Data Processing Addendum

This addendum applies when you use Shuttio to move personal data in a CRM you control. You are the controller. VentuRise LLC, which operates Shuttio, is the processor.

Last updated: 13 October 2026

1. Parties and scope

This addendum (“DPA”) forms part of the Terms of service between VentuRise LLC, a limited liability company organized under the laws of the State of Wyoming, USA, Wyoming filing ID 2026-002092905, 30 N Gould St Ste R, Sheridan, WY 82801, USA (“Shuttio”, the processor) and the customer who accepted the Terms (“Customer”, the controller). The Customer is the organisation whose account accepted the Terms. Its name and address are the ones on the account and in its Stripe billing details. This DPA binds both parties when the Terms are accepted. For a countersigned PDF, write to help@shuttio.com. It applies from the first migration and covers Customer Personal Data that Shuttio processes in the Customer's name under Regulation (EU) 2016/679 (“GDPR”). If this DPA and the Terms conflict on personal data, this DPA prevails.

Customer Personal Datameans the personal data in the records the Customer chooses to migrate. It does not cover Shuttio's own account data (sign-in, billing, contact details of the Customer's users). For that data Shuttio is the controller, as the privacy policy explains.

Shuttio's contact for this DPA and for data protection is help@shuttio.com. Shuttio has not appointed a Data Protection Officer.

2. Subject matter, duration, nature and purpose

Subject matter. Shuttio copies the data the Customer selects from a source (a CSV file, or HubSpot, Pipedrive or Affinity) into a destination the Customer connects (Attio, Clarify, Odoo, HubSpot, Pipedrive, Breakcold or Twenty), and can roll back what it created.
Duration.From the Customer's first migration until Shuttio has deleted the Customer Personal Data under section 11. Retention periods are in Annex I.
Nature of processing. Reading from the source through its API, mapping, transforming (for example phone numbers to E.164), writing to the destination, holding bookkeeping that makes a run repeatable and reversible, and deleting.
Purpose. Moving the CRM data the Customer chooses from the source to the destination, and nothing else. Shuttio does not sell the data, use it for advertising, or use it to train a model.

3. Instructions

Shuttio processes Customer Personal Data only on the Customer's documented instructions: this DPA, the Terms, and the choices the Customer makes in the product (which objects to tick, the field mapping, the destination, starting, pausing, cancelling and rolling back). Shuttio tells the Customer without delay if it believes an instruction breaches the GDPR. If EU or Member State law requires Shuttio to process the data otherwise, Shuttio tells the Customer first, unless the law forbids it.

4. Processor obligations

Shuttio will:

process Customer Personal Data only as section 3 allows;
keep the data confidential, and allow access only to staff who need it and who are bound by a duty of confidentiality;
apply the measures in Annex II;
engage subprocessors only under section 6;
help the Customer as set out in sections 7 and 8;
delete or return the data under section 11;
give the Customer the information needed to show compliance with Art. 28 GDPR, and allow audits under section 12.

5. Customer obligations

The Customer confirms that it has a legal basis to have the data migrated and to instruct Shuttio, and that the people whose data it migrates have been informed as the GDPR requires. The Customer decides what it migrates. Shuttio does not scan the records. The Customer should not migrate special-category data (Art. 9) or criminal-offence data (Art. 10) unless it needs to, and is responsible for the legal basis if it does.

6. Subprocessors

The Customer gives general authorisation for the subprocessors on the subprocessors page, which is Annex III. Shuttio binds each subprocessor to data protection duties that match this DPA and stays responsible to the Customer for them.

Shuttio emails account holders at least 30 days before a new subprocessor receives Customer Personal Data, and updates the subprocessors page on the day it sends the notice. The Customer may object on reasonable data protection grounds within those 30 days by writing to help@shuttio.com. Shuttio then either does not use the new subprocessor for that Customer's data, or the Customer may end its use of Shuttio and Shuttio deletes the data under section 11. If the parties cannot resolve the objection, the Customer may end the agreement and Shuttio refunds a paid migration that has not started.

7. International transfers

Shuttio is established in the United States, not in the European Economic Area. Where a Customer in the EEA transfers Customer Personal Data to Shuttio, the parties agree the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two, controller to processor, with the Customer as data exporter and Shuttio as data importer. They are incorporated into this DPA by reference, with the details in Annex I and Annex II. Under clauses 17 and 18 they are governed by the law of, and disputes go to the courts of, the EU Member State where the Customer is established. Shuttio's subprocessors also run in the United States. Shuttio transfers Customer Personal Data to a subprocessor only under the European Commission's adequacy decision for the EU–US Data Privacy Framework, where the subprocessor is certified, or under the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module Three, processor to processor). Each subprocessor is bound by its own data processing agreement that includes those clauses. The subprocessors page states the mechanism for each.

If the Customer is established in the United Kingdom, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies to transfers that the UK GDPR covers. If the Customer is established in Switzerland, the Standard Contractual Clauses apply with the amendments the Swiss Federal Act on Data Protection requires: the Swiss Federal Data Protection and Information Commissioner is the competent authority, and references to the GDPR include the FADP. Where the Customer is outside the EEA and the GDPR applies to its transfer to Shuttio, the same Module Two clauses apply, with Shuttio as importer, and the supervisory authority is the one named in section 14.

8. Data subject requests

If a person asks Shuttio to access, correct, delete, restrict, port or object to the processing of Customer Personal Data, Shuttio forwards the request to the Customer within 5 working days and does not answer it itself, unless the law requires. Taking account of the nature of the processing, Shuttio helps the Customer answer such requests. The records live in the Customer's source and destination, which the Customer can search and edit directly. What Shuttio holds is bookkeeping: ids, mappings, failure receipts and the failed-value text in Annex I. Shuttio finds and deletes entries on request.

