Legal
Data Processing Agreement
For most CastCalc data we are the controller (see the Privacy Policy). Where a business customer enters personal data of its own staff or contacts – for example Team users or named supplier contacts – we process that data on the customer's behalf as a processor under Article 28 GDPR. These terms apply to that processing as part of the Terms of Service. A signed copy is available on request: write to sales@osturu.com with your company name and address.
1. Subject, duration, data
- Subject: providing CastCalc to the customer. Duration: as long as the customer's account exists, plus the deletion period below.
- Data subjects: the customer's users and contacts named in CastCalc. Data: names, business e-mail addresses, supplier contact names and notes the customer enters.
2. Our obligations as processor
- We process the data only on the customer's documented instructions, which are given by the use of CastCalc and these terms.
- Everyone with access to the data is bound to confidentiality.
- Technical and organisational measures: encryption in transit (HTTPS), hashed passwords, access only per login and team, rate limits on sign-in, database backups, server logs for security.
- We help the customer answer data subject requests, report personal data breaches without undue delay (at the latest within 72 hours of becoming aware), and support impact assessments where needed.
- At the end of the service we delete the data within 12 months, or earlier on request, unless the law requires us to keep it; the customer can export its data before.
- We provide the information needed to show compliance and allow audits on reasonable notice, at most once a year, at the customer's cost.
3. Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Supabase Inc. | Database | EU region |
| Hostinger International Ltd. | Servers | EU |
| Zoho Corporation B.V. | EU data centre | |
| Stripe Payments Europe Ltd. | Payments (billing contacts only) | Ireland (EU), with transfers to the USA under the Data Privacy Framework / standard contractual clauses |
We inform customers by e-mail at least 30 days before adding or replacing a sub-processor; the customer may object and, if we cannot address the objection, cancel the subscription before the change.
4. Transfers outside the EU
Only with appropriate safeguards under Chapter V GDPR (adequacy decision or standard contractual clauses).