Version 2026-11, effective 2 December 2026 · Citron (operated by Inkblot Studio)
1. Parties and roles
1.1 This Data Processing Agreement ("DPA") forms part of the agreement under which the customer ("Controller") uses the Citron console, delivery API and related services ("Services") provided by Inkblot Studio OOD, a limited liability company registered in Bulgaria under UIC 208715250 (VAT number BG208715250), with its registered office at 19 Maragidik, floor 2, office 1, 8000 Burgas, Bulgaria ("Inkblot Studio", "Processor").
1.2 For personal data the Controller stores in, or collects through, the Services, the Controller is the controller and the Processor is the processor within the meaning of Regulation (EU) 2016/679 ("GDPR").
2. Subject matter, duration, nature and purpose
2.1 The Processor processes personal data only to provide, secure and support the Services, for the duration of the agreement plus the deletion period in section 9.
2.2 Categories of data subjects: the Controller's website visitors, enquirers, customers, contacts and staff users.
2.3 Categories of personal data: contact details (name, email, phone), enquiry and booking content, CRM records, account and audit data, files and attachments, Citron AI conversations, dictated speech, and any other data the Controller chooses to store in the Services.
3. Instructions
3.1 The Processor processes personal data only on the Controller's documented instructions, including those given through the configuration of the Services, unless Union or Member State law requires otherwise. The Processor informs the Controller if an instruction appears to infringe data protection law.
4. Confidentiality
4.1 Everyone at the Processor with access to personal data is bound by confidentiality.
5. Security
5.1 The Processor implements the technical and organisational measures described in Annex 2, including tenant isolation of every workspace, encryption in transit, encrypted storage of connector credentials, role-based access control, two-factor authentication and audit logging.
6. Sub-processors
6.1 The Controller authorises the sub-processors listed in Annex 1. The Processor informs the Controller at least 30 days before adding or replacing a sub-processor; the Controller may object on reasonable data protection grounds.
6.2 The Processor imposes data protection obligations on each sub-processor that are no less protective than this DPA.
7. Assistance
7.1 The Processor assists the Controller, taking into account the nature of the processing, with data subject requests (the Services include a full data export), security, breach notification, impact assessments and prior consultation.
8. Personal data breaches
8.1 The Processor notifies the Controller without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the Controller's data.
9. Deletion and return
9.1 At the end of the Services the Controller can export its data at any time (Settings → Organization → Data export). The Processor deletes the Controller's data 90 days after the end of the agreement, unless law requires storage.
10. Audits
10.1 The Processor makes available the information necessary to demonstrate compliance and allows for audits by the Controller or an auditor it mandates, with reasonable notice and at most once per year unless a breach occurred.
11. International transfers
11.1 Where a sub-processor processes personal data outside the EEA, the transfer is covered by an adequacy decision or the Standard Contractual Clauses.
Annex 1: Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the application, databases and uploaded files | Finland and Germany (EU) |
| Stripe Payments Europe Ltd. | Billing and payments | Ireland (EU), USA |
| Resend Inc. / Zoho Corporation | Transactional email | USA / EU |
| Anthropic PBC | AI features, including Citron AI conversations, attachments and agents | USA |
| Eleven Labs Inc. | Speech-to-text for dictation. The Processor keeps no audio and requests deletion of each transcript | USA |
| Cloudflare Inc. | Bot protection on public forms, DNS | Global |
| Functional Software Inc. (Sentry) | Error reporting, only when enabled | USA / EU |
Annex 2: Technical and organisational measures
- Logical separation of every workspace (tenant scope enforced on every query), with an automated isolation test suite.
- TLS for all traffic; connector credentials encrypted with per-workspace keys (AES-256-GCM).
- Role-based access control, optional step-up two-factor authentication for sensitive actions.
- Audit log of administrative actions; backups with restricted access.
- Owner-initiated full data export in open formats (JSON, CSV).