Legal
Data Processing Agreement
Last updated: 31 October 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Stoa, operated by Ahmed Adil Kareem, Baghdad, Iraq ("Processor"), and the business using Stoa ("Customer" or "Controller"). It applies whenever Stoa processes personal data on the Customer's behalf, including under the UK GDPR and the EU GDPR.
1. Subject and duration
The Processor processes personal data only to provide the Stoa planning service to the Customer, for as long as the Customer uses Stoa, and until the data is deleted as described in section 8.
2. Types of data and people
- People: the Customer's owner, managers, group leaders, and team members.
- Data: names, email addresses, account identifiers, team roles and structure, plans, tasks, projects, notes, confirmed hours, overtime, notifications, and bug reports.
No special categories of personal data (such as health data) are intended to be processed. The Customer should not enter such data into Stoa.
3. The Processor's obligations
The Processor will:
- process personal data only on the Customer's documented instructions, which are these terms and the Customer's use of Stoa's features,
- ensure that anyone authorized to access the data is bound by confidentiality,
- apply appropriate security measures, including encrypted connections, secure sessions, strict separation of each customer's data, limited administrator access, and regular backups,
- help the Customer respond to requests from people exercising their data protection rights, including through Stoa's export and deletion features,
- notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data,
- help the Customer with data protection impact assessments where reasonably required, and
- make available the information needed to show compliance with this DPA.
4. The Customer's obligations
The Customer is responsible for having a lawful basis to process its team's data in Stoa and for informing its team members about it.
5. Sub-processors
The Customer authorizes the Processor to use these sub-processors:
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean | Server hosting | Frankfurt, Germany |
| Sign-in, if the user chooses it | Global | |
| Microsoft | Sign-in, if the user chooses it | Global |
The Processor will announce any new sub-processor in the app at least 30 days in advance. The Customer may object on reasonable data protection grounds; if the parties cannot resolve the objection, the Customer may end the subscription.
6. International transfers
The Processor operates from Iraq, which is outside the UK and the European Economic Area. For any transfer of personal data from the EEA to the Processor, the parties agree to the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference. For transfers from the UK, the UK International Data Transfer Addendum to those clauses applies. If these clauses conflict with this DPA, the clauses prevail.
7. Audits
On reasonable written request, the Processor will provide information showing compliance with this DPA. Any further audit must be agreed in advance, at reasonable times, and at the Customer's cost.
8. End of processing
When the Customer deletes its team or its subscription ends and the team is deleted, the Processor deletes the Customer's personal data, including from backups within 35 days, unless the law requires it to be kept. Before deletion, the Customer can export its data from Stoa.
9. Contact
Ahmed Adil Kareem, Baghdad, Iraq