DPA change history

Version 2.4 · in force from 7 October 2026

7 October 2026 — services an organisation connects (register 2.2)

• The sub-processor register lists three more services an organisation can connect: Viva, to take payment for invoices and accepted proposals; WhatsApp Business (Meta); and Viber Business Messages through Infobip or Apifon. Each is the organisation’s own account, which it connects and pays for itself, so none is our sub-processor.
• Editorial, versions unchanged. Clause 4.3 and Annex I of this agreement, the Pro terms, and the terms and privacy notice for people using an organisation’s portal no longer give examples from a feature set that is not offered. The rules on children’s data and special categories are unchanged.

No sub-processor is added or replaced.

3 October 2026 — deleted records can be restored (DPA 2.4)

• Clause 7.2 said deletion of an individual record was immediate. It is no longer: a deleted record moves to Recently deleted, where your users can restore it for 30 days (a deleted lead for 90 days), and is then deleted permanently and automatically. Your administrators can also delete a record there permanently at once, for example to answer an erasure request. Deleting the whole organisation keeps its 30-day grace period. Backups are still overwritten on the rotation in clause 11.3.

No sub-processor is added or replaced.

2 October 2026 — the audit trail (DPA 2.3, Pro privacy policy 2.3, Pro terms 2.2)

What the platform records about activity inside an organisation now goes further than these documents said, and they now describe it.

• Annex II, II.8 replaces two lines with what is recorded: every request that changes data and every export, download, generated document and view of audit records, with its outcome, including refused requests; changes with their values before and after, personal fields redacted in the record itself; sign-ins including failed attempts and why, with attempts on unknown addresses kept only as a keyed hash; and every AI tool call. The audit trail is now append-only in the database itself, not only in the application, and is kept 24 months (it said at least 12). Your administrators can search and export it.
• Annex II, II.5 adds that our support staff acting as one of your users are recorded as such, and your administrators see it.
• Annex I describes the audit records accordingly.
• The Pro privacy policy describes the same records about each user, says what an organisation’s administrators can see, and lengthens two retention periods: security and sign-in records and the record of AI tool requests are kept 24 months (they were 12). It adds the request log (24 months) and the operational server logs, which are overwritten as they fill.
• The Pro terms (clause 7.4) list what the audit trail holds.

No sub-processor is added or replaced.

2 October 2026 — connected services (DPA 2.2, register 2.1, Pro privacy policy 2.2, Pro terms 2.1)

These documents now cover what an organisation can connect to Intellayer. Every feature below is off until an organisation turns it on.

• Connected mailboxes and calendars. A user can now allow sending from their connected mailbox and turn on calendar sync, each a separate choice. The Pro privacy policy lists the extra Google and Microsoft permissions and what each is used for, and explains the logging choice of a personal mailbox and the forwarding and BCC addresses. It also adds the Data Assistant to the AI features that can read email previews on lead timelines, which it had left out.
• AI apps and connected services. New sections of the policy describe connecting your own AI app, which never receives mailbox or calendar data, and the services an organisation connects: accounting software, a phone system, automation tools through API keys and webhooks, and its own payment account for proposal deposits.
• DPA Annex I adds the data these bring in: email sent from a connected mailbox, synced calendar events and call records from a connected phone system, and the people who call or are called as a category of data subject. It also adds staff availability: the time off staff record, or that calendar sync copies from out-of-office events (dates and times only, never a reason).
• The sub-processor register gains a section listing the services an organisation connects. They are not sub-processors, but they are data flows, so they are listed. No sub-processor is added or replaced. Sinch Mailgun, already listed, now also receives email sent to an organisation’s forwarding and BCC logging addresses, and Anthropic, already listed, also prepares the tasks and notes a user confirms in the assistant.
• The Pro terms (clauses 7.6, 7.7 and 10) say the same from the other side: sending and calendar sync are separate choices, and your organisation answers for the AI apps, API keys and services it connects.

1 October 2026 — connected mailboxes (Pro privacy policy 2.1)

The Pro privacy policy section on connected mailboxes now describes what the mailbox sync actually does. The earlier text was wrong in three places:

• AI features. It said mailbox content reached an AI provider only when a user asked for a reply draft. Four more features can send some of it: AI steps in automation rules (automatically, when a rule for incoming email runs), follow-up suggestions (automatically, once a day), and lead briefings and lead signals (when a user asks). Each is off until enabled, and all of them use the AI sub-processor already listed in Annex III. The policy now names each one and what it sends.
• Unmatched mail. It said mail matching no record was “logged and discarded”. A mailbox set as the organisation inbox files every incoming message as a conversation, matched or not, and every processed message’s sender, recipients and subject are kept in a sync log for 12 months.
• Retention. The subjects and 200-character previews that filed emails leave on lead timelines were not deleted at 24 months along with the messages. They now are.

Support staff signed in as one of a customer’s users can no longer open inbox conversations, the sync log or data exports, and see email subjects and previews on timelines masked. The same policy’s legal-form line, missed by the 30 August correction below, now names AS Creative Technologies LTD correctly. The sub-processor register is unchanged.

30 August 2026 — DPA version 2.1

Version 2.0 committed us to fixed clocks that no law requires of a processor, and that we would rather meet in substance than miss on paper. They are replaced with the standard the GDPR itself uses.

