This Data Processing Agreement ("DPA") forms part of the Terms of Service between planCoo ("Processor") and the business customer ("Controller") using our services.
1. Definitions
Terms used in this DPA have the meanings given in the GDPR (General Data Protection Regulation).
2. Processing Details
2.1 Subject Matter
Processing of personal data necessary to provide the planCoo services.
2.2 Duration
For the duration of the Terms of Service agreement.
2.3 Nature and Purpose
To provide project management and collaboration services to the Controller and its authorized users.
This may include providing access to the same planCoo service through Microsoft Teams as a client surface, including limited host-context and authentication flows needed to render the service in Teams and authenticate authorized users.
2.4 Types of Personal Data
- Basic account information (names, email addresses)
- Authentication data (email address; password credentials processed and stored by Firebase Authentication as salted/hashed values; authentication events such as sign-in timestamps and technical metadata)
- Limited Microsoft Teams / Microsoft Entra authentication and host-context data when the Controller's authorized users access planCoo through Microsoft Teams
- Profile information
- Project and task metadata
- User activity logs and technical logs (e.g. request timestamps, IP address, user agent, request identifiers, error traces)
2.5 Categories of Data Subjects
- Controller's employees and contractors
- Other individuals the Controller authorizes to use the service
2.6 Microsoft Teams Access Clarification
Where the Controller or its authorized users choose to access planCoo through Microsoft Teams, Microsoft Teams serves as an access channel to the existing planCoo service. This does not change the core roles of the parties under this DPA. planCoo continues to process personal data for the purposes described in this DPA, while Microsoft may process platform-level data under Microsoft's own terms and data protection commitments.
3. Obligations of the Processor
planCoo shall:
- Process personal data only on documented instructions from the Controller
- Ensure persons authorized to process the data have committed to confidentiality
- Implement appropriate technical and organizational security measures
- Assist the Controller in responding to data subject requests
- Assist the Controller in ensuring compliance with security obligations
- Delete or return all personal data after the end of services
- Make available information necessary to demonstrate compliance
4. Sub-processors
planCoo uses the following sub-processors:
- Microsoft Azure (hosting, storage)
- Microsoft Azure OpenAI (AI text generation for project reports, meeting briefings, and portfolio analysis)
- Firebase Authentication and reCAPTCHA (Google LLC) (authentication and abuse prevention)
- LemonSqueezy (payment processing)
- Cloudflare (DNS management and security/traffic management)
The Controller hereby provides general authorization for planCoo to engage these sub-processors.
Optional third-party integrations initiated by end users (such as LinkedIn account linking/content sharing) may involve separate third-party processing contexts and are described in Section 5.
5. International Transfers
planCoo uses a mix of EU/EEA-based storage for primary application data and global/US-based processing for certain platform services and subprocessors.
Current processing/transfer overview (factual, as currently configured):
- Microsoft Azure (primary application data and files): West Europe (Netherlands) for primary application data, including Azure SQL Database and Azure Blob Storage.
- Azure Static Web Apps (hosting/edge delivery): Resource region: East US 2 (Azure resource location, as currently configured) with globally distributed edge delivery for static content (Global).
- Telemetry and technical logs (Microsoft Azure Application Insights / Log Analytics): Not enabled (Application Insights resource has been removed; no application telemetry ingestion is configured at this time).
- Firebase Authentication (Google LLC): Global service (Google). planCoo uses email + password, email-link sign-in (“magic link”), and Google sign-in.
- Google reCAPTCHA (Google LLC): Global service (Google) used for abuse prevention on public endpoints.
- Payments/subscriptions (LemonSqueezy): US/global processing by the payment provider.
- Cloudflare (DNS/WAF): Global network processing for DNS and security/traffic management.
- Azure OpenAI (Microsoft): Azure region as configured. Data submitted for AI processing is not used to train Microsoft's AI models. Covered by Microsoft Azure DPA and Standard Contractual Clauses.
Where personal data is processed/transferred outside the EU/EEA, planCoo relies on the European Commission Standard Contractual Clauses (SCCs) and applicable vendor contractual/technical safeguards.
