Legal

GDPR / RODO. Your data protection rights with BusyVault.

This page adds GDPR (EU) and RODO (Poland) detail to our Privacy Policy for BusyVault cloud customers and the people they invite.

In short: you can ask for a copy of your data, fix it, or ask us to delete it. Cloud data stays in Europe. We do not sell it.

Template notice: This page sums up our GDPR and RODO practice so you can read it. It is not legal advice. A Data Processing Agreement (DPA) and Standard Contractual Clauses are free to request for business customers.

Last updated: 1 July 2026

Scope

Applies to personal data processed when you use BusyVault hosted at busyvault.com.

GDPR applies to people in the European Economic Area (EEA). RODO is the Polish form of GDPR. BusyVault runs in the browser and can be installed from Chrome or Edge on Windows, macOS and Linux. The Android app is on Google Play and uses the same account. The iPhone and iPad app is coming soon. Enterprise customers can run BusyVault on their own servers under a separate contract. If you run BusyVault on your own servers (Enterprise), your team may be the controller. See your setup agreement.

Roles under GDPR

Who is responsible for what depends on the data.

BusyVault as controller: sign-up, billing, marketing (with consent), security logs, and how the service runs. BusyVault is that controller for the hosted service. This page does not publish a street address or a tax number.
Customer as controller: content in workspaces (messages, files, tickets) about your employees, clients, or partners.
BusyVault as processor: when we handle workspace content only on your written instructions. A DPA sets this link.

Legal basis

Summary of Article 6 GDPR bases we rely on.

ContractProviding BusyVault, user accounts, support, paid features (Art. 6(1)(b))

Legitimate interestSecurity, fraud prevention, minimal analytics, product reliability (Art. 6(1)(f))

Legal obligationTax, accounting, lawful requests from authorities (Art. 6(1)(c))

ConsentOptional marketing, non-essential cookies where required (Art. 6(1)(a))

Special categories of data are covered by Art. 9. You should not upload them unless you have a lawful basis. Customers are responsible for content they submit.

Your rights

Data subject rights under GDPR / RODO.

Right of access (Art. 15): confirm whether we process your data and receive a copy.
Rectification (Art. 16): correct inaccurate personal data.
Erasure (Art. 17): ask us to delete data when you no longer need it, or when you take back consent (where that applies).
Restriction (Art. 18): ask us to limit use in set cases.
Portability (Art. 20): get the data you gave us in a structured file when the basis is a contract or consent.
Objection (Art. 21): object to processing based on legitimate interests or direct marketing.
Withdraw consent: where processing is consent-based, without affecting prior lawful processing.
Complaint: lodge a complaint with a supervisory authority — in Poland: Prezes UODO (uodo.gov.pl).

Workspace admins may handle some requests directly, such as removing a member. We assist controllers with requests involving subprocessors, as required by Art. 28 GDPR.

Data subject request (DSR) process

How to submit and what to expect.

Submit: email contact@busyvault.com with subject "GDPR request" or "Wniosek RODO".
Identify: we verify your identity (logged-in email or reasonable proof) to prevent unauthorized disclosure.
Scope: describe the right you wish to exercise and relevant workspace/account if applicable.
Response: we reply within 30 days (extendable by 60 days for complex requests, with notice).
Free of charge: first request is free; manifestly unfounded or excessive requests may be refused or charged per Art. 12(5).

Tip: Workspace owners and administrators can create a password-protected BusyVault backup export of a workspace or channel. It restores supported records and contains attachment references, not a separate copy of every file. For a personal data request, contact contact@busyvault.com.

EEA residency

Where your data lives in the cloud service.

BusyVault SaaS is designed with EEA data residency: application databases and primary file storage (Cloudflare R2) use EU/EEA regions. Backups and disaster recovery stay within approved regions unless you agree otherwise in writing.

Enterprise self-hosted deployments keep all data on infrastructure you control.

Subprocessors

Third parties that process personal data on our behalf (Art. 28 GDPR).

Stripe, Inc. — payment processing and subscription management (PCI-DSS compliant; card data stays with Stripe).
Cloudflare, Inc. — R2 object storage and CDN for file attachments (EEA region configuration).
Email providers — transactional email delivery.
Google (Firebase) / Apple (APNs) — push notification delivery when enabled.
Hosting partners — compute and database hosting in the EEA.

We maintain contractual data protection terms with subprocessors. An up-to-date list and advance notice of material changes are available to business customers on request or via DPA.

International transfers

When data leaves the EEA.

Some subprocessors (e.g. Stripe, Cloudflare, Apple, Google) may process data in the United States or other countries. Where required, we rely on appropriate safeguards such as EU Standard Contractual Clauses (SCCs) and supplementary measures.

Contact contact@busyvault.com for transfer impact assessments or SCC copies for vendor review.

Contact

Privacy team / DPO-style contact (operational, not a statutory DPO unless designated).

GDPR & RODO requests: contact@busyvault.com
General: contact@busyvault.com
Polish supervisory authority: UODO