Data Processing Agreement

CONSLINQ

Last updated: 18 October 2026 · Version 1.0

1. About this Agreement

This Data Processing Agreement ("DPA") governs the processing of personal data by:

Gresys Hub Unip. Lda. Industrial Zone, Lote 4, Door 1 Cadaval 2550-171 Lisbon, Portugal

NIF: 517174065

trading as CONSLINQ and referred to in this DPA as the "Processor" or "we";

on behalf of the licensed consulting firm accepting the CONSLINQ Terms of Service (the "Controller" or "you");

in connection with the Controller's use of the CONSLINQ platform (the "Service").

This DPA forms part of the Terms of Service between the parties (the "Terms"). Where there is any conflict between this DPA and the Terms in respect of personal data processing, this DPA prevails.

This DPA is the parties' Article 28 GDPR processor contract. It applies to all personal data processed by the Processor on behalf of the Controller through the Service.

2. Definitions

Terms not defined here have the meanings given to them in the GDPR.

"GDPR" means Regulation (EU) 2016/679 (General Data Protection Regulation), as supplemented by Portuguese Law No. 58/2019 and other applicable national implementing legislation.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in the GDPR, that is processed by the Processor on behalf of the Controller through the Service.

"Data Subject" means the individual to whom Personal Data relates. In the context of the Service, this is typically a client of the Controller, a member of that client's family, or another individual whose data the Controller has uploaded or generated through the Service.

"Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

"Personal Data Breach" has the meaning given in Article 4(12) GDPR — a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data.

"Applicable Data Protection Law" means the GDPR, Portuguese Law No. 58/2019, and any other law relating to the protection of Personal Data that applies to the parties.

"Supervisory Authority" means the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, or such other supervisory authority as has jurisdiction under Applicable Data Protection Law.

3. Scope, subject matter, and duration

Subject matter. The processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the Service.

Duration. This DPA takes effect on the date the Controller accepts the Terms and continues for the duration of the Terms, plus any post-termination period during which the Processor retains Personal Data in accordance with Section 12.

Nature and purpose of processing. The Processor processes Personal Data solely for the purpose of providing the Service to the Controller, including hosting, storing, transmitting, backing up, and displaying the data; providing platform functionality (case management, document handling, payment tracking, and related workflows); providing technical support; maintaining security and integrity of the platform; and complying with legal obligations.

Types of Personal Data. The categories of Personal Data processed are described in Annex A. In summary: identifying information, contact details, family relationship information, passport numbers, case-related documents (which may themselves contain a wide range of Personal Data), case progress records, and payment records.

Categories of Data Subjects. The categories of Data Subjects are described in Annex A. In summary: the Controller's clients, members of those clients' families and dependants included in cases (including family members whom the Controller or its clients invite as users of the Service), and affiliates or referral partners the Controller invites into the Service.

Special categories of Personal Data. The Processor does not require or expect the Controller to process special-category Personal Data (Article 9 GDPR) through the Service in the ordinary course. Where such data may nonetheless be included in case documents — for example, health information supporting a medical visa application — the Controller is responsible for ensuring the processing has an appropriate lawful basis under Article 9 and for applying any additional safeguards required by Applicable Data Protection Law.

4. Roles of the parties

Processor. The Processor acts as processor in respect of all Personal Data processed on behalf of the Controller through the Service.

Controller. The Controller is controller in respect of that Personal Data. The Controller determines the purposes and means of the processing and is responsible for ensuring that the processing complies with Applicable Data Protection Law, including that the Controller has a lawful basis for the processing, has complied with its transparency obligations to Data Subjects, and has complied with any additional requirements applicable to sensitive or special-category data.

Not joint controllers. The parties are not joint controllers. The Processor does not determine the purposes or means of the processing on behalf of the Controller and does not use Personal Data for its own purposes.

Separate controller processing. Separately from the processor relationship established by this DPA, the Processor acts as controller in respect of certain account and firm data provided by the Controller to establish and operate its account. That controller-role processing is described in the Privacy Policy and is not within the scope of this DPA.

