Schedule Demo

Data Processing Agreement

Last updated: August 2026

This agreement ("DPA") governs personal data that DatMig processes on your behalf when you migrate data between platforms. It forms part of our Terms of Service and applies automatically from the moment you use DatMig to migrate data containing personal data; no signature is required. If your organisation requires a countersigned copy, email support@datmig.com.

It is made between you (the "Customer", acting as controller) and DatMig, a registered business name of Photonic Wave Analyses Limited, a private limited company registered in Ireland under company number 810165, whose principal place of business is Rivers, Castletroy, Limerick, V94 C010, Ireland ("DatMig", acting as processor). Terms such as "controller", "processor", "personal data", "processing", "personal data breach" and "supervisory authority" have the meanings given in the GDPR.

1. Roles

You are the controller of the personal data contained in the data you migrate. You determine what data is migrated, its source and target platforms, and how it is mapped. DatMig is your processor for that data and processes it only to provide the service.

DatMig is an independent controller for the personal data whose purposes and means it determines: your account details, billing records and website analytics. That processing is covered by our Privacy Policy, not this DPA.

2. Your responsibilities as controller

You confirm that you have a lawful basis for the processing you instruct, that you have given any privacy notices and obtained any consents your own users or customers require, and that you are entitled to disclose the data to us and to the target platform. You are responsible for the accuracy of the data you migrate and for configuring migrations so that only data you intend to move is moved.

3. Our instructions

We process personal data only on your documented instructions. Your instructions are the configuration you set in the product: the source and target you connect, the scope you select, and the mappings you confirm, together with this DPA and the Terms.

If we are required by law to process personal data beyond your instructions, we will notify you before doing so unless the law prohibits it. If we consider that an instruction breaches data protection law, we will inform you.

4. Confidentiality

Any person we authorise to process your personal data is bound by confidentiality obligations and is granted access only to the extent their role requires.

5. Security

We implement appropriate technical and organisational measures under Article 32 of the GDPR, described in Annex II. We keep them under review and may update them, provided the level of protection is not reduced.

6. Subprocessors

You give us general authorisation to engage the subprocessors listed in Annex III. We impose data protection obligations on each of them that are no less protective than those in this DPA, and we remain fully liable to you for their performance.

We will give you at least 15 days' notice before adding or replacing a subprocessor, by email or in the product. If you reasonably object on data protection grounds within that period, we will work with you to identify a resolution; if we cannot, you may terminate the affected service and receive a pro-rata refund of fees paid for the unused remainder of your period.

7. International transfers

Personal data you migrate is processed on our servers in France, within the European Economic Area, and is not transferred outside it. No subprocessor listed in Annex III processes that data outside the EEA, and our own personnel access production systems only from within the EEA. Should this change, we will notify you under section 6 before it takes effect, and the transfer will be made under an adequacy decision or the European Commission Standard Contractual Clauses, together with any additional safeguards required.

8. Assistance with data subject requests

The service provides you with direct access to your migration records, so in most cases you can respond to a data subject yourself. Where you cannot, we will provide reasonable assistance, taking into account the nature of the processing.

If a data subject contacts us directly about data we process for you, we will not respond substantively; we will forward the request to you without undue delay.

9. Personal data breaches

If we become aware of a personal data breach affecting personal data we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware. We will give you the information you reasonably need to meet your own notification obligations, including the nature of the breach, the categories and approximate number of records affected so far as known, the likely consequences, and the measures we have taken.

10. Data protection impact assessments

We will provide reasonable assistance with data protection impact assessments and prior consultations with a supervisory authority, where these relate to our processing and you cannot obtain the information elsewhere.

11. Deletion and return

We do not retain the work data you migrate; it passes through our systems in transit and is not stored. Attachments are staged only for as long as the transfer requires and are then deleted. What we do retain is migration metadata: object identifiers and names, per-job reports and API logs, so that you can audit runs and retry failures.

