Data Processing Agreement
Version of 3 November 2026.
This agreement (the "DPA") applies when ApplePie creative agency OG, Wagramer Straße 110, 1220 Wien, Austria, FN 681220 w ("ApplePie", the "Processor") processes personal data in SCALE by split/build (the "Service") on behalf of a workspace that uses the Service (the "Controller"). It forms part of the Terms of Use and meets Art. 28 GDPR. By using the Service for personal data of others, the Controller accepts it. A signed copy is available on request at support@splitbuild.net.
1Subject matter and duration
The Processor hosts and operates the Service so the Controller can manage its projects, tasks, files, conversations, calls and client records. Processing lasts as long as the workspace exists, plus the erasure period in section 9.
2Nature, purpose and data
- Nature and purpose: storing, displaying, searching, transmitting to integrations the Controller connects, backing up and deleting workspace content — only to provide the Service.
- Categories of data subjects: the Controller's members, employees, contractors, clients and their contacts.
- Types of personal data: names, email addresses, telephone numbers, messages, files, recordings and transcripts, and any other data the Controller places in the Service. The Controller must not place special categories of data (Art. 9 GDPR) in the Service.
3Instructions
The Processor processes personal data only on the Controller's documented instructions, which are these terms, the Controller's use of the Service and settings, and the requests of its administrators. If the Processor believes an instruction infringes data-protection law, it will say so without delay.
4Confidentiality
People authorised to process the data are bound to confidentiality.
5Security (Art. 32 GDPR)
- Encryption in transit (TLS); third-party credentials encrypted at rest; passwords stored as bcrypt hashes.
- Access separated by workspace and by area, enforced in the application and in the database; role-based permissions; logging of actions.
- Regular backups, restricted operator access, and a process for investigating and fixing vulnerabilities.
The Processor may change these measures if the level of protection does not fall.
6Sub-processors
The Controller authorises the sub-processors in the table below. Features that need a sub-processor (AI, Telegram, Zoom, email, calendar) send data to it only when the Controller enables them.
| Sub-processor | Purpose | Location |
|---|---|---|
| Timeweb | Server and database hosting | Russian Federation |
| Resend | Sending and receiving email | United States |
| Google (Gemini), Anthropic (Claude) | AI features | United States |
| Replicate | Call transcription | United States |
| Telegram | Connected chats | International |
| Zoom | Meeting bot | United States |
| Google Calendar, Google Docs | Connected calendars and files | United States |
The Processor will tell the Controller of a new sub-processor in the interface or by email before it starts, and the Controller may object on reasonable grounds by disabling the related feature or by ending use. The Processor imposes on each sub-processor obligations equivalent to these.
7International transfers
Where personal data is transferred outside the EU/EEA, the Processor ensures a lawful basis under Chapter V GDPR, such as the Standard Contractual Clauses, the EU–US Data Privacy Framework or, where applicable, the derogation of Art. 49(1)(b). The Privacy Policy, section 6, lists the locations.
8Assistance
The Processor helps the Controller, taking the nature of the processing into account and within reason, to answer data-subject requests (access, correction, erasure, restriction, portability, objection), and with security, breach notification, impact assessments and consultation with authorities. The Controller can export its data through the interface and the external API at any time.
9Deletion and return
After the workspace is deleted, the Processor erases its personal data within 30 days, and from backups within the backup rotation period, unless the law requires storage. Until then the Controller can export it.
10Personal data breaches
The Processor notifies the Controller without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting the Controller's data, with the information it has to support the Controller's own notification duty.
11Audits
The Processor makes available the information needed to demonstrate compliance with Art. 28 and allows audits by the Controller or an auditor it appoints, on reasonable notice, during business hours and without disrupting operations, at the Controller's cost. Security documentation is normally sufficient.
12Governing law
This DPA is governed by Austrian law. In case of conflict with the Terms of Use on the processing of personal data, this DPA prevails.
13Contact
support@splitbuild.net