5. Controller's instructions

Processing on documented instructions. The Processor processes Personal Data only on the documented instructions of the Controller, unless required to do otherwise by law binding on the Processor. Where the Processor is so required by law, it will inform the Controller of that legal requirement before processing, unless the law prohibits such disclosure on important grounds of public interest.

What constitutes documented instructions. The Controller's documented instructions are:

This DPA and the Terms
The Controller's configuration and use of the Service through its ordinary operation — for example, the Controller's decision to create a case, upload a document, invite a Data Subject as a user, or delete a record
Any additional written instructions the Controller gives to the Processor at legal@conslinq.com

Unlawful instructions. If the Processor considers that an instruction from the Controller infringes Applicable Data Protection Law, the Processor will inform the Controller without delay and may suspend performance of that instruction until it is confirmed, withdrawn, or amended.

6. Confidentiality

The Processor ensures that persons authorised to process Personal Data on its behalf:

Have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality
Process Personal Data only as necessary to perform the Service and only in accordance with this DPA
Receive appropriate training on data protection and security relevant to their role

The Processor limits access to Personal Data to those personnel who need access to perform their role, and reviews access permissions regularly.

7. Security of processing

The Processor implements appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of Data Subjects.

The measures currently in place are described in Annex B. In summary:

Encryption of Personal Data in transit and at rest
Application-layer encryption of passport numbers, with per-access audit logging
Logical isolation of each Controller's data (multi-tenant architecture with enforced isolation)
Role-based access controls within each Controller's tenant
Append-only audit logging of state changes, document access, and sensitive-data reads
EU data residency for storage and application compute
Access to production infrastructure limited to named individuals whose actions are logged
Regular review of security measures as the platform and its risk profile evolve

The Processor may update its technical and organisational measures from time to time, provided the level of security is not materially reduced. Material changes will be notified to the Controller in accordance with Section 15.

8. Sub-processors

General authorisation. The Controller grants the Processor general authorisation to engage Sub-processors to process Personal Data, subject to the conditions in this Section.

Current Sub-processors. The Sub-processors currently engaged are listed at conslinq.com/subprocessors. That page identifies each Sub-processor, the processing activity for which it is engaged, and the location of processing.

New or changed Sub-processors. The Processor will notify the Controller at least 30 days before engaging a new Sub-processor or making a material change to an existing Sub-processor arrangement. Notice will be given by email to the account owner and by an update to the Sub-processors page.

Right to object. The Controller may object to a new or changed Sub-processor on reasonable data-protection grounds within the 30-day notice period. If the Controller objects, the parties will discuss the objection in good faith. If the parties cannot agree on a solution within a further 30 days, the Controller may terminate the affected part of the Service, with a pro-rata refund of any pre-paid fees for the terminated period.

Sub-processor obligations. The Processor imposes on each Sub-processor, by written contract, data protection obligations that are no less protective of Personal Data than those set out in this DPA. The Processor remains fully liable to the Controller for the performance of each Sub-processor's obligations.

9. International transfers

Personal Data comprising customer and client case data is stored and processed on infrastructure located in the European Union (Frankfurt, Germany).

Some Sub-processors are established in the United States and may be subject to US legal requirements. In addition, our transactional email provider stores delivery logs and associated metadata in the United States, as described on the Sub-processors page.

Where any transfer of Personal Data outside the European Economic Area occurs in connection with a Sub-processor's operations, the Processor ensures that an appropriate transfer mechanism under Chapter V GDPR is in place, such as:

The European Commission's Standard Contractual Clauses executed between the Processor and the Sub-processor
An adequacy decision under Article 45 GDPR
Any other transfer mechanism recognised under Chapter V GDPR

The transfer mechanism relied upon for each Sub-processor is identified on the Sub-processors page.

Where the Controller itself instructs the Processor to transfer Personal Data outside the EEA — for example, by sending platform-generated communications to Data Subjects located outside the EEA — the Controller is responsible for ensuring that it has a lawful basis for that transfer and has complied with Chapter V GDPR.

10. Assistance to the Controller

Data Subject requests. The Processor assists the Controller, by appropriate technical and organisational measures, in fulfilling the Controller's obligation to respond to Data Subject requests to exercise their rights under the GDPR (access, rectification, erasure, restriction, portability, and objection).