In an active workspace, reports and API logs are kept for six months by default, or for a period contracted in an Enterprise Agreement. When you delete a workspace, its migration metadata is deleted immediately, apart from the workspace's own identifier, name and timestamps. When a user account is deleted, only that person's name and email address are kept, and only while a workspace they belonged to remains active, so that past jobs and the activity trail remain attributable. You may request that we delete metadata sooner at any time. We retain customer billing details and invoices for a period of six years from the date of creation of such data/documents; that processing is ours as controller and sits outside this DPA.

Because the migrated data itself resides in your source and target platforms, there is nothing further for us to return. Deletion takes effect on live systems immediately; residual copies in our hosting provider's daily backup, which covers a rolling 24 hours, are overwritten by the following day's backup.

12. Audits

We will make available the information reasonably necessary to demonstrate our compliance with Article 28, and will allow and contribute to audits, including inspections, conducted by you or an auditor you appoint. Audits take place on reasonable notice of at least 15 days, no more than once a year unless a supervisory authority requires otherwise or we have suffered a breach affecting your data, during business hours, without unreasonably disrupting our operations, and subject to confidentiality. Where we hold current certifications or reports, we may provide those to satisfy an audit request.

13. Liability

Liability under this DPA is subject to the limitations and exclusions in the Terms of Service, to the extent permitted by law. Nothing here limits either party's liability to a data subject or a supervisory authority.

14. Term, changes and law

This DPA applies for as long as we process personal data on your behalf. We may update it where data protection law or our processing changes, on notice, provided the change does not reduce your protection. It is governed by the laws of Ireland, and clause 13 of the Terms of Service applies to disputes about it.

Annex I: Details of the processing

Subject matter. Migration of the Customer's work-management data from a source platform to a target platform.

Duration. For the term of the Customer's DatMig account and any retention period described in clause 11.

Nature and purpose. Reading data from the source platform via its API, transforming it according to the Customer's mapping choices, writing it to the target platform, and recording the outcome for reporting, retry and audit.

Categories of data subject:

  • The Customer's employees, contractors and other workspace users.
  • Any individuals named or described in the migrated content, for example a customer's clients, suppliers or contacts appearing in tasks, comments or attachments.

Types of personal data:

  • Identifiers and contact details: names, email addresses, user IDs.
  • Assignment and activity data: who a task is assigned to, who commented, timestamps, time entries.
  • Free-text content: task descriptions, comments and attachments, which may contain any personal data the Customer has chosen to include.

Special category data. DatMig does not require special category data and is not designed to process it. Because free-text fields and attachments may contain any data the Customer enters, the Customer is responsible for deciding whether to migrate content that includes it.

Annex II: Technical and organisational measures

  • Data minimisation by design. Work data is migrated in transit and not stored. Only object identifiers, names, job reports and API logs are retained.
  • Encryption. Data is transmitted over encrypted connections. Connected-platform credentials are encrypted at rest.
  • Access control. Access to production systems is limited to personnel who need it, under confidentiality obligations, and is possible only from within the EEA.
  • Tenant separation. Each customer's migrations, credentials and records are scoped to their own workspace.
  • Auditability. Every migration produces a per-item report and an API log the Customer can inspect.
  • Resilience and backups. Our servers are backed up daily by our hosting provider, each backup replacing the previous day's. Because migrated work data is not stored, backups cover the service and its migration metadata rather than your content.
  • Testing and review. Dependencies are scanned automatically for known vulnerabilities, and findings are addressed as part of ordinary maintenance. We review the measures described in this annex at least once a year, and after any significant change to the service.

Annex III: Subprocessors

  • OVH Hosting Limited (OVHcloud): hosting and infrastructure. Processing location: France.

Resend, Stripe and Google process personal data for email delivery, billing and website analytics respectively. None of them receives the content you migrate, and DatMig is the controller for that processing, so it falls under the Privacy Policy rather than this DPA.

Contact

For questions about this agreement, or to request a signed copy, email support@datmig.com or use the contact form.