Data processing terms
Company registration details shown in brackets are being added and will be filled in before paid plans open.
When the files you upload contain personal data about other people, such as customer names in a sales export, you stay in control of that data and we process it only to make your forecasts. These terms describe that relationship as GDPR article 28 requires, and they form part of our terms of service.
1. Roles
You (the customer) are the controller of personal data contained in the files you upload. [Company legal name] ApS (CVR [CVR number]), operating 4castPlannr, is your processor for that data. For your own contact and billing details we are the controller, as described in the privacy policy.
2. Summary of the processing
| Purpose | Preparing forecasts, testing them on your history, building recommended plans and reports, and keeping them updated if you subscribe. |
|---|---|
| Types of data | Whatever your business files contain. Usually sales, stock, orders, bookings or staffing figures; sometimes names, email addresses or IDs of your customers, suppliers or staff. |
| People concerned | Your customers, suppliers, staff or other people who appear in your files. |
| Sensitive data | Not needed and not wanted. Please remove it before uploading. |
| How long | Free forecasts: 90 days after the report is sent. Subscriptions: while active, then deleted within 30 days. Backups: up to 30 more days. |
| Where | Our servers in the EU (Helsinki, Finland). |
3. What we commit to
- We process your data only on your instructions, which are these terms and the requests you send us. If we think an instruction breaks data protection law, we tell you.
- Everyone who can access your data is bound to confidentiality.
- We protect your data with appropriate technical and organizational measures, including encrypted connections, separate storage per customer, strict upload checks, limited access, and error reports that strip out real values. More on our security page.
- We help you answer requests from people who exercise their rights, and with security, breach notification and impact assessments where relevant to our processing.
- If we become aware of a personal data breach affecting your data, we tell you without undue delay, and within 48 hours where possible, with the information you need to meet your own obligations.
- We never sell your data and never use it to train models offered to other customers.
- When the agreement ends, we delete your data as described above, unless the law requires us to keep it. Ask us first if you want a copy.
- We make available the information needed to show we meet these terms, and allow reasonable audits, normally by written questions, with reasonable notice and at your cost.
4. Sub-processors
You authorize us to use the service providers listed below. Each is bound by a written agreement with data protection duties at least as strict as these. We will email you at least 30 days before adding or replacing a sub-processor that handles your files. If you object for a good reason and we cannot find a solution, you may cancel and we refund any prepaid fees for the remaining period.
| Provider | Purpose | Where |
|---|---|---|
| Hetzner Online GmbH | Server hosting (our servers run in Helsinki, Finland) | Germany (company), Finland (data center) |
| Simply.com (Simply A/S) | Domain, DNS and email for hello@4castplannr.com | Denmark |
5. Transfers outside the EU
We store your files in the EU. If personal data from your files is ever processed outside the EU or EEA, we make sure a valid transfer mechanism is in place first, such as an adequacy decision (including the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.
6. US state privacy laws
Where US state privacy laws such as the California Consumer Privacy Act apply, we act as your service provider. We process personal information only to provide the service to you, do not sell or share it, do not keep, use or disclose it for any other purpose or outside our direct business relationship with you, and do not combine it with personal information from other sources except as those laws permit.
7. Everything else
These data processing terms apply for as long as we process personal data for you. The liability limits and the governing law in our terms of service also apply here. If you need a signed copy for your records, email hello@4castplannr.com.