Data Processing Agreement
Last updated: 16 September 2026
This Data Processing Agreement (DPA) forms part of the agreement between Projectino s.r.o., operator of the RedmineX product and brand (Projectino, Processor), and the business customer identified in the applicable quotation, order or agreement (Customer, Controller) where Projectino processes Personal Data on the Customer's behalf.
If the Customer acts as a processor for another controller, Projectino acts as the Customer's subprocessor and the provisions below apply accordingly.
This DPA is intended to satisfy the processor-contract requirements of Article 28 GDPR where the GDPR applies.
1. Scope and instructions
Projectino will process Customer Personal Data only:
to provide, secure, maintain and support the Products and Services described in the Agreement;
on the Customer's documented instructions, including instructions contained in the Agreement and normal use of the Services; or
where processing is required by applicable law, in which case Projectino will inform the Customer before processing unless legally prohibited from doing so.
Projectino will promptly inform the Customer if, in its reasonable opinion, an instruction infringes applicable data-protection law.
The Customer is responsible for determining the lawfulness, purpose and means of its processing and for providing lawful instructions to Projectino.
2. Details of processing
Unless the applicable order or service specification states otherwise:
Subject matter: operation, hosting, administration, maintenance, support, migration, integration, backup, troubleshooting and related technical services for the Customer's Redmine environment and connected systems.
Duration: the term of the applicable Service plus the period reasonably required for return, migration, backup expiry and deletion.
Nature and purpose: storage, access, transmission, organisation, retrieval, configuration, support, maintenance, backup, restoration, migration and other processing necessary to provide the agreed Service.
Data subjects: Customer employees, contractors, users, customers, suppliers, contacts and other individuals whose data the Customer places in or connects to the Service.
Personal Data: account and identity data, business contact data, issue/project content, communications, attachments, logs, authentication data, technical metadata and any other Personal Data submitted by or for the Customer.
Special-category data: not required by RedmineX as a standard service. If the Customer chooses to process special-category or similarly sensitive data, the Customer is responsible for ensuring that such processing is lawful and appropriate for the agreed Service and security level.
3. Confidentiality and authorised personnel
Projectino will ensure that persons authorised to process Customer Personal Data are bound by confidentiality obligations and receive access only to the extent reasonably necessary for their role.
Access will be granted according to operational need and will be removed or adjusted when no longer required.
4. Security
Projectino will implement and maintain technical and organisational measures appropriate to the risk, taking into account the nature, scope, context and purpose of processing.
Measures may include, as appropriate to the Service:
role-based and least-privilege access controls;
unique administrative credentials and controlled privileged access;
encryption in transit and encryption at rest where supported and appropriate;
logging, monitoring and incident-management processes;
system hardening, patching and vulnerability management;
backups and recovery procedures where included in the Service;
separation of environments where appropriate;
change-management and deployment controls;
confidentiality and security requirements for personnel and contractors; and
supplier and subprocessor security management.
The specific architecture and security measures may differ by hosting region, infrastructure provider and service tier. Projectino may update measures over time provided that the overall level of protection is not materially reduced.
5. Hosting regions and remote access
The Customer's primary production environment will be hosted in the region stated in the applicable Agreement. Available regions may include Europe, Asia, North America and South America.
Regional hosting determines the primary location of the Customer environment; it does not mean that all processing is confined to that region. Authorised Projectino personnel, including personnel located in Europe, may remotely access Customer environments in other regions where required to operate, maintain, secure, support or troubleshoot the Service. Approved contractors and subprocessors may also access data where necessary for the agreed Service.
Where applicable data-protection law imposes requirements on international transfers or remote access, Projectino will use the legally required transfer mechanism and safeguards.
6. Subprocessors
The Customer gives Projectino general authorisation to engage subprocessors where reasonably necessary to provide the Services, including providers of hosting, infrastructure, backup, monitoring, security, support, communications and related operational services.
Projectino will require subprocessors that process Customer Personal Data to provide data-protection obligations appropriate to the processing and substantially consistent with Projectino's obligations under this DPA.
Projectino will remain responsible for its subprocessors to the extent required by applicable law.
