This Data Processing Agreement ("DPA") forms part of the Terms of Service between planCoo ("Processor") and the business customer ("Controller") using our services.
1. Definitions
Terms used in this DPA have the meanings given in the GDPR (General Data Protection Regulation).
2. Processing Details
2.1 Subject Matter
Processing of personal data necessary to provide the planCoo services.
2.2 Duration
For the duration of the Terms of Service agreement.
2.3 Nature and Purpose
To provide project management and collaboration services to the Controller and its authorized users.
This may include providing access to the same planCoo service through Microsoft Teams as a client surface, including limited host-context and authentication flows needed to render the service in Teams and authenticate authorized users.
2.4 Types of Personal Data
- Basic account information (names, email addresses)
- Authentication data (email address; password credentials processed and stored by Firebase Authentication as salted/hashed values; authentication events such as sign-in timestamps and technical metadata)
- Limited Microsoft Teams / Microsoft Entra authentication and host-context data when the Controller's authorized users access planCoo through Microsoft Teams
- Profile information
- Project and task metadata, names and descriptions, including personal data in free-text content and cached translations
- User activity logs and technical logs (e.g. request timestamps, IP address, user agent, request identifiers, error traces)
2.5 Categories of Data Subjects
- Controller's employees and contractors
- Other individuals the Controller authorizes to use the service
2.6 Microsoft Teams Access Clarification
Where the Controller or its authorized users choose to access planCoo through Microsoft Teams, Microsoft Teams serves as an access channel to the existing planCoo service. This does not change the core roles of the parties under this DPA. planCoo continues to process personal data for the purposes described in this DPA, while Microsoft may process platform-level data under Microsoft's own terms and data protection commitments.
3. Obligations of the Processor
planCoo shall:
- Process personal data only on documented instructions from the Controller
- Ensure persons authorized to process the data have committed to confidentiality
- Implement appropriate technical and organizational security measures
- Assist the Controller in responding to data subject requests
- Assist the Controller in ensuring compliance with security obligations
- Delete or return all personal data after the end of services
- Make available information necessary to demonstrate compliance
4. Sub-processors
planCoo uses the following sub-processors:
- Microsoft Azure (hosting, storage)
- Microsoft Azure OpenAI (AI text generation for project reports, meeting briefings, and portfolio analysis)
- Microsoft Azure Translator (optional machine translation of project and task text; see Section 5.7)
- Firebase Authentication and reCAPTCHA (Google LLC) (authentication and abuse prevention)
- LemonSqueezy (payment processing)
- Cloudflare (DNS management and security/traffic management)
The Controller hereby provides general authorization for planCoo to engage these sub-processors.
Optional third-party integrations initiated by end users (such as LinkedIn account linking/content sharing) may involve separate third-party processing contexts and are described in Section 5.
5. International Transfers
planCoo uses a mix of EU/EEA-based storage for primary application data and global/US-based processing for certain platform services and subprocessors.
Current processing/transfer overview (factual, as currently configured):
- Microsoft Azure (primary application data and files): West Europe (Netherlands) for primary application data, including Azure SQL Database and Azure Blob Storage.
- Azure Static Web Apps (hosting/edge delivery): Resource region: East US 2 (Azure resource location, as currently configured) with globally distributed edge delivery for static content (Global).
- Telemetry and technical logs (Microsoft Azure Application Insights / Log Analytics): Not enabled (Application Insights resource has been removed; no application telemetry ingestion is configured at this time).
- Firebase Authentication (Google LLC): Global service (Google). planCoo uses email + password, email-link sign-in (“magic link”), and Google sign-in.
- Google reCAPTCHA (Google LLC): Global service (Google) used for abuse prevention on public endpoints.
- Payments/subscriptions (LemonSqueezy): US/global processing by the payment provider.
- Cloudflare (DNS/WAF): Global network processing for DNS and security/traffic management.
- Azure OpenAI (Microsoft): Azure region as configured. Data submitted for AI processing is not used to train Microsoft's AI models. Covered by Microsoft Azure DPA and Standard Contractual Clauses.
Where personal data is processed/transferred outside the EU/EEA, planCoo relies on the European Commission Standard Contractual Clauses (SCCs) and applicable vendor contractual/technical safeguards.
5.1 Firebase Authentication – concrete scope
planCoo uses Firebase Authentication as a specialized authentication service so that planCoo does not have to implement and operate custom password storage and verification. This reduces security risk and leverages a mature authentication platform.
Firebase Authentication is an established authentication provider used widely in industry, with documented security and compliance controls.