Where a Data Subject contacts the Processor directly with a request concerning Personal Data processed on behalf of the Controller, the Processor will forward the request to the Controller without undue delay and inform the Data Subject that the Controller is responsible for responding. The Processor will not respond to the substance of the request itself unless the Controller instructs otherwise.

Standard support for Data Subject requests is provided as part of the Service at no additional charge. Extraordinary requests requiring significant Processor effort — for example, bulk export of a large Controller's entire dataset in a specific non-standard format — may be subject to reasonable additional fees to cover the Processor's costs, notified to the Controller in advance.

Data protection impact assessments and prior consultation. The Processor provides the Controller with reasonable assistance, on written request, for:

Data protection impact assessments the Controller is required to carry out under Article 35 GDPR
Prior consultations with the Supervisory Authority under Article 36 GDPR

The information the Processor provides for these purposes includes descriptions of the processing, the security measures in place, and any other information reasonably necessary that is within the Processor's knowledge or control.

Compliance with obligations. The Processor assists the Controller in ensuring compliance with the Controller's obligations under Articles 32 to 36 GDPR, taking into account the nature of the processing and the information available to the Processor.

11. Personal Data Breaches

Notification to Controller. The Processor notifies the Controller of a Personal Data Breach affecting the Controller's Personal Data without undue delay and in any event within 72 hours of the Processor becoming aware of the breach.

Contents of notification. The notification includes, to the extent then known:

The nature of the breach, including the categories and approximate number of Data Subjects affected and the categories and approximate number of Personal Data records affected
The likely consequences of the breach
The measures taken or proposed to be taken by the Processor to address the breach and mitigate its possible adverse effects
Contact details for further information

Where all this information is not available within 72 hours, the Processor provides what is available and supplements the notification with further information as it becomes available.

Ongoing cooperation. The Processor cooperates with the Controller, provides such further information as the Controller reasonably requests, and assists the Controller in fulfilling the Controller's own breach notification obligations to the Supervisory Authority under Article 33 GDPR and to affected Data Subjects under Article 34 GDPR.

Responsibility for onward notification. Onward notification of the breach to the Supervisory Authority and to affected Data Subjects is the responsibility of the Controller.

Costs. The Processor bears its own costs of responding to a Personal Data Breach caused by the Processor's own act or omission. Where a breach is caused by the Controller's act or omission — for example, credential compromise on the Controller's side — the Processor may pass on reasonable costs of extraordinary support the Controller requests.

12. Return and deletion of Personal Data

During the term. The Controller may delete Personal Data at any time through the Service. When the Controller deletes a record, the Processor removes it from the active database. Documents deleted through the Service are held in a recovery state for 30 days and then permanently deleted from the platform's storage. Deletion from Sub-processor infrastructure, including backup rotation cycles, is completed within a reasonable further period.

Retention obligations sit with the Controller. The Controller acknowledges that the retention of Personal Data — including retention required by law and retention beyond the minimum required by law — is the Controller's responsibility as controller. The Processor does not currently enforce a minimum retention period for Personal Data on the platform. Where the Controller is subject to a statutory retention obligation, including for immigration case records in Portugal, the Controller must not delete Personal Data within that retention period, and must configure its own use of the Service accordingly.

Platform-enforced retention — a minimum retention floor that prevents deletion inside a defined period — is planned for a future release. When introduced, this Section will be amended and the Controller notified in accordance with Section 15.

On termination. On termination of the Terms:

The Processor makes the Controller's Personal Data available for export for 30 days from the effective date of termination
On the Controller's written request made within that 30-day period, the Processor may (but need not) extend the export window by a further 60 days
After the export window closes, the Processor deletes the Controller's Personal Data from the Service
Deletion from Sub-processor infrastructure, including backup rotation cycles, is completed within a reasonable further period

Choice of return or deletion. The Controller may instruct the Processor, before the end of the export window, whether to return the Personal Data to the Controller — by making it available for export through the Service or by another agreed method — or to delete it. In the absence of an instruction, the Processor deletes the Personal Data at the end of the export window.

