Data processing agreement
When your company uses Plandura, you are the controller of the content and we are the processor. Here is what the agreement covers, and every sub-processor we use.
Roles and scope
Your company is the data controller. CXminds is the processor and processes personal data only on your instructions, for the purpose of delivering the platform.
Processing covers what you put into the workspace: users and roles, plus any personal data in strategy, goals, projects, tasks, reviews and notes.
Our obligations
- We process data only on your instructions and for the agreed purpose.
- Our staff are bound by confidentiality and get access only on a need-to-know basis.
- We assist you in fulfilling data subject rights — access, rectification, erasure and portability.
- We notify you without undue delay if we become aware of a personal data breach.
- We delete or return data when the agreement ends, no later than 90 days after.
- We provide the information you need to document compliance, including answers to audit questions.
Security measures
- Encryption in transit and at rest.
- Per-company access control enforced in the database, not only in the interface.
- Verified email at sign-in and two-factor authentication for platform administration.
- Logging of administrative actions.
- Backups with tested restores and separated development and production environments.
Sub-processors
By accepting the agreement you give general authorisation for the sub-processors below. We give notice of changes so you can object.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase (database, login og filer) | Hosting of database, user sign-in and files for your company workspace. | EU |
| Cloudflare (levering af websitet) | Delivery and protection of the application and the public pages. | EU/global (edge) |
| AI-modelleverandør via Lovable AI Gateway | Processing of the text you send to AI features. Content is not used to train models. | EU/USA |
| Stripe (betaling) | Subscription and payment handling. Card data is processed by Stripe only. | EU/USA |
| Virk/CVR (offentligt register) | Lookup of official company information based on the CVR number. | Danmark |
Transfers outside the EU
Processing takes place primarily in the EU. Where a sub-processor processes data outside the EU/EEA, it is done under the European Commission's standard contractual clauses with supplementary technical measures.
Signed agreement
If you need a signed data processing agreement for your records, email sales@cxminds.dk and we will send it.