Giano Care
Legal
Data processing agreement
Last updated October 15, 2026
Giano Care
privacy@giano.care
This agreement (article 28 GDPR) is part of the terms of service between the organisation using Giano Care (the controller) and Giano Care (the processor). It takes effect when the organisation signs up.
1. Subject and duration
The processor hosts and operates the Giano Care service for the controller for as long as the controller's account exists, and processes personal data only to provide it.
2. Data and people concerned
- People: those who submit the controller's intake form ("customers"), and the controller's team members.
- Data: customers' name, phone, optional email, answers to the controller's questions (which may include health-related data, art. 9 GDPR), bookings and call notes, and the team's messages about requests; team members' account data.
- Processing: storage, display to authorised team members, routing, notifications, statistics, export and erasure.
3. Processor's obligations
- Process data only on the controller's documented instructions, which are given through the service's settings and features; tell the controller if an instruction seems unlawful.
- Ensure everyone with access is bound by confidentiality.
- Apply the security measures in section 5.
- Help the controller answer data subjects' requests, using the export and erasure tools in the service and on request.
- Notify the controller of a personal data breach without undue delay, and help with notifications to authorities and people.
- Help with data protection impact assessments where needed.
- At the end of the service, delete the controller's data (45 days after the plan or trial ends, after an export window) unless the law requires keeping it.
- Make available the information needed to show compliance and allow reasonable audits, with notice.
4. Sub-processors
The controller authorises these sub-processors:
| Provider | Purpose | Location |
|---|---|---|
| netcup GmbH | Servers and database | Germany |
| Backblaze, Inc. | Encrypted database backups and uploaded pictures | EU region (Netherlands); SCCs for US access |
| Resend, Inc. | Email delivery (no intake answers are sent) | EU sending region; SCCs for US access |
| Stripe Payments Europe Ltd. | Subscription payments (account holders only) | Ireland |
| Meta Platforms Ireland Ltd. | WhatsApp messages to team members, only if the add-on is enabled | Ireland; SCCs for US transfers |
| Functional Software, Inc. (Sentry) | Error reports, without request data or customer data | EU region |
| New Relic, Inc. | Performance monitoring (timings and errors), without request data or customer data | EU region |
| Better Stack, Inc. | Server logs, without request parameters, email or IP addresses | USA; EU-US Data Privacy Framework, SCCs as fallback |
The processor will tell owners by email at least 30 days before adding or replacing a sub-processor; the controller may object and, if no solution is found, terminate.
5. Security measures
- HTTPS for all traffic; servers in the EU with firewall and key-only administrative access.
- Encryption at rest of customers' phone, email, intake answers, call notes and team messages.
- Strict separation between organisations in every query; role-based access, professionals see only their assigned people.
- Rate limiting and lockout against brute force; two-factor authentication for platform administrators; logged and notified administrator access.
- Configurable retention: customers whose cases closed longer ago than the controller's setting are anonymized automatically.
6. Contact
Data protection questions and breach contacts: privacy@giano.care.