Our legal role, DPA, audit terms, policy program, and review process.
Our legal entity is Borg Collective GmbH, a German company.
Our role depends on why we handle the data.
We act as a controller for our own account, website, product, billing, safety, and support needs.
We act as a processor for business customer data that we handle only on the customer's instructions. The DPA sets out that role.
Yes. Email contact@graph.one and we will provide our DPA.
The DPA covers processor duties, security steps, service providers, transfers, help with data rights, audits, and return or deletion at the end of the service.
We do not post signed, customer-specific DPAs in public.
It includes GDPR and UK GDPR processor terms and CCPA service-provider terms.
For EEA transfers, the DPA uses the EU Standard Contractual Clauses where needed. It also includes the UK transfer addendum where that applies.
For other US state privacy laws, the DPA says we will agree any extra terms the law requires.
Yes. Our DPA gives customers information and audit rights on reasonable written request.
The standard DPA allows one audit each year unless law or a serious event calls for more. We first provide current documents and answers that may settle the review.
An audit must protect our confidential information and other customers' data, use reasonable notice, and avoid needless service disruption.
Yes. Our DPA requires reasonable help with privacy rights, security duties, DPIAs, and regulator contact.
The help depends on the processing and the information available to us. Send the request, deadline, and data or feature in scope to contact@graph.one.
We maintain written policies for access, encryption, data handling, incidents, recovery, changes, vulnerabilities, vendors, retention, and privacy.
We also keep an asset list, risk register, staff security rules, internal audit process, and corrective-action process.
These are internal working documents. Ask us for the policy summary or evidence needed for your review.
Our policies set regular risk, technical-control, document, and full security-program reviews.
The schedule calls for quarterly risk-register and policy document reviews, technical-control reviews twice a year, and a full internal security-program audit each year.
A schedule is not proof that a review happened. Ask us for the latest completed record if your assessment needs it.
Staff and contractors must accept confidentiality and security duties before they receive system access.
Our policy requires identity and professional-background checks, security onboarding, annual policy and phishing awareness, and secure-development training for developers.
The Security topic explains the access and offboarding rules that apply once someone receives system access.
We publish our privacy policy, service terms, cookie policy, and legal notice.
Email contact@graph.one.
Use the same address for a DPA, security evidence, a privacy request, a vendor review, or a security report. State your company and the document you need.