What we use (authentication methods):
- Email + password sign-in
- Email-link sign-in (“magic link”)
- Google sign-in (via Firebase Authentication)
- Microsoft sign-in (via Firebase Authentication)
Personal data processed for authentication (typical categories):
- Email address (used for account identification and for sending sign-in links)
- Password credential (handled by Firebase Authentication; planCoo does not store raw passwords)
- Firebase user identifier (UID)
- For Google sign-in: provider identifier and basic profile attributes returned by the provider (typically name, email, profile picture)
- For Microsoft sign-in: provider identifier and basic profile attributes returned by the provider (typically name, email, profile picture)
- Authentication events/metadata (e.g. sign-in time, IP address and device/browser information used for security and fraud prevention)
Why this processing happens: to verify user identity, issue/validate authentication tokens, and secure access to the planCoo service.
5.2 Realtime Chat – concrete scope
planCoo provides a realtime chat feature to facilitate collaboration between users.
Service Provider & Location:
- Firebase Realtime Database & Firestore (Google Cloud)
- Region: europe-west1 (Belgium). All chat data is stored and processed exclusively within the EU/EEA.
Data Processed:
- Chat messages (text content)
- Metadata (timestamps, sender UID, participant UIDs)
Security Measures:
- Strict Access Control: Database rules enforce that only the specific participants in a conversation can read or write messages.
- Encryption: Data is encrypted in transit (HTTPS/TLS) and at rest.
- Data Minimization: Users can remove a conversation from their own inbox. Account deletion removes remaining chat data.
5.3 Telemetry and operational logging – concrete scope
To operate and secure the service, planCoo (and relevant infrastructure providers) may process limited technical and operational data such as:
- Request metadata (timestamps, URL path, response status codes)
- Network identifiers (IP address)
- Device/browser information (user agent)
- Diagnostics and error traces
planCoo aims to minimize personal data in logs and uses redaction/pseudonymization where practical (e.g. not logging authentication tokens and avoiding logging full request bodies by default).
5.4 Sub-processor compliance (concrete controls)
planCoo uses the following concrete measures to maintain GDPR compliance when using subprocessors:
- Contractual governance: We maintain DPAs (and SCCs where applicable) with subprocessors that process personal data.
- Purpose limitation: Subprocessors are used for narrowly defined purposes (hosting, authentication, payments, security) and not for unrelated processing.
- Data minimization: We minimize the personal data sent to subprocessors and avoid sending sensitive payloads where not necessary (e.g. do not log auth tokens; avoid logging full request bodies by default).
- Access control: Access to production systems and operational tooling is restricted by role and least privilege.
- Security measures: TLS in transit, encryption at rest where supported, and standard security controls from infrastructure providers.
5.5 LinkedIn account linking and sharing (optional)
planCoo offers optional LinkedIn features (account linking/verification and user-initiated sharing).
When this applies: only if an authorized user explicitly initiates LinkedIn linking or sharing.
Typical data categories involved: LinkedIn account identifier (sub), basic profile attributes returned by LinkedIn (typically name, email, profile image), LinkedIn profile URL, and content the user chooses to publish.
Token handling: LinkedIn OAuth access tokens are used on-demand for requested operations and are not stored persistently by planCoo.
Role of LinkedIn: For user-initiated posting/linking, LinkedIn may act as an independent controller for data processed in its platform according to LinkedIn's terms and privacy documentation.
5.6 Azure OpenAI – concrete scope
planCoo uses Microsoft Azure OpenAI to power AI-assisted features available to authenticated users, including project report generation, meeting briefings, and portfolio analysis.
Service Provider & Authentication:
- Microsoft Azure OpenAI (Microsoft Corporation)
- Authentication: API key stored as a server-side environment variable in Azure Functions. The API key is never transmitted to or accessible from the user's browser. All AI calls are made exclusively server-to-server.
What triggers processing:
AI features are user-initiated. Processing only occurs when a logged-in user explicitly requests an AI-generated report or briefing (e.g. clicks "Generate report"). No background or automatic AI processing of personal data occurs.
Data categories transmitted to Azure OpenAI:
- Project titles, descriptions, and status information
- Task names and completion status
- Team member display names and roles within the project context
- Meeting titles and agenda content (for meeting briefings)
Data categories NOT transmitted to Azure OpenAI:
- Email addresses, passwords, or authentication tokens
- Payment or subscription data
- Private messages or chat content
- Firebase UIDs or internal system identifiers
Microsoft's data use obligations:
Under the Microsoft Azure OpenAI terms of service, Microsoft does not use inputs or outputs from planCoo's Azure OpenAI resource to train, retrain, or improve Microsoft's AI models. Microsoft may retain inputs and outputs for up to 30 days solely for safety and abuse monitoring, after which they are deleted.
Legal basis for processing: Contractual necessity (providing the AI feature the user has explicitly requested).
Azure region: Sweden Central (EU/EEA). No transfer outside the EU/EEA for AI processing.
International transfer safeguards: Microsoft Azure DPA and Standard Contractual Clauses (SCCs) as issued by the European Commission.
