Data Processing Agreement

Processor
Tailwind Technologies SIA (“Tailwind”), reg. No. 40203371091, Ezera iela 8, Ikšķile, LV-5052, Latvia
Controller
The company holding a Tailwind account (the “Customer”)
Service
Tailwind cash-flow forecasting (SaaS, tailwindapp.eu)
Contact at Tailwind
Salvis Blūzma, CTO — salvis@tailwind.lv
Version
1.0 — 28.09.2026

This Data Processing Agreement (“DPA”) governs the processing of personal data by Tailwind on behalf of the Customer in connection with the Service. It forms part of the Terms and Conditions published at tailwindapp.eu (the “Agreement”) and applies to every customer of the Service from the moment the Customer accepts the Agreement. No separate signature is required. Where this DPA conflicts with the Agreement, this DPA prevails in respect of the processing of personal data.

Terms such as “personal data”, “processing”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings given to them in Regulation (EU) 2016/679 (“GDPR”).

1. Roles of the parties

1.1. In respect of the data that the Customer and its users create, import or synchronise into their Tailwind account, the Customer is the controller and Tailwind is the processor.

1.2. In respect of the data Tailwind holds to provide, administer and bill the Service — the Customer’s company details, the names and email addresses of its users, subscription status and login records — Tailwind is a controller in its own right and processes that data in accordance with its own privacy information.

1.3. Annex 1 describes the processing carried out under this DPA.

2. Processing on instructions

2.1. Tailwind processes personal data only on the Customer’s documented instructions, including as regards transfers to a third country, unless required to do otherwise by Union or Member State law. Where such a legal requirement applies, Tailwind informs the Customer before processing unless that law prohibits it.

2.2. The Customer’s instructions are constituted by this DPA, the Agreement and the Customer’s use of the functions of the Service. Any further instruction requires the agreement of both parties and may be subject to additional charges.

2.3. Tailwind informs the Customer without delay if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection law.

2.4. The Customer is responsible for the lawfulness of the personal data it enters into the Service and of the instructions it gives.

3. Confidentiality

3.1. Tailwind ensures that the persons authorised to process the personal data are bound by an obligation of confidentiality, whether contractual or statutory. The employment contracts of Tailwind’s personnel contain an undertaking not to disclose information about Tailwind’s customers that can reasonably be regarded as confidential.

3.2. Tailwind limits access to personal data to those persons who require it to perform Tailwind’s obligations under the Agreement.

4. Security of processing

4.1. Tailwind implements the technical and organisational measures set out in Annex 2, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing, as well as the risk to the rights and freedoms of natural persons.

4.2. Tailwind may update those measures over time, provided that the level of protection is not reduced. The current version of Annex 2 is available from Tailwind on request.

5. Sub-processors

5.1. The Customer gives Tailwind general authorisation to engage the sub-processors listed in Annex 3.

5.2. Tailwind imposes on each sub-processor data protection obligations substantially equivalent to those in this DPA, and remains fully liable to the Customer for the performance of that sub-processor’s obligations.

5.3. Tailwind maintains a current list of sub-processors and provides it to the Customer on request.

5.4. The Customer may object to the addition or replacement of a sub-processor on reasonable data protection grounds. If the parties cannot agree on a solution within 30 days of the objection, the Customer may terminate the subscription with effect from the date the sub-processor is engaged, and Tailwind refunds any prepaid fees covering the period after termination.

6. International transfers

6.1. Personal data is hosted in the European Union, as described in Annex 2.

6.2. Certain sub-processors listed in Annex 3 are established outside the EU/EEA. Transfers to those sub-processors take place on the basis of the European Commission’s adequacy decisions, including the EU–US Data Privacy Framework where applicable, or of standard contractual clauses adopted by the Commission, as provided in the terms of the sub-processor concerned.

7. Assistance to the Customer

7.1. Data subject rights. The Service gives the Customer direct access to the personal data in its account, so that the Customer can locate, correct and delete that data itself, and can export its planned transactions. Recorded transactions originate from the Customer’s own bank and remain available to the Customer from that bank or another account information service. Taking into account the nature of the processing, this is how Tailwind assists the Customer in fulfilling its obligation to respond to requests from data subjects. Where a request cannot be fulfilled in that way, Tailwind provides reasonable additional assistance at the Customer’s request.

7.2. If a data subject addresses a request concerning the Customer’s data directly to Tailwind, Tailwind forwards it to the Customer without undue delay and does not respond to it itself unless instructed to do so by the Customer.

7.3. Other assistance. Taking into account the nature of the processing and the information available to it, Tailwind assists the Customer in complying with its obligations under Articles 32 to 36 GDPR, including the security of processing, notification of personal data breaches and data protection impact assessments.

