delete existing copies, unless Union or Member State law requires storage.

6.2 The Customer may export its Personal Data through the Service's export functionality at any time during the term of the Agreement and during a thirty (30) day grace period following termination.

6.3 After the grace period, Setorio shall delete the Customer's Personal Data within sixty (60) days, except for: (a) backup copies, which are deleted in accordance with Setorio's backup retention schedule (maximum thirty (30) days); and (b) Personal Data that Setorio is required by law to retain.

7. Liability

7.1 Each Party's liability arising out of or related to this DPA, whether in contract, tort or under any other theory of liability, is subject to the limitations and exclusions of liability set out in the Agreement.

7.2 Nothing in this DPA limits or excludes liability that cannot be limited or excluded under applicable law, including liability under Article 82 GDPR for damage caused to a Data Subject.

8. Term and Termination

8.1 This DPA takes effect on the date the Customer accepts it (whether by clicking acceptance during signup, by signing it, or by continuing to use the Service after this DPA is published) and remains in effect for the duration of the Agreement.

8.2 The obligations placed on Setorio under this DPA shall survive termination of the Agreement for as long as Setorio Processes Personal Data on behalf of the Customer.

9. Governing Law and Jurisdiction

9.1 This DPA is governed by the laws of the Netherlands, without regard to conflict of law rules.

9.2 Any dispute arising out of or in connection with this DPA shall be submitted to the exclusive jurisdiction of the competent court in Amsterdam, the Netherlands.

10. Miscellaneous

10.1 In the event of any conflict between this DPA and the Agreement, this DPA shall prevail with respect to the Processing of Personal Data.

10.2 Setorio may amend this DPA from time to time to reflect changes in applicable law, the Service, or its Sub-processor list. Material changes will be notified to the Customer at least thirty (30) days in advance through the Service or by email. Continued use of the Service after the effective date of an amendment constitutes acceptance of the amended DPA.

10.3 If any provision of this DPA is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect.

10.4 All notices to Setorio under this DPA shall be sent to dpa@setor.io. Notices to the Customer shall be sent to the email address associated with the Customer's workspace.

Annex A: Description of Processing

A.1 Subject matter

Processing of Personal Data necessary for Setorio to provide the Service to the Customer, namely a software-as-a-service platform for client subscription management, billing and a client portal.

A.2 Duration

For the duration of the Agreement, plus the retention periods set out in Section 6 of this DPA.

A.3 Nature and purpose

The nature of the Processing consists of: collection, storage, organisation, retrieval, consultation, transmission, disclosure to authorised recipients, restriction and erasure of Personal Data through the Service. The purpose is to enable the Customer to manage subscriptions, send invoices, communicate with its clients, and operate a branded client portal.

A.4 Types of Personal Data

Identification data of the Customer's clients and their authorised users: name, email address, business name, profile information.
Communication and authentication data: login credentials (hashed), authentication tokens, IP address, browser metadata, language preferences.
Subscription and billing data: subscription plan, billing address, VAT number, invoice history, payment status. Card data itself is processed directly by Stripe and is never stored by Setorio.
Content uploaded by the Customer or its clients through the portal: project files, comments, messages, requests, and any documents they choose to share.
Usage data: timestamps of portal access, actions performed, feature usage.

A.5 Categories of Data Subjects

The Customer's clients (typically businesses or individual professionals).
Authorised users of the Customer's clients (e.g. team members, contacts, end-users invited to the portal).
The Customer's own team members and authorised users of the Customer's workspace.

A.6 Frequency of Processing

Continuous, for the duration of the Agreement.

Annex B: Technical and Organisational Measures

Setorio implements and maintains the following technical and organisational measures to ensure a level of security appropriate to the risk in accordance with Article 32 GDPR. Setorio may update these measures from time to time provided that the level of security is not materially diminished.

