Data Processing Agreement

effective7 November 2026data stored inthe EU

This Data Processing Agreement (“DPA”) is between the customer that uses ChillCode (the controller, “you”) and FILIN VITALII, sole trader (egyéni vállalkozó), Hungary (the processor, “we”). It is part of the terms and applies from the moment you accept them, to personal data we process for you in sessions. It meets Article 28 of the GDPR. Print this page to PDF for your records; for a countersigned copy write to privacy@chillcode.net.

1. The processing

Subject and purposeRunning technical-interview sessions for you: showing one live view to the people in it, saving it, producing the report.
DurationWhile you use the service; each session until it is erased (7 days after its last use on Free, 30 on Team).
Data subjectsCandidates; your interviewers.
Personal dataNames typed on joining; code, text, drawings, comments, test cases and files the candidate produces; integrity signals (pastes with their first lines, time away from the tab, large instant edits); interviewers’ notes and emails; IP addresses in transit.
Special categoriesNone are needed and none should be entered.

2. What we do

  1. We process the data only on your documented instructions — these terms, and what you do in the product — unless the law requires otherwise, in which case we tell you first if we may.
  2. Everyone who can access the data is bound to confidentiality.
  3. We keep the measures on the security page in place (Article 32), and do not weaken them.
  4. We help you answer data subjects’ requests, and with impact assessments and consultations with authorities, as far as our part of the processing allows.
  5. We tell you of a personal data breach without undue delay and within 48 hours of becoming aware of it, with what we know and what we are doing.
  6. We erase session data as the retention schedule says. When you stop using the service, we erase the rest within 30 days, and it leaves backups within 7 days after that, unless the law requires us to keep it.
  7. We give you the information needed to show compliance, answer reasonable security questionnaires, and allow an audit once a year on 30 days’ notice, at your cost.

3. Subprocessors

You authorise the subprocessors on the subprocessors page. We bind each to data protection terms no weaker than these, and stay responsible for them. We announce a new one there 30 days before it starts; if you object on reasonable grounds and we cannot resolve it, you may end the service and get a refund of the prepaid period.

4. Where

Session data is stored and processed in the EU (Ireland (Supabase, AWS eu-west-1); the application in Frankfurt, Germany (Fly.io, region fra)). Where a subprocessor may access it from outside the EU, the transfer is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.

5. Other

Liability under this DPA follows the terms. If this DPA and the terms disagree about personal data, this DPA wins.