Draft for legal counsel review - not yet in force.
Last updated: July 2026
This Data Processing Agreement ("DPA") forms part of, and is incorporated by reference into, the BizKard Terms of Service (the "Agreement") between the customer identified in the Agreement ("Customer") and Emelum OÜ, registry code 17234831, Nõmme tn 30, Kärdla linn, Hiiumaa vald, 92412, Estonia ("Emelum"), operating the BizKard platform (the "Service"). It takes effect upon Customer's acceptance of the Agreement; no separate signature is required. This DPA is primarily relevant to Business Users, including organizations operating team workspaces; it applies to any Customer for whom Emelum processes personal data as processor. In case of conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails.
Terms such as "personal data", "processing", "controller", "processor", "data subject", "personal data breach", and "supervisory authority" have the meanings given in the GDPR.
2.1 Customer as controller, Emelum as processor. For personal data contained in Customer Data, Customer is the controller (or, where Customer acts on behalf of another controller, a processor, in which case Emelum is a subprocessor) and Emelum is the processor. This DPA is the contract required by Article 28(3) GDPR.
2.2 Emelum as independent controller for Account Data. Emelum processes Account Data (billing, authentication, usage, support, security) as an independent controller for its own legitimate business purposes, as described in the BizKard Privacy Policy. Account Data is outside the scope of this DPA.
2.3 Details of processing. The subject matter, duration, nature and purposes of processing, the categories of personal data, and the categories of data subjects are set out in Annex A.
2.4 Customer instructions. The Agreement, this DPA, and Customer's configuration and use of the Service (including which cards are published, which leads are captured and exported, and which external tools Customer authorizes) constitute Customer's complete documented instructions. Where Customer authorizes an external tool or AI assistant to access its workspace data (including Lead Data) through the Service's OAuth-protected API/MCP endpoint, the access and processing performed at that tool's request constitute Customer's documented instructions, and Customer is responsible for the tools it authorizes and for revoking access it no longer wants. Additional instructions require the parties' prior written agreement.
3.1 Customer is responsible for the accuracy, quality, and lawfulness of Customer Data and the means by which Customer acquired it, including establishing a valid lawful basis for each Lead collected through the Service and for every communication Customer sends, and providing any notices required of Customer as controller.
3.2 Customer warrants that it has provided all notices and obtained all rights, consents, and permissions required by Data Protection Laws for Emelum to process Customer Data as contemplated by the Agreement, including in respect of team members whose cards Customer creates and manages. Emelum obtains no consents and provides no notices on Customer's behalf.
3.3 Customer will not instruct Emelum to process personal data in violation of Data Protection Laws, will not upload special categories of personal data (Article 9 GDPR), data relating to criminal convictions (Article 10 GDPR), or data of children as Customer Data, and will not use the Service to make decisions about individuals that produce legal or similarly significant effects.
Emelum will:
4.1 Process on instructions only. Process Customer Data only on Customer's documented instructions (Section 2.4), including with regard to international transfers, unless required to do otherwise by EU or Member State law, in which case Emelum will inform Customer of that legal requirement before processing, unless the law prohibits this. Emelum will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws.
4.2 Confidentiality. Ensure that all persons authorized to process Customer Data are bound by contractual or statutory obligations of confidentiality. Emelum staff access to Customer Data is limited to what is necessary to provide, support, and secure the Service, and administrative access is logged (see Annex B).
4.3 Security. Implement and maintain the technical and organizational measures set out in Annex B, and any further measures required by Article 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing. Emelum may update Annex B from time to time, provided the updates do not materially reduce the overall level of protection.
4.4 No sale. Not sell Customer Data, not retain, use, or disclose it for any purpose other than providing the Service under the Agreement, and not use Customer Data to train AI models.
5.1 General authorization. Customer grants Emelum a general written authorization (Article 28(2) GDPR) to engage the Subprocessors listed on the BizKard [Subprocessor List](./06-Subprocessor-List.md) (Annex C, published at the Service and maintained as a live page).
5.2 Change notice. Emelum will give Customer at least 30 days' advance notice of the addition or replacement of any Subprocessor, by updating the Subprocessor List and notifying subscribed customers by email. Customers can subscribe to change notifications as described on the Subprocessor List page.
5.3 Objection right. Customer may object to a new Subprocessor on reasonable, documented data protection grounds within 30 days of notice, by writing to privacy@bizkard.me. The parties will work in good faith to resolve the objection. If no resolution is found within 30 days of the objection, Customer may terminate the affected part of the Service on written notice and receive a pro-rata refund of prepaid fees for the unused portion of the affected Service.
