Data Processing Addendum

Operator and roles

inteora is operated by ByteFlow, a company based in Bulgaria. This Data Processing Addendum applies where inteora processes personal data in customer content on behalf of a business customer.

The customer remains responsible for deciding what content is uploaded, who may access it, and whether there is a lawful basis for processing and sharing it.

Processing details

The processing relates to workspaces, project review pages, uploaded assets, comments, notifications, access controls, support, security, and service reliability.

Data subjects may include customer users, workspace members, client reviewers, commenters, support contacts, and people whose personal data appears in customer content.

Customer instructions

inteora processes customer content to provide, secure, support, maintain, and improve the service, and to comply with applicable law. Customers are responsible for ensuring their instructions are lawful.

Confidentiality and security

Personnel or contractors with access to customer content must be subject to confidentiality obligations. Access is limited to service operation, support, security, abuse prevention, legal compliance, or customer instructions.

inteora maintains technical and organizational measures designed to protect customer content, including authenticated dashboard access, access controls, password-protected review links, signed file URLs, backups, monitoring, and incident response processes.

Subprocessors

Customer authorizes inteora to use subprocessors needed to provide the service. Current providers are summarized on the Subprocessors page . inteora remains responsible for subprocessors as required by applicable data protection law and the applicable agreement.

International transfers

Some providers may process information outside Bulgaria or the European Economic Area. Where required, international transfers rely on appropriate safeguards.

Assistance

Taking into account the nature of the service, inteora will provide reasonable assistance with data subject requests, security inquiries, data protection impact assessments, and supervisory authority consultations where required and where the customer cannot reasonably handle the request without inteora.

Breach notification

inteora will investigate suspected personal data breaches affecting customer content and notify affected business customers without undue delay after confirming a breach where required.

Deletion or return

After termination or a verified deletion request, inteora will delete or return customer content according to service functionality, written instructions, legal obligations, and backup processes. Billing, tax, security, and legal records may be retained separately where required.

Contact

Questions about this DPA can be sent to support@inteora.com .