5.1 Firebase Authentication – concrete scope
planCoo uses Firebase Authentication as a specialized authentication service so that planCoo does not have to implement and operate custom password storage and verification. This reduces security risk and leverages a mature authentication platform.
Firebase Authentication is an established authentication provider used widely in industry, with documented security and compliance controls.
What we use (authentication methods):
- Email + password sign-in
- Email-link sign-in (“magic link”)
- Google sign-in (via Firebase Authentication)
- Microsoft sign-in (via Firebase Authentication)
Personal data processed for authentication (typical categories):
- Email address (used for account identification and for sending sign-in links)
- Password credential (handled by Firebase Authentication; planCoo does not store raw passwords)
- Firebase user identifier (UID)
- For Google sign-in: provider identifier and basic profile attributes returned by the provider (typically name, email, profile picture)
- For Microsoft sign-in: provider identifier and basic profile attributes returned by the provider (typically name, email, profile picture)
- Authentication events/metadata (e.g. sign-in time, IP address and device/browser information used for security and fraud prevention)
Why this processing happens: to verify user identity, issue/validate authentication tokens, and secure access to the planCoo service.
5.2 Realtime Chat – concrete scope
planCoo provides a realtime chat feature to facilitate collaboration between users.
Service Provider & Location:
- Firebase Realtime Database & Firestore (Google Cloud)
- Region: europe-west1 (Belgium). All chat data is stored and processed exclusively within the EU/EEA.
Data Processed:
- Chat messages (text content)
- Metadata (timestamps, sender UID, participant UIDs)
Security Measures:
- Strict Access Control: Database rules enforce that only the specific participants in a conversation can read or write messages.
- Encryption: Data is encrypted in transit (HTTPS/TLS) and at rest.
- Data Minimization: Chat data is managed through access controls and account/data deletion workflows in the service.
5.3 Telemetry and operational logging – concrete scope
To operate and secure the service, planCoo (and relevant infrastructure providers) may process limited technical and operational data such as:
- Request metadata (timestamps, URL path, response status codes)
- Network identifiers (IP address)
- Device/browser information (user agent)
- Diagnostics and error traces
planCoo aims to minimize personal data in logs and uses redaction/pseudonymization where practical (e.g. not logging authentication tokens and avoiding logging full request bodies by default).
5.4 Sub-processor compliance (concrete controls)
planCoo uses the following concrete measures to maintain GDPR compliance when using subprocessors:
- Contractual governance: We maintain DPAs (and SCCs where applicable) with subprocessors that process personal data.
- Purpose limitation: Subprocessors are used for narrowly defined purposes (hosting, authentication, payments, security) and not for unrelated processing.
- Data minimization: We minimize the personal data sent to subprocessors and avoid sending sensitive payloads where not necessary (e.g. do not log auth tokens; avoid logging full request bodies by default).
- Access control: Access to production systems and operational tooling is restricted by role and least privilege.
- Security measures: TLS in transit, encryption at rest where supported, and standard security controls from infrastructure providers.
5.5 LinkedIn account linking and sharing (optional)
planCoo offers optional LinkedIn features (account linking/verification and user-initiated sharing).
When this applies: only if an authorized user explicitly initiates LinkedIn linking or sharing.
Typical data categories involved: LinkedIn account identifier (sub), basic profile attributes returned by LinkedIn (typically name, email, profile image), LinkedIn profile URL, and content the user chooses to publish.
Token handling: LinkedIn OAuth access tokens are used on-demand for requested operations and are not stored persistently by planCoo.
Role of LinkedIn: For user-initiated posting/linking, LinkedIn may act as an independent controller for data processed in its platform according to LinkedIn's terms and privacy documentation.
5.6 Azure OpenAI – concrete scope
planCoo uses Microsoft Azure OpenAI to power AI-assisted features available to authenticated users, including project report generation, meeting briefings, and portfolio analysis.
Service Provider & Authentication:
- Microsoft Azure OpenAI (Microsoft Corporation)
- Authentication: API key stored as a server-side environment variable in Azure Functions. The API key is never transmitted to or accessible from the user's browser. All AI calls are made exclusively server-to-server.