5.4 Flow-down and liability. Emelum will impose on each Subprocessor, by written contract, data protection obligations that are substantially similar to and no less protective than those in this DPA, including appropriate transfer safeguards, and remains fully liable to Customer for the performance of each Subprocessor's obligations.
6.1 Taking into account the nature of the processing, Emelum will assist Customer, by appropriate technical and organizational measures and insofar as possible, in fulfilling Customer's obligation to respond to data subject requests under Chapter III GDPR (access, rectification, erasure, restriction, portability, objection). Given the self-service nature of the Service, this assistance may be satisfied by the Service's built-in features: search, vCard export of contacts, CSV export of analytics, correction, unpublishing of cards, and deletion of individual leads and cards. Account-level and workspace-level deletion are performed by Emelum on written request (Section 9).
6.2 If a data subject request concerning Customer Data is made directly to Emelum (for example by a lead whose details Customer captured, or a team member whose card Customer manages), Emelum will not respond substantively on Customer's behalf (except to direct the data subject to Customer or as required by law) and will forward the request to Customer within 5 business days of identifying that it concerns Customer's account or workspace.
Taking into account the nature of the processing and the information available to Emelum, Emelum will provide reasonable assistance to Customer in ensuring compliance with Customer's obligations under Articles 32 to 36 GDPR, including security of processing, personal data breach notification to supervisory authorities and data subjects, data protection impact assessments, and prior consultation. Emelum may charge reasonable fees for assistance that materially exceeds the standard features of the Service, and will notify Customer of anticipated fees in advance.
8.1 Emelum will notify Customer without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting Customer Data. Notification will be sent to Customer's designated administrator email.
8.2 The notification will describe, to the extent then known: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed to address the breach, and a contact point. Emelum will provide updates as further information becomes available and will reasonably cooperate with Customer's own notification obligations.
8.3 Emelum's notification of a breach is not an acknowledgement of fault or liability.
9.1 During the term, Customer can export contacts using the Service's vCard export and analytics using CSV export, and can delete Customer Data by deleting the relevant cards and leads in-product. Deletion of an entire workspace or account is performed by Emelum on Customer's written request to privacy@bizkard.me; in-product workspace and account deletion is not currently available.
9.2 Upon termination or expiry of the Agreement, Emelum will, at Customer's choice, return Customer Data in a commonly used electronic format (export available for 30 days after termination, per the Agreement) or delete it, and will in any event delete all remaining Customer Data within 90 days of termination, except where EU or Member State law requires continued storage, in which case Emelum will protect the data and cease all other processing. Residual copies in encrypted backups are deleted in the ordinary course of the backup rotation cycle.
10.1 Emelum will make available to Customer all information reasonably necessary to demonstrate compliance with Article 28 GDPR, including summaries of third-party security assessments and, when available, SOC-type or equivalent audit reports, which the parties agree will normally satisfy Customer's audit needs.
10.2 Where such reports are insufficient to demonstrate compliance, Customer (or an independent auditor mandated by Customer and not a competitor of Emelum, bound by confidentiality) may audit Emelum's compliance with this DPA no more than once per 12-month period, on at least 30 days' written notice, during business hours, in a manner that does not disrupt Emelum's operations or compromise other customers' data, and at Customer's cost, including reimbursement of Emelum's reasonable time at its then-current professional services rates. Audit outputs are Emelum's confidential information.
10.3 Nothing in this Section limits any audit right mandated by a supervisory authority or by the SCCs.
11.1 Customer acknowledges that Emelum's hosting infrastructure and several Subprocessors are located in the United States and that providing the Service may involve transfers of Customer Data outside the EEA.
11.2 For transfers of Customer Data from the EEA to countries without an adequacy decision, the parties hereby incorporate the SCCs into this DPA as follows: Module Two (controller to processor) applies where Customer is a controller, and Module Three (processor to processor) applies where Customer is a processor; Clause 7 (docking) is not included; Clause 9(a) Option 2 (general authorization) applies with the notice period in Section 5.2; Clause 11(a) optional language is not included; Clauses 17 and 18: the SCCs are governed by Estonian law and disputes are resolved before the courts of Estonia; the competent supervisory authority under Clause 13 is the Estonian Data Protection Inspectorate. Annexes I, II, and III of the SCCs are populated by Annex A, Annex B, and Annex C of this DPA respectively.
