Data Processing Agreement

Last updated: November 2026

1. Parties and background

This Data Processing Agreement (“DPA”) is an annex to the Terms of Service of Lendilo.app and part of that agreement (the “Main Agreement”). It applies between the organization that uses Lendilo (the “Customer”) and SimplyPulse AB, registration number 559513-3561 (“SimplyPulse”).

The Customer is the controller of the personal data it registers in Lendilo about its borrowers, and SimplyPulse is its processor under Article 28 of the GDPR. If this DPA and the Main Agreement conflict on personal data matters, this DPA prevails. A Customer who wants a separate signed agreement can ask for one at hello@lendilo.app.

2. The processing

SimplyPulse processes the personal data only to provide, maintain and support Lendilo, and not for its own purposes. Annex A describes the processing. SimplyPulse may use aggregated statistics, from which no person or Customer can be identified, to develop the service.

3. Instructions

SimplyPulse processes personal data only on the Customer’s documented instructions. These are the Main Agreement, this DPA and the Customer’s own use and settings in the service. Further instructions must be in writing, and SimplyPulse may charge reasonable fees for work beyond the service’s normal functions. SimplyPulse will tell the Customer if it considers an instruction to breach data protection law.

The Customer is responsible for having a legal basis for the processing, for the accuracy of the data and for informing the people concerned.

4. Confidentiality and security

Only people who need access have it, and they are bound by confidentiality that continues after their engagement ends. SimplyPulse applies appropriate measures under Article 32 of the GDPR, including:

• encryption in transit (TLS) and storage within the EU,
• login with single-use codes by email, without passwords, and a new code for sensitive actions,
• separation between organizations, tested automatically, and roles for owners and admins,
• secret links stored only as one-way hashes, and removal of location data from uploaded photos,
• backups, system updates and internal incident procedures.

SimplyPulse may change the measures, as long as the level of security does not decrease.

5. Sub-processors

The Customer authorizes SimplyPulse to use the sub-processors listed in Annex B. SimplyPulse imposes equivalent obligations on them by contract and remains liable for them. SimplyPulse gives at least 30 days’ notice of changes to the list, by email to the owner of the organization. The Customer may object on reasonable grounds. If no solution is found, the Customer may terminate the Main Agreement from the date the change takes effect, and paid time not used is refunded.

6. International transfers

The personal data covered by this DPA is processed within the EU/EEA. If that were to change, SimplyPulse will ensure a valid transfer mechanism under Chapter V of the GDPR and tell the Customer in advance, as described in section 5.

7. Assistance to the Customer

The service lets the Customer correct, export and delete borrowers’ data itself, which covers most requests from the people concerned. If such a request reaches SimplyPulse, it is referred to the Customer. SimplyPulse otherwise helps to a reasonable extent, including with data protection impact assessments and consultations.

8. Personal data incidents

SimplyPulse notifies the Customer without undue delay, and within 48 hours of discovering a personal data breach, with the information it has. SimplyPulse helps the Customer prepare notifications to authorities and to the people concerned, but does not make those notifications on the Customer’s behalf.

9. Audit

On request, SimplyPulse provides the information needed to show compliance with this DPA, and allows audits by the Customer or an auditor it appoints. Audits take place at most once a year, with 30 days’ notice, and may not be carried out by a competitor of SimplyPulse. SimplyPulse may charge for reasonable time spent. Audits of sub-processors are handled through SimplyPulse.

10. Export and deletion at the end of the agreement

The Customer can export all its data at any time under Settings → Data, including before deletion. When the owner deletes the organization, it is hidden at once and deleted for good after 30 days, unless the Customer asks otherwise or retention is required by law. Backup data is deleted as backups rotate, and has the same protection until then.

11. Term

This DPA applies for as long as SimplyPulse processes personal data for the Customer, and ends when deletion under section 10 is complete. Liability, changes, governing law and disputes are governed by the Main Agreement.

Annex A: The processing

• Purpose and nature: collecting, storing, structuring, sending and deleting personal data to provide, administer and support Lendilo.
• Duration: the term of the Main Agreement and the deletion period in section 10.
• People concerned: the Customer’s borrowers, such as members, pupils, employees and their guardians. Borrowers may be children.
• Personal data: name, and if the Customer or the borrower provides them, email address and phone number; loans, returns and bookings; messages and notes connected to them.
• Sensitive data: the service is not intended for special categories of personal data under Article 9 of the GDPR, or for national ID numbers. The Customer must not enter them, not even in free-text fields.
• Children’s data: where borrowers are children, the Customer is responsible for having a legal basis and for informing them and, where needed, their guardians. Keep to what the loan requires.
• Retention: borrowers are anonymized after a period of inactivity the Customer chooses (24 months unless changed). Links to “My loans” stop working after 30 days.

Annex B: Sub-processors

Paddle.com Market Ltd is the merchant of record for payments and an independent controller of payment data, so it is not a sub-processor. Umami, which we use for anonymous statistics on the public website, is not used in the app, the catalog or on borrowers’ pages, and does not process any data covered by this DPA. Both are described in the Privacy Policy.