What triggers processing:
AI features are user-initiated. Processing only occurs when a logged-in user explicitly requests an AI-generated report or briefing (e.g. clicks "Generate report"). No background or automatic AI processing of personal data occurs.
Data categories transmitted to Azure OpenAI:
- Project titles, descriptions, and status information
- Task names and completion status
- Team member display names and roles within the project context
- Meeting titles and agenda content (for meeting briefings)
Data categories NOT transmitted to Azure OpenAI:
- Email addresses, passwords, or authentication tokens
- Payment or subscription data
- Private messages or chat content
- Firebase UIDs or internal system identifiers
Microsoft's data use obligations:
Under the Microsoft Azure OpenAI terms of service, Microsoft does not use inputs or outputs from planCoo's Azure OpenAI resource to train, retrain, or improve Microsoft's AI models. Microsoft may retain inputs and outputs for up to 30 days solely for safety and abuse monitoring, after which they are deleted.
Legal basis for processing: Contractual necessity (providing the AI feature the user has explicitly requested).
Azure region: Sweden Central (EU/EEA). No transfer outside the EU/EEA for AI processing.
International transfer safeguards: Microsoft Azure DPA and Standard Contractual Clauses (SCCs) as issued by the European Commission.
6. Security Measures
planCoo implements appropriate technical and organizational security measures including:
6.1 Authentication & Access Control
- Authentication via Firebase Authentication (email + password, email-link sign-in “magic link”, Google sign-in, and Microsoft sign-in)
- Role-based access control for system resources
- Token-based authentication using short-lived Firebase ID tokens for API access
6.2 Data Storage Security
- Data encryption at rest in Azure SQL Database
- Transparent Data Encryption (TDE) for database protection
- Azure Blob Storage with encryption for file content
6.3 Data Transmission Security
- HTTPS/TLS encryption for all data in transit
- Secure API endpoints with proper authentication
- Time-limited Shared Access Signatures (SAS) for blob storage access
- Secure webhook implementation with signature verification
- SSL/TLS termination and optimization through Cloudflare
6.4 Application Security
- Regular security updates and patch management
- Input validation and output encoding to prevent injection attacks
- Protection against common web vulnerabilities (XSS, CSRF)
- Secure development practices and code reviews
- Content Security Policy (CSP) implementation restricting resource origins
- Browser security headers (X-XSS-Protection, X-Content-Type-Options)
6.5 Infrastructure Security
- Hosting on Microsoft Azure (cloud infrastructure security and access controls)
- DDoS protection through both Azure services and Cloudflare
- Cloudflare Web Application Firewall (WAF)
- Access controls for operational systems
6.6 Operational Security
- Operational monitoring and troubleshooting using telemetry and technical logs (see Section 5.3)
6.7 Organizational Measures
- Access provided on a need-to-know basis
- Documented internal policies and review cadence (where established)
6.8 Third-Party Security
- Contractual requirements for subprocessors (DPAs, and SCCs where applicable)
Annex A — Processing details (summary)
- Subject matter: Provision of planCoo services.
- Duration: For the term of the services.
- Nature and purpose: Project management and collaboration features, account administration, security and abuse prevention.
- Categories of data subjects: Authorized users of the Controller.
- Types of personal data: As listed in Section 2.4.
Note on marketing and sales inquiry data: Personal data collected through the Microsoft Azure Marketplace "Contact me" form (prospective customer inquiries) is processed by planCoo as an independent Data Controller for its own sales and business development purposes. This data is not processed on behalf of a Controller within the scope of this DPA. Retention and processing of such data is described in planCoo's Privacy Policy (Section 3.4 and 9.1).
Annex B — Subprocessors (summary)
planCoo uses the subprocessors listed in Section 4 for the purposes described below:
- Microsoft Azure: Hosting, application data storage (Azure SQL Database, Blob Storage), and platform delivery (Static Web Apps).
- Google LLC (Firebase Authentication, reCAPTCHA): Authentication and abuse prevention.
- LinkedIn (optional, user-initiated integration): Account linking/verification metadata and user-initiated social publishing.
- LemonSqueezy: Payment and subscription processing.
- Cloudflare: DNS and security/traffic management.
7. Contact Information
For DPA matters, contact: [email protected]
Last updated: June 8, 2026