11.3 Onward transfers by Emelum to Subprocessors outside the EEA are protected by SCCs (Module Three) or, where the recipient holds a current certification under the EU-US Data Privacy Framework, by that framework, with SCCs as fallback. Transfers from the UK are covered by the UK International Data Transfer Addendum to the SCCs, and transfers from Switzerland by the Swiss adaptations, in each case applied mutatis mutandis.
11.4 In case of conflict between this DPA and the SCCs, the SCCs prevail.
Each party's liability arising out of or related to this DPA, including the SCCs to the extent permitted, is subject to the exclusions and limitations of liability set out in the Agreement. Nothing in this Section limits either party's liability to data subjects under the GDPR or the SCCs.
13.1 This DPA applies for as long as Emelum processes Customer Data and survives termination of the Agreement until all Customer Data is deleted or returned under Section 9.
13.2 Emelum may update this DPA where required by changes in Data Protection Laws, regulator guidance, or approved transfer mechanisms, or to reflect changes in the Service, provided updates do not materially reduce the protection of Customer Data; material changes will be notified in accordance with the Agreement.
13.3 This DPA is governed by the law governing the Agreement (Estonian law), except where the SCCs require otherwise. Notices under this DPA go to Customer's administrator email and to Emelum at legal@bizkard.me (privacy matters: privacy@bizkard.me).
Subject matter. Provision of the BizKard platform: hosting and publication of digital business cards, capture and storage of leads (card-page submissions, scanned business cards, voice captures, imports, and consent-gated visitor identification), contact management, enrichment, and export, generation of follow-up message drafts for Customer (the Service does not send messages to leads), card view analytics for Customer, and related storage, backup, and support.
Duration. The term of the Agreement plus the deletion period in Section 9.
Nature and purposes of processing. Collection (via Customer's card pages, Customer-initiated scans of physical business cards, Customer voice notes, Customer imports, and, with visitor consent where required, third-party visitor identification), AI-assisted text extraction from scanned card images and voice recordings (via the Lovable AI Gateway using Google Gemini and OpenAI models; images and recordings are processed transiently and not stored), enrichment, storage, structuring, display (public display of Card Data on card pages published at Customer's instruction), retrieval, export (vCard and CSV files), generation of template-based follow-up message drafts (the Service does not send messages to leads), access by external tools authorized by Customer through the OAuth-protected API/MCP endpoint, backup, and deletion. All processing occurs to provide and secure the Service under the Agreement.
Categories of personal data.
Categories of data subjects. Customer's employees, contractors, and team members whose cards are created or managed in the Service; leads: individuals who submit their contact details through Customer's card pages, whose physical business cards Customer scans, whose details Customer records by voice note or import, or who are identified by the visitor identification service on Customer's card pages; visitors of Customer's public card pages.
Frequency. Continuous, for the duration of the Agreement.
Measures below were verified against the BizKard codebase in July 2026; re-verify before publication and after material infrastructure changes.
| Domain | Measures |
|---|---|
| Tenant isolation | Logical separation of customer accounts and workspaces; database access scoped to the authenticated user's identity and team role through row-level security policies on customer-data tables, with automated regression tests |
| Encryption | Encryption in transit (TLS/HTTPS for all connections); encryption at rest for the managed database and object storage provided by the hosting platform (scanned card images and voice recordings are processed transiently and not stored) |
| Access control | Role-based access (workspace owner, admin, manager, member roles); least-privilege access for Emelum personnel; email verification for accounts; server-side authorization checks in backend functions |
| Administrative access | Restricted administrative access via a dedicated server-side roles system; platform-level audit logging of administrative actions provided by the hosting provider |
| Logging | Logs of user and administrative actions; email send logs; card interaction event logs |
| Backups and resilience | Managed cloud infrastructure with provider-level redundancy and regular automated backups by the hosting provider |
| Secure development | Secrets managed via environment configuration, not source code; dependency and platform updates via managed hosting |
| Personnel | Confidentiality obligations for all personnel with data access; access limited to support, security, billing, and legal purposes |
| Subprocessor management | Written data protection terms with all Subprocessors; transfer safeguards per Section 11; periodic review of Subprocessor security posture |
| Incident response | Breach detection, escalation, and notification process supporting the 72-hour commitment in Section 8 |
The authorized Subprocessors, including each Subprocessor's function, the categories of data processed, and processing location, are listed on the BizKard [Subprocessor List](./06-Subprocessor-List.md), available at the Service (published at bizkard.me) and incorporated into this DPA by reference. Changes are governed by Section 5.