Deletion as Controller instruction. Deletion of Personal Data at the Controller's instruction, whether during the term or on termination, is performed on the Controller's authority as controller. The Controller is responsible for ensuring that such deletion is consistent with the Controller's own retention obligations under Applicable Data Protection Law.

Exception for legal obligations. The Processor may retain Personal Data after the export window to the extent required to comply with the Processor's own legal obligations, for example retention of audit logs where required for accountability. Any such retention is limited to what is legally required and the retained data is subject to continued protection under this DPA for the period of retention.

13. Audit rights

Information rights. The Processor provides the Controller, on reasonable written request, with information necessary to demonstrate compliance with this DPA and with the Processor's obligations under Article 28 GDPR. This includes:

The Sub-processors currently engaged and the transfer mechanisms relied upon
The technical and organisational security measures in place
Any relevant certifications or third-party audit reports the Processor holds
The nature of any Personal Data Breach that has affected the Controller's Personal Data

Audit rights. The Controller may audit the Processor's compliance with this DPA, no more than once in any 12-month period unless a Personal Data Breach affecting the Controller's Personal Data has occurred, on the following terms:

The Controller gives at least 30 days' prior written notice of the audit
The audit is conducted at the Controller's cost, during normal business hours, in a manner that does not unreasonably interfere with the Processor's business
The auditor is either the Controller's own qualified personnel or an independent third-party auditor agreed by the parties, such agreement not to be unreasonably withheld, who is subject to appropriate confidentiality obligations
The audit is limited to information and systems relevant to the processing of the Controller's Personal Data
The Controller does not access other customers' data or the Processor's confidential business information

Substitute for on-site audit. The Processor may satisfy the audit obligation by providing a recent third-party audit report or independent certification covering the matters in scope, provided the report or certification is reasonably up to date and covers the scope the Controller intends to audit.

Cooperation with Supervisory Authorities. The Processor cooperates with the Supervisory Authority in the performance of its tasks, including making the information required by this DPA available to the Supervisory Authority on request.

14. Liability

Liability under this DPA is governed by the limitation of liability provisions in the Terms.

For the avoidance of doubt:

Article 82 GDPR liability of the Processor to a Data Subject is a matter between the Processor and that Data Subject; it is not a contract claim and is not limited by the Terms
The parties' respective allocations of responsibility under Article 82(2) and (3) GDPR, where controller and processor are jointly and severally liable, are as follows: each party is liable for the damage caused by its own processing that infringes the GDPR, and the party that has paid full compensation to a Data Subject is entitled to claim back from the other party the part of the compensation corresponding to that other party's responsibility for the damage
Nothing in this DPA or the Terms limits or excludes either party's liability for a matter that cannot be limited or excluded under Applicable Data Protection Law

15. Changes to this DPA

The Processor may amend this DPA from time to time to reflect changes in the Service, changes in Sub-processor arrangements, changes in Applicable Data Protection Law, or clarifications and corrections.

Where amendments are material — including changes to security measures that materially reduce protection, changes to retention rules, or changes to the categories of Sub-processors — the Processor will notify the Controller at least 30 days before the amendment takes effect, by email to the account owner. Non-material amendments may be made without notice.

If the Controller does not accept a material amendment, the Controller may terminate the Terms with effect from the date the amendment would take effect, without penalty.

16. General

Order of precedence. In the event of conflict between this DPA and the Terms in respect of the processing of Personal Data, this DPA prevails. In all other respects, the Terms apply as written.

Governing law and jurisdiction. This DPA is governed by the laws of Portugal and is subject to the exclusive jurisdiction of the courts of Lisbon, as set out in the Terms.

Survival. The provisions of this DPA that by their nature should survive termination of the Terms — including Sections 11 (breach notification for the period the Processor retains Personal Data), 12 (return and deletion), 13 (audit rights, in respect of the period during which the Processor processed Personal Data), and 14 (liability) — survive termination.

Annex A — Details of processing

Subject matter and purpose. Processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the CONSLINQ platform, an operational platform for licensed immigration and relocation consulting firms. The purpose is to enable the Controller to deliver immigration, visa, and relocation consulting services to its clients, including case management, client and family record-keeping, document handling, payment tracking, and related workflows.

Duration. The duration of the Terms plus any post-termination retention period described in Section 12.