B.1 Encryption

All Personal Data is encrypted in transit using TLS 1.2 or higher.
All Personal Data is encrypted at rest using AES-256 (Supabase managed encryption).
Database backups are encrypted at rest.

B.2 Access control

Role-based access control with least-privilege principle for all production systems.
Multi-factor authentication required for all administrative access by Setorio personnel.
Row-level security (RLS) policies in the application database to enforce workspace-level data isolation.
All access to production systems is logged and reviewed periodically.

B.3 Network and infrastructure security

Production hosting on Vercel (EU region) and Supabase (eu-west-2). Both providers are ISO/IEC 27001 certified.
Web application firewall and DDoS protection at the edge.
Automated dependency vulnerability scanning.
Secrets and credentials managed through Vercel environment variables and never committed to source control.

B.4 Application security

Authentication via Supabase Auth with secure password hashing (bcrypt).
Session tokens issued via JWT with short expiry and rotation.
Input validation, output encoding, and parameterised queries to mitigate injection attacks.
Cross-Site Request Forgery (CSRF) protection on state-changing endpoints.
Content Security Policy (CSP) headers and other security headers configured at the application level.

B.5 Logging, monitoring and incident response

Application errors and exceptions captured by Sentry (EU region).
Product analytics captured by PostHog (EU instance) without Personally Identifiable Information in event properties.
Automated alerting on anomalies, failed authentication attempts and error spikes.
Documented incident response procedure including the seventy-two (72) hour breach notification commitment in Section 4.6 of this DPA.

B.6 Backups and resilience

Automated daily database backups with point-in-time recovery.
Backups retained for a maximum of thirty (30) days.
Geographically redundant storage within the EU.

B.7 Personnel

All personnel with access to Personal Data are bound by written confidentiality obligations that survive termination of their engagement.
Periodic security and privacy awareness training.

B.8 Data minimisation and retention

Personal Data is collected only to the extent necessary for the purposes set out in Annex A.
Personal Data is deleted in accordance with Section 6 of this DPA.

Annex C: List of Sub-processors

The following Sub-processors are engaged by Setorio for the Processing of Personal Data on behalf of the Customer as of 18 April 2026.

Sub-processor	Purpose	Data location	Transfer mechanism
Vercel Inc.	Application hosting and edge functions	European Union (Frankfurt)	Hosted in EU; SCCs in place for any incidental US transfers
Supabase Inc.	Application database, authentication, storage	European Union (eu-west-2)	Hosted in EU; SCCs in place for any incidental US transfers
Stripe, Inc. and Stripe Payments Europe Ltd.	Payment processing, subscription billing, EU VAT calculation (Stripe Tax)	European Union (primary) and United States	EU controller via Stripe Payments Europe; SCCs for US transfers
Resend Inc.	All transactional email delivery: welcome, billing, portal notifications to Customer's clients, and internal operational notifications to Setorio	European Union and United States	Standard Contractual Clauses (Module Two)
PostHog Inc. (EU instance)	Product analytics, feature usage and funnel analysis	European Union (eu.i.posthog.com)	Hosted in EU
Moneybird B.V.	Optional invoicing integration (only when the Customer connects Moneybird to its workspace; mutually exclusive with Stripe-issued invoices)	European Union (Netherlands)	Hosted in EU
Functional Software, Inc. (Sentry)	Error monitoring and exception tracking	European Union (Frankfurt)	EU data residency configured

Updates: Setorio will provide at least thirty (30) days' notice of any changes to this list as set out in Section 4.4.3 of this DPA.

Acceptance

This DPA is accepted by the Customer at the moment any of the following events occurs, whichever is earliest:

The Customer ticks the acceptance checkbox during signup or upgrade to a paid Setorio workspace;
The Customer signs and returns this DPA to dpa@setor.io;
The Customer continues to use the paid Service for more than thirty (30) days after this DPA has been notified to it.

Customers requiring a counter-signed copy may submit a request to dpa@setor.io. Setorio will provide a signed PDF within ten (10) business days.