Data Processing Agreement (DPA)

1. Definitions

Controller: the customer organisation using Custala. Processor: Breath Studios (operator of Custala). Personal Data: any information relating to an identified or identifiable natural person under applicable data protection law. Sub-processor: any third party engaged by Breath Studios to process Personal Data on its behalf.

2. Scope

This DPA forms part of your agreement with Breath Studios and applies where Breath Studios processes Personal Data on behalf of the Controller in connection with the Custala service described in the Terms of Service.

3. Processing instructions

Breath Studios will process Personal Data only on documented instructions from the Controller; only use Personal Data to provide Custala; not use Personal Data for unrelated purposes without prior written consent; and inform the Controller promptly if, in our opinion, an instruction infringes applicable data protection law.

4. Nature and purpose of processing

Processing includes storing and organising account and team data; generating insights and recommendations (including Ala AI coaching); and operating billing entitlements and access control.

Purpose: to provide the Custala platform and associated features as described in the Terms of Service.

5. Categories of personal data

Manager / admin identifiers (name, email, role); usage and activity data (logins, interactions); team, segment and access-scope configuration; technical logs as needed for security and operations.

6. Categories of data subjects

Employees and team members who respond to surveys; managers and workspace administrators; other authorised users of the platform.

7. Duration of processing

Breath Studios will process Personal Data for the duration of the service agreement, plus any period required to fulfil legal obligations or handle deletion after termination.

8. Processor obligations

Breath Studios agrees to ensure authorised personnel are bound by confidentiality; implement appropriate security measures; assist the Controller with data-subject rights requests; not engage new Sub-processors without prior notification where required; and make available information reasonably necessary to demonstrate compliance with this DPA.

9. Sub-processors

Current Sub-processors include: Hostinger for cloud hosting and infrastructure; Lemon Squeezy for payment processing; Resend for transactional email; Google Gemini for Ala AI coaching.

We will give the Controller reasonable prior written notice before engaging a new material Sub-processor, ensure Sub-processors are bound by protective obligations, and remain responsible for their acts and omissions. The Controller may object in writing within the notice period; if unresolved, either party may terminate the relevant service on written notice.

10. Data subject rights

Breath Studios will assist the Controller in responding to requests under applicable law (access, rectification, erasure, restriction, portability, objection). We will notify the Controller of requests received directly without undue delay and will not respond without authorisation unless required by law.

11. Security measures

Measures include role-based access controls; encryption of data in transit where appropriate; secure hosting via Hostinger; monitoring; and staff awareness of data-protection responsibilities.

12. Data breach notification

In the event of a Personal Data breach, Breath Studios will notify the Controller without undue delay and, where feasible, within 72 hours of becoming aware; provide detail needed for the Controller’s own notification duties; and cooperate in investigation and remediation.

13. Data retention and deletion

Upon termination of the service, Breath Studios will delete or return Personal Data within 90 days of the termination date at the Controller’s choice, confirm deletion on request, and retain data longer only where required by law (and will inform the Controller of such retention).

14. International transfers

Where Personal Data is transferred outside Türkiye or the EEA, Breath Studios will ensure appropriate safeguards required by applicable law.

15. Liability

Each party is responsible for its own obligations under applicable data protection law. Breath Studios’ liability under this DPA is subject to the limitations in the Terms of Service, except where liability cannot be limited by law.

16. Governing law

This DPA is governed by the laws of the Republic of Türkiye, without prejudice to mandatory protections under applicable data protection law.

17. Contact

Data protection queries: info@breathstudios.net · https://breathstudios.net/