Nature of processing. Hosting, storing, transmitting, backing up, and displaying Personal Data; providing platform functionality including case management, document handling, payment tracking, and communications between the Controller and Data Subjects; providing technical support; maintaining security and integrity of the platform.

Categories of Personal Data.

Identifying information: names, dates of birth, nationalities, contact details (email, telephone, postal address), gender where recorded
Family relationship information: relationships between the primary client and family members or dependants included in a case
Passport numbers: stored under application-layer encryption with per-access audit logging (see Section 7 and Annex B)
Documents: documents uploaded by the Controller or Data Subjects in support of a case, which may themselves contain a wide range of Personal Data, potentially including special categories (see below)
Case-related records: case progress, notes, status history, correspondence within the platform
Payment records: informational records of payments made or received in connection with a case, together with any supporting documents (proof of payment). No payment card data is processed by the platform.
Account and access records: login and access logs for the Controller's users and Data Subjects with portal access, and audit records of actions taken in the platform

Special categories of Personal Data. Special-category Personal Data (Article 9 GDPR) may incidentally be included in case documents where the underlying visa or immigration process requires it — for example, health data supporting a medical visa application, or family status information relevant to family reunification cases. The Controller is responsible for ensuring an appropriate Article 9 lawful basis and any additional safeguards required by Applicable Data Protection Law. The Processor does not process special-category data other than as incidentally contained in Controller-uploaded materials.

Categories of Data Subjects.

The Controller's clients (individuals for whom the Controller provides immigration, visa, or relocation consulting services)
Members of those clients' families and dependants included in specific cases (including family members whom the Controller or its clients invite as users of the Service)
Affiliates or referral partners the Controller invites into the platform to submit or track leads
Users within the Controller's own organisation (consultants and administrative staff)

Frequency of processing. Continuous throughout the duration of the Terms.

Location of processing. Storage and application compute in the European Union (Frankfurt, Germany). Sub-processors that may result in transfers outside the EEA are listed at conslinq.com/subprocessors together with the transfer mechanisms relied upon.

Annex B — Technical and organisational security measures

The Processor has implemented the following technical and organisational measures. Measures are reviewed and updated as the platform and its risk profile evolve.

Access control.

Multi-factor authentication available for user accounts
Role-based access control within each Controller's tenant, with roles defined for consultants, affiliates, clients, and platform administrators
Access to production infrastructure limited to named individuals of the Processor
Actions by personnel with production access are themselves audit-logged
Regular review of access permissions

Encryption.

All connections to the Service use HTTPS with modern TLS
Data at rest is encrypted at the storage layer by the underlying infrastructure provider
Documents uploaded to the Service are stored encrypted at rest and accessed only via short-lived signed links
Passport numbers are additionally encrypted at the application layer, with a separate encryption key from general database encryption

Isolation.

Multi-tenant architecture with logical isolation of each Controller's data
Isolation enforced at the application layer through a tenant-scoped data access wrapper
Isolation backstopped by database-level policies

Integrity and auditability.

Append-only audit log of state changes, document access, sensitive-data reads, and administrative actions
Passport number decryptions individually audit-logged with actor identification and timestamp
Document downloads individually audit-logged

Availability.

Data hosted on infrastructure with regular automated backups
Application deployed with a documented rollback path for production changes
Infrastructure region-pinned to Frankfurt, Germany for both storage and application compute

Sub-processor controls.

Each Sub-processor engaged under written contract with GDPR-compliant data processing terms
Sub-processor list published at conslinq.com/subprocessors and updated in advance of changes
Regular review of Sub-processor arrangements

Organisational.

Personnel with access to Personal Data are subject to confidentiality obligations, either contractually or as a matter of professional obligation
Personnel receive training on data protection and security relevant to their role
Documented incident response process for Personal Data Breaches
Regular review of security measures as the platform and its risk profile evolve

Development and deployment.

Source code held in access-controlled version control
Changes to production go through a defined review and deployment process
Automated testing of security-sensitive functionality
Separation between development, staging, and production environments

The Processor undertakes to keep these measures current with the state of the art appropriate to the sensitivity of the data processed and to the resources reasonably available to the Processor as an operator of the Service.