Projectino will make information about material subprocessors available to the Customer and will provide reasonable notice of intended additions or replacements where required by Article 28 GDPR. The Customer may raise a reasonable data-protection objection to a new subprocessor. The parties will work in good faith to resolve the objection; where no reasonable solution is available, either party may terminate the affected Service in accordance with the Agreement.
7. Data-subject requests
Taking into account the nature of the processing, Projectino will provide reasonable assistance to enable the Customer to respond to requests from data subjects exercising rights under applicable data-protection law.
If Projectino receives a request directly concerning Customer Personal Data, it will redirect the requester to the Customer or otherwise inform the Customer, unless legally prohibited from doing so.
8. Security incidents and personal-data breaches
Projectino will notify the Customer without undue delay after becoming aware of a confirmed Personal Data breach affecting Customer Personal Data.
The notification will include information reasonably available to Projectino that the Customer needs to assess the incident and meet applicable notification obligations. Projectino may provide information in phases as the investigation progresses.
Projectino will take reasonable steps to contain, investigate and remediate incidents within its responsibility. Notification of an incident does not constitute an admission of fault or liability.
9. Compliance assistance
Taking into account the nature of processing and information available to Projectino, Projectino will provide reasonable assistance with the Customer's obligations concerning security, breach notification, data-protection impact assessments and prior consultation with supervisory authorities where these obligations relate to the Services.
Assistance that materially exceeds normal support may be billable unless caused by Projectino's breach of this DPA or otherwise included in the Agreement.
10. International transfers
Where the GDPR applies, transfers of Customer Personal Data to a country outside the EEA will be made only where a valid transfer mechanism is available, such as:
an adequacy decision;
the European Commission's Standard Contractual Clauses (SCCs); or
another transfer mechanism permitted by applicable law.
Where SCCs are required for processing under the Agreement, the parties agree to cooperate in completing the applicable module and annex information and to treat the SCCs as incorporated into the Agreement once applicable. If this DPA conflicts with mandatory provisions of the SCCs, the SCCs prevail for the relevant transfer.
Projectino will take reasonable steps to assess and implement supplementary measures where required for a restricted transfer.
11. Return and deletion
At the end of the relevant Service, Projectino will, at the Customer's choice and subject to the Agreement, return or make available a reasonable export of Customer Personal Data and delete remaining copies when they are no longer required to provide transition services, maintain agreed backups, establish or defend legal claims, or comply with law.
Backup copies may remain until they expire through the normal backup lifecycle, during which they remain protected under this DPA and will not be restored except for legitimate operational or recovery purposes.
The Customer is responsible for requesting and obtaining any required export before contractual access expires where the Service provides self-service export functionality.
12. Audit and information rights
Projectino will make available information reasonably necessary to demonstrate compliance with this DPA and Article 28 GDPR.
Where that information is insufficient, the Customer may request a reasonable audit related specifically to processing under this DPA. Audits must be coordinated in advance, protect the confidentiality and security of other customers and Projectino systems, avoid unreasonable operational disruption, and normally be limited to once per year unless a material incident or supervisory authority requires otherwise.
Projectino may satisfy audit requests through relevant independent reports, certifications, security documentation or remote review where reasonably sufficient. Customer-specific audits that require material additional effort may be billable unless they identify a material breach by Projectino.
13. Customer obligations
The Customer represents that it has a lawful basis for the Personal Data it instructs Projectino to process and that its instructions comply with applicable law.
The Customer is responsible for configuring users, permissions, retention rules, authentication settings and connected systems under its control and for limiting the Personal Data submitted to what is necessary for its purposes.
The Customer will not require Projectino to process Personal Data in a manner inconsistent with the agreed Service or applicable law without first agreeing the necessary technical, contractual and security measures.
14. Liability and precedence
Liability arising under this DPA is subject to the liability provisions of the main Agreement except where applicable data-protection law requires otherwise.
If this DPA conflicts with the main Terms & Conditions concerning processing of Customer Personal Data, this DPA prevails. Mandatory SCC provisions or applicable law prevail over conflicting contractual provisions.
15. Contact
Data-protection enquiries concerning processing under this DPA may be sent to hello@redmine-x.com.
Projectino s.r.o.
Světova 523/1
180 00 Prague 8
Czechia
Company ID: 09829202
VAT ID: CZ09829202