Data Processing Agreement (DPA)
This Data Processing Agreement ("DPA") defines the terms and conditions under which Fruitask processes personal data on behalf of customers (Controllers) who use the Fruitask platform.
The DPA is incorporated into our Terms of Service and applies to all customers using Fruitask to process personal data of individuals in the Philippines (under DPA 2012), European Union (under GDPR), or other jurisdictions with data protection laws.
Scope of Processing
Fruitask processes personal data as a Processor (or "Personal Information Processor" under DPA 2012) when:
- You (the Controller/PIC) upload, create, or store personal data in your Fruitask workspace
- You invite collaborators or share your workspace with team members
- You use Fruitask forms, surveys, or public links to collect personal data
- You use automations or workflows that involve personal data
- You connect, host or automate a mailbox through FruitMail
Details of Processing
Subject Matter
Processing of personal data that you store or manage within Fruitask workspaces, tables, documents, connected or hosted mailboxes, automations, and related features.
Duration
During your subscription to Fruitask and for the retention period specified in our Privacy Policy after account termination.
Nature of Processing
- Storage and retrieval of personal data
- Access control and permission management
- Backup and disaster recovery
- Security monitoring and threat detection
- Technical maintenance and support
- Retrieval, rendering, synchronization and transmission of mailbox messages and attachments
- Execution of customer-configured email actions and inbound-mail automations
- Optional recording of approximate email-open events when enabled by the customer or sender
Purpose
To provide the Fruitask service and fulfill your instructions regarding personal data management.
Categories of Personal Data
Whatever you choose to store in Fruitask, which may include:
- Names and contact information
- Email addresses and phone numbers
- Identifiers and authentication data
- Email message bodies, subjects, headers, addresses, attachments, drafts and mailbox state
- Email-open timestamps, counts and delivery-deduplication identifiers
- Other personal data you choose to process
Categories of Data Subjects
Individuals whose personal data you process using Fruitask, including customers, employees, mailbox users, email senders and recipients, vendors, collaborators, or other third parties.
Fruitask Obligations as Processor
1. Processing Only as Instructed
We process personal data only as instructed by you through the platform's features and controls. We do not use your data for our own purposes (except as necessary to operate the service and comply with law).
2. Confidentiality
Our employees and contractors are bound by confidentiality obligations regarding personal data they access during service delivery.
3. Security Measures
We implement appropriate technical and organizational security measures including HTTPS encryption, access controls, audit logging, and regular security testing.
4. Data Integrity & Availability
We maintain measures to ensure personal data is accurate, complete, and available. We maintain backups and disaster recovery procedures.
5. Assistance with Data Subject Rights
We provide tools and assistance for you to handle data subject access requests, including data export features (CSV, JSON) that help you fulfill requests for rectification, erasure, and portability.
6. Audit & Compliance
We maintain audit logs and documentation of processing activities. We cooperate with regulatory authorities and provide you with information necessary to demonstrate compliance.
7. Data Breach Notification
We notify you without unreasonable delay if we experience a personal data breach affecting data you store in Fruitask.
8. Data Deletion Upon Termination
Upon account termination or deletion request, we delete personal data as instructed, except where we have legal obligations to retain it.
Your Responsibilities as Controller
As the Controller (Personal Information Controller under DPA 2012), you are responsible for:
- Lawful Basis: Ensuring you have a lawful basis to collect and process personal data
- Transparency: Informing data subjects about how their data is processed
- Consent: Obtaining necessary consent from data subjects
- Data Accuracy: Ensuring personal data is accurate and kept up-to-date
- Data Minimization: Collecting only necessary data for stated purposes
- Data Subject Rights: Responding to access, rectification, erasure, and portability requests
- Security: Implementing appropriate security measures to protect personal data
- Compliance: Ensuring compliance with all applicable data protection laws
- Third-Party Agreements: Obtaining agreements with any subprocessors you engage
- Mailbox Authority: Ensuring you are authorized to connect each mailbox and instruct Fruitask to process its contents
- Email Communications: Complying with applicable privacy, marketing, employment, communications and anti-spam requirements
- Open Tracking: Determining and documenting an appropriate lawful basis and providing any notice or consent required before enabling email-open tracking
Authorized Subprocessors
We use the following subprocessors to provide Fruitask services. All are bound by Data Processing Agreements that comply with applicable data protection laws:
Hostinger
Infrastructure hosting — Processing Location: Europe
MongoDB
Database services — Processing Location: As configured (EU/PH/US)
Fruitask-operated Stalwart Mail
Transactional delivery and optional Fruitask-hosted mailboxes. Stalwart is a Fruitask-operated service component rather than a separate subprocessor; its infrastructure provider and processing location are identified in the Subprocessor List.
Google Analytics
Analytics (anonymized only) — With consent where required
Paddle
Payment processing (PCI-DSS compliant) — For billing only
Google Workspace/Gmail, Microsoft 365/Outlook, and custom IMAP/SMTP providers selected and contracted directly by a customer are customer-directed external services rather than automatically appointed Fruitask subprocessors. Their terms, processing locations, retention and transfer mechanisms apply to the customer's mailbox account. The current Fruitask-appointed subprocessor list is maintained on the Subprocessor List.
We notify customers of changes to our subprocessor list and provide opportunities to object. Contact us for current details.
International Data Transfers
If your data is transferred outside the Philippines or European Union:
- We use Standard Contractual Clauses (SCCs) approved by relevant authorities
- We conduct Transfer Impact Assessments (TIAs) to ensure adequate protection
- We implement additional technical measures (encryption, etc.) where necessary
- We notify you in advance of any cross-border transfers
Term & Termination
This DPA applies during your subscription to Fruitask and continues as necessary to fulfill our legal obligations regarding data deletion and retention.
Upon termination:
- You can export your data in CSV/JSON format
- You can request deletion of all personal data
- We delete data as instructed within 15 days, except where legally required to retain
- Backups are purged within 90 days
Amendment to DPA
We may amend this DPA to reflect changes in our processing activities, regulatory requirements, or subprocessors. We will notify customers at least 30 days in advance of material changes and provide an opportunity to terminate without penalty if the changes are unacceptable.
Complete DPA Document
This page provides a summary of our Data Processing Agreement. For a complete, detailed DPA document suitable for regulatory compliance and audit purposes, please contact us.
We can provide a signed DPA that complies with DPA 2012, GDPR, CCPA, and other regulatory frameworks.