• Breach notification to you is now “without undue delay” (clause 9.1), measured against what you actually need — notice in time to make your own Article 33 report inside your 72 hours — instead of a flat 48-hour deadline. Article 33(2) sets no clock for a processor.
• Article 17 cross-notification between the parties moves from 7 days to without undue delay (Annex IV).
• Vulnerability reports are acknowledged as soon as we reasonably can, rather than within five working days (Annex II, and the legal information page).
• Backup overwrite is described as the ordinary rotation, normally within 35 days, rather than a guarantee of 35 days (clause 11.3, Annex II).

What has not changed: the 30 days of notice before a new sub-processor and your right to object (clauses 6.3 and 6.4), the security measures themselves, the sub-processor register, and every allocation of responsibility between us.

30 August 2026 — correction to the stated contracting party

The published documents named a sole proprietorship, and a named individual, as the party you contract with. That was wrong. The operator of the Service, the Processor under this DPA and the Controller under the privacy policies is and was AS Creative Technologies LTD, a private limited liability company registered in the Republic of Cyprus, of Alamanas 50, Dali, Nicosia 2547, Cyprus.

Nothing else changed: the substantive terms, the security measures, the sub-processor register and the allocation of responsibilities are unaffected. The correction is recorded here rather than applied silently, because the identity of your counterparty is the one fact you are entitled to rely on without checking.

24 August 2026 — DPA version 2.0

A full legal review replaced the previous published summary with the agreement itself. The substantive changes:

• The DPA is now the actual Article 28 terms. Version 1.0 as published was a page describing what a DPA covers. It listed the topics — instructions, confidentiality, security, sub-processors, breach notification, deletion, audit — without containing the clauses. A description of a contract is not a contract, and Article 28(3) requires the terms themselves. Version 2.0 is the operative text, with Annexes I to IV.
• The contracting party is stated correctly. Earlier drafts described Intellayer as “a company registered in the Republic of Cyprus”. It is a sole proprietorship — a named individual trading under a business name. The party you contract with is a natural person, and every document now says so. (This entry was itself wrong. See the 30 August 2026 correction above: the operator is and was AS Creative Technologies LTD. The entry is left in place because a change history that quietly edits itself is not a record.)
• Joint controllership removed. Version 1.0 asserted that Intellayer and a Customer became joint controllers under Article 26 for data about an individual who dealt with both. On review that was the wrong analysis: the parties do not jointly determine the purposes and means of any processing. Each is an independent controller of what it holds in its own right. The practical consequence for Customers is significant — joint controllers are jointly and severally liable to data subjects under Article 82(4), so the old drafting exposed each party to the other’s failures for no corresponding benefit. Clause 3.3 now states the correct position, and clause 3.4 with Annex IV preserves an Article 26 allocation as a fallback if a regulator or court ever disagrees.
• Deletion or return is now the Customer’s choice, as Article 28(3)(g) requires. Version 1.0 provided only for deletion.
• Security claims corrected. The audit clause previously implied that a third-party security certification or audit report existed to hand over. None does. Clause 10.1 and Annex II now state plainly that there is no ISO 27001 or SOC 2 certification and no annual external penetration test, rather than letting a supplier questionnaire draw its own conclusion.
• RTO and RPO are stated as objectives, not guarantees (Annex II.3), and the password-hashing commitment is expressed as a standard rather than a specific work factor that would go stale.
• The pseudonymisation safeguard applied before AI requests is described in Annex II.1, together with an explicit statement that it is minimisation and not anonymisation — we hold the mapping, so the transmitted data remains personal data.
• New: government access requests (clause 12.5), emergency sub-processor replacement (clause 6.6), and an explicit statement that liability caps between the parties cannot and do not limit a data subject’s Article 82 rights (clause 13.2).
• Correct contact addresses. Earlier drafts used addresses at a domain that is not ours. Notices under this DPA go to [email protected], copied to [email protected].
• Annex III reconciled with reality. The published register and the DPA’s annex had drifted apart. They are now one page, and DocuSign, Cal.com, Open-Meteo, Firebase Crashlytics and Firebase Analytics — all of which were in use — appear on it.

• First issue for Intellayer. This is the first publication of a data processing agreement for Intellayer. The entries below this one record the history of the platform’s underlying data protection posture, which Intellayer inherits; they predate this product having legal documents of its own. What is genuinely new here is express treatment of the CRM vertical — in particular the processing of children’s data, in clauses 4.3 and 7 and in Annex I.

13 August 2026

• The DPA, its sub-processor register and this change history moved to intellayer.app. The paths were unchanged, so /legal/dpa/subprocessors continued to resolve as the DPA requires.
• Annex III: the Anthropic entry was widened to state that AI-assisted CRM features include reply drafting in the shared inbox. This described an existing opt-in feature more precisely; no new sub-processor was added and no data category changed.
• The Pro privacy policy gained a section on Google account data, covering the optional read-only Gmail and Microsoft 365 mailbox connection used by the shared inbox.

2 August 2026

• Annex III was reviewed and reissued in full following a data protection audit, and published at a stable URL as the DPA requires.
• Recorded that transactional and marketing email moved from SendGrid to Mailgun (EU region) in April 2026.
• Recorded that the text typeface became self-hosted rather than loaded from Google Fonts. Icon fonts remained on Google Fonts, and the migration is still open — see the sub-processor page.

2 May 2026

• Version 1.0 — first issue of the Data Processing Agreement covering Article 28 processing between the platform operator as processor and subscribing organisations as controllers.

Being told about changes

Sub-processor changes are notified to your organisation’s admin contacts 30 days in advance under clause 6.3 of the DPA, and appear here. To ask about an entry, or to raise an objection under clause 6.4: [email protected].