8. Personal data breaches

8.1. Tailwind notifies the Customer by email to the Customer’s registered administrators within 24 hours of becoming aware of a personal data breach affecting personal data processed under this DPA.

8.2. The notification describes, to the extent known at the time, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where the information is not available at once, Tailwind provides it in phases as the investigation progresses.

8.3. Tailwind documents personal data breaches and, at the Customer’s request, provides the information the Customer needs in order to notify a supervisory authority or the data subjects concerned. Notification to a supervisory authority or to data subjects is the Customer’s responsibility as controller.

9. Deletion at the end of processing

9.1. The Customer may export data from the Service at any time while the account exists, using the export functions of the Service.

9.2. On deletion of the Customer’s account, Tailwind cancels the subscription and deletes the personal data in that account from the production database immediately. Copies contained in backups expire on the ordinary backup cycle, so that the data is fully erased within 30 days of deletion.

9.3. Where a subscription ends without the Customer deleting its account, the account is switched to read-only and the data is retained so that the Customer can reactivate the subscription. The Customer may delete the account at any time, or request its deletion in writing, whereupon clause 9.2 applies.

10. Demonstrating compliance

10.1. Tailwind makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, including the security overview referred to in Annex 2 and, once a year on request, written responses to the Customer’s security or data protection questionnaire.

10.2. Tailwind provides, on request, the certifications held by its sub-processors to the extent those are made available to Tailwind.

11. General

11.1. This DPA applies from the date the Customer accepts the Agreement and remains in force for as long as Tailwind processes personal data on behalf of the Customer.

11.2. Tailwind may publish updated versions of this DPA. An update does not reduce the level of protection afforded to the Customer’s personal data. Each version carries a version number and a date, and superseded versions are available from Tailwind on request.

11.3. The liability of the parties under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.

11.4. This DPA is governed by the laws of the Republic of Latvia. Disputes are subject to the jurisdiction of the courts of the Republic of Latvia.

Annex 1 — Description of the processing

  • Subject matter: Provision of the Tailwind cash-flow forecasting service
  • Duration: For the term of the Customer’s subscription, and thereafter as set out in clause 9
  • Nature and purpose: Storage, organisation, retrieval, display and analysis of the Customer’s financial data in order to record transactions, synchronise bank account data and produce cash-flow forecasts; authentication of the Customer’s users
  • Categories of data subjects: The Customer’s users; individuals identifiable in the Customer’s counterparty records and transactions, such as sole traders
  • Categories of personal data: Name, surname, email address and national identity number of users; counterparty names and bank account numbers; transaction dates, amounts, currencies, descriptions and comments; IBANs, account owner names and balances of synchronised bank accounts; login timestamps and session records
  • Special categories of data: None. The Service is not intended for special categories of personal data within the meaning of Article 9 GDPR
  • Frequency: Continuous, for the duration of the subscription

Annex 2 — Technical and organisational measures

The technical and organisational measures Tailwind applies are described in Tailwind — Security Overview, version 1.0 (28.09.2026), which forms part of this DPA. In summary:

  • Hosting. All production data is hosted in the European Union, at DigitalOcean’s fra1 data centre in Frankfurt, Germany.
  • Encryption. TLS for all traffic to the Service and to sub-processors; bank synchronisation tokens encrypted in the database with AES-256; backups encrypted at rest in object storage.
  • Authentication. No passwords are issued; users authenticate with Smart-ID or Google sign-in.
  • Separation. Every record carries a tenant identifier and every query is filtered by the tenant of the authenticated user.
  • Staff access. Tailwind’s administrative interface does not display customer transactions or forecasts. Direct database access is limited to two named administrators for system administration, protected by two-factor authentication, and is not used to read customer data.
  • Backups. Daily, retained 30 days, stored in the same EU region.
  • Development. Code review before merge, separated environments, synthetic test data, parameterised queries, CSRF protection, input validation and rate limiting.
  • Vulnerability management. Periodic review of dependencies and runtime versions against published advisories; security patches prioritised over feature work.
  • Monitoring. Application error tracking with sensitive fields masked; infrastructure monitoring with email alerting.

Annex 3 — Sub-processors

  • DigitalOcean — Germany (hosting); United States (entity) — hosting and backup storage
  • Laravel Forge (Laravel LLC) — United States — server provisioning, deployment and backup automation
  • GoCardless (Bank Account Data) — United Kingdom / Latvia — PSD2 bank account synchronisation
  • Stripe — United States / Ireland — subscription payments
  • SK ID Solutions — Estonia — Smart-ID authentication
  • Google — United States / Ireland — Google sign-in and outbound email
  • OpenAI — United States — recognition of merchant names from card payment descriptions
  • Flare — Belgium — application error tracking
  • Mailchimp (Intuit) — United States — product and marketing email