5.7 Azure Translator – optional project text translation
At an authorized user's request, planCoo sends project and task names and descriptions to Microsoft Azure Translator for machine translation into the selected language. These free-text fields may contain personal data entered by the Controller or its users. Account credentials, payment records and participant identifiers are not included as separate translation inputs. This feature does not translate uploaded documents, feeds, comments or private chat messages.
Requests are made server-to-server over HTTPS after project access checks. Original text remains unchanged and is used for editing; translations are labelled as machine-generated, with the original as the authoritative version. Existing translations can be displayed automatically in the user's interface language. Cache-only lookups do not send text to Translator; new external translations require an explicit translation request.
Microsoft's handling of submitted text: Microsoft's Translator data, privacy and security documentation states that Text Translation does not store submitted customer content. Microsoft's Translator No Trace policy states that submitted translation text is not written to persistent storage or used for training. These statements concern Translator's handling of submitted content, not planCoo's own storage or all service operational metadata. planCoo does not upload training or adaptive reference datasets through this feature.
Processing location and contractual safeguards: The configured Foundry resource is in Sweden Central. Resource location alone does not establish the location where every translation request is processed. The feature currently uses the Text Translation preview API; this DPA does not represent that translation processing is restricted to Sweden or the EU/EEA. Applicable Microsoft service and preview terms govern the service, and the international-transfer safeguards in Section 5 apply where processing occurs outside the EU/EEA.
planCoo's storage and retention: Translations are stored in the application's Azure SQL database to reuse results for authorized users. The shared cache is keyed by source-text hash, target language and translation version, rather than project identity. Text changes create new cache entries; older entries are not automatically deleted on editing. Usage records contain project, company and requesting-user identifiers, target language, text counts, character counts and timestamps, rather than source text. A cleanup procedure exists, but scheduled cache cleanup is not currently enabled. Deletion and return obligations under Section 3 also apply to personal data in cached translations and usage records; automatic project-specific cache deletion is not currently implemented.
6. Security Measures
planCoo implements appropriate technical and organizational security measures including:
6.1 Authentication & Access Control
- Authentication via Firebase Authentication (email + password, email-link sign-in “magic link”, Google sign-in, and Microsoft sign-in)
- Role-based access control for system resources
- Token-based authentication using short-lived Firebase ID tokens for API access
6.2 Data Storage Security
- Data encryption at rest in Azure SQL Database
- Transparent Data Encryption (TDE) for database protection
- Azure Blob Storage with encryption for file content
6.3 Data Transmission Security
- HTTPS/TLS encryption for all data in transit
- Secure API endpoints with proper authentication
- Time-limited Shared Access Signatures (SAS) for blob storage access
- Secure webhook implementation with signature verification
- SSL/TLS termination and optimization through Cloudflare
6.4 Application Security
- Regular security updates and patch management
- Input validation and output encoding to prevent injection attacks
- Protection against common web vulnerabilities (XSS, CSRF)
- Secure development practices and code reviews
- Content Security Policy (CSP) implementation restricting resource origins
- Browser security headers (X-XSS-Protection, X-Content-Type-Options)
6.5 Infrastructure Security
- Hosting on Microsoft Azure (cloud infrastructure security and access controls)
- DDoS protection through both Azure services and Cloudflare
- Cloudflare Web Application Firewall (WAF)
- Access controls for operational systems
6.6 Operational Security
- Operational monitoring and troubleshooting using telemetry and technical logs (see Section 5.3)
6.7 Organizational Measures
- Access provided on a need-to-know basis
- Documented internal policies and review cadence (where established)
6.8 Third-Party Security
- Contractual requirements for subprocessors (DPAs, and SCCs where applicable)
Annex A — Processing details (summary)
- Subject matter: Provision of planCoo services.
- Duration: For the term of the services.
- Nature and purpose: Project management and collaboration features, account administration, security and abuse prevention.
- Categories of data subjects: Authorized users of the Controller.
- Types of personal data: As listed in Section 2.4.
Note on marketing and sales inquiry data: Personal data collected through the Microsoft Azure Marketplace "Contact me" form (prospective customer inquiries) is processed by planCoo as an independent Data Controller for its own sales and business development purposes. This data is not processed on behalf of a Controller within the scope of this DPA. Retention and processing of such data is described in planCoo's Privacy Policy (Section 3.4 and 9.1).
Annex B — Subprocessors (summary)
planCoo uses the subprocessors listed in Section 4 for the purposes described below:
- Microsoft Azure: Hosting, application data storage (Azure SQL Database, Blob Storage), and platform delivery (Static Web Apps).
- Microsoft Azure Translator: Optional project and task text translation as described in Section 5.7.
- Google LLC (Firebase Authentication, reCAPTCHA): Authentication and abuse prevention.
- LinkedIn (optional, user-initiated integration): Account linking/verification metadata and user-initiated social publishing.
- LemonSqueezy: Payment and subscription processing.
- Cloudflare: DNS and security/traffic management.
7. Contact Information
For DPA matters, contact: [email protected]
Last updated: October 30, 2026