9. Personal data breach

Shuttio tells the Customer without undue delay, and within 72 hours, after it becomes aware of a personal data breach affecting Customer Personal Data. The notice goes to the email address of the account owner and says: what happened, which data and roughly how many records or people, the likely consequences, and what Shuttio has done and will do. Shuttio sends what it knows at once and the rest as it learns it. Shuttio helps the Customer meet its duties to notify the supervisory authority and the people affected (Art. 33 and 34 GDPR).

10. Assistance

Shuttio helps the Customer, at no extra charge for reasonable requests, with its duties on security, breach notification, data protection impact assessments and prior consultation (Art. 32 to 36 GDPR), within the limits of what Shuttio holds (see Annex I).

11. Deletion and return

Shuttio holds no copy of the migrated rows. They are in the Customer's destination, and a rollback removes what a migration created there. The bookkeeping that Shuttio does hold follows the retention periods in Annex I. When the Customer deletes its account, or asks Shuttio to, Shuttio deletes the account data, the connections and all migration bookkeeping within 30 days and confirms by email. On request to help@shuttio.com, Shuttio returns what it holds within 30 days as CSV files: the ids, the mappings and the failure rows. The Customer's records themselves are not stored, so there is nothing more to return.

Deleted data can remain in the database host's restore history for up to 6 hours. The production database (Neon, AWS us-east-2, Ohio) keeps a point-in-time restore history of 6 hours, and nothing older.The law may require Shuttio to keep some data, for example billing records.

12. Audits

Shuttio answers the Customer's written questions about this DPA and gives it the information needed to show compliance. The Customer may audit Shuttio once in any 12 months, or after a personal data breach, with 30 days' written notice, during working hours, at its own cost, under a confidentiality undertaking and without access to other customers' data. Shuttio holds no third-party audit report (SOC 2 or ISO 27001) at the date above. Instead, Shuttio answers a security questionnaire once a year and provides the documentation on its security page. Shuttio allows an on-site or third-party audit only when a supervisory authority requires it or after a personal data breach, at the Customer's cost and with 30 days' notice.

13. Liability

Each party's liability for claims under this DPA is limited to the greater of the fees the Customer paid to Shuttio in the 12 months before the claim and EUR 1,000. The EUR 100 cap in the Limitation of liability section of the Termsstays for all other claims. Nothing in this DPA limits a data subject's rights against either party under Art. 82 GDPR, liability for intent or gross negligence, or liability that the law does not allow to be limited.

14. Term and governing law

This DPA lasts as long as Shuttio processes Customer Personal Data. It is governed by the law and the courts set out in the Governing law section of the Terms (the laws of the State of Wyoming, USA; the courts located in Wyoming), except that the Standard Contractual Clauses are governed as section 7 states. Shuttio is not established in the EEA, so it has no lead supervisory authority. Data subjects may complain to the supervisory authority in the EU or EEA country where they live. For the Standard Contractual Clauses, the competent supervisory authority is the one of the EU Member State where the Customer is established.

Annex I: the processing

Categories of data subjects

People who appear in the Customer's CRM or CSV: the Customer's customers, leads, prospects, partners and suppliers, and its own staff and CRM users (for example record owners and task assignees).

Categories of personal data

Whatever the Customer ticks for migration. In the objects Shuttio supports this is typically:

names, email addresses, phone numbers, job titles and postal addresses;
company names and domains;
deals, products, tickets, cases and other business objects, with their custom fields;
notes, tasks, meetings (title, time, participant names) and, for HubSpot calls, call details;
file attachments, which are streamed from the source to the destination and not stored;
list memberships and, where the Customer enables it, field history.

Shuttio does not ask for special-category data and does not detect it. Free-text fields can contain any data the Customer or its staff typed into them.

What Shuttio stores, and for how long

Shuttio stores the bookkeeping of a migration: settings, mirrored structure, the field mapping, a ledger of the ids it created in the destination, a map from source ids to destination ids, and a receipt for each row that failed or was skipped. The ledger and the id map hold ids and slugs, not record names. A receipt can quote a value the destination rejected, up to 200 characters.

ItemRetention

CredentialsDeleted 14 days after the migration finishes, and revoked with the provider where the provider allows it.

Fields step cacheEncrypted. Used for at most 24 hours, deleted within 48 hours by a daily purge.

Uploaded CSVDeleted when the import finishes or you roll it back. A CSV sample started before CSV imports ran in full keeps its file for up to 30 days.

Odoo import packageEncrypted. Deleted 7 days after it is built, or when you finish the load guide. Download links work for 24 hours.

Odoo app queueEncrypted. Deleted when your Odoo confirms the records, and after 24 hours at most.

Failed-value textDeleted 14 days after the migration finishes. The rest of the failure receipt stays with the migration.

Ledger, id map, mapping, failure receiptsKept while the account exists, so a migration can be re-run or rolled back. Deleted with the account.

Server logsIds and counts only. Kept by the host for at most 3 days.

Frequency

Continuous during a migration, once per migration run. Shuttio holds no standing feed of Customer Personal Data.

Annex II: technical and organisational measures

MeasureHow Shuttio applies it

Encryption at restEvery connection credential is sealed with AES-256-GCM under its own data key. A master key held outside the database wraps each data key. One module decrypts, and one table holds token material.

Hashed secretsPasswords are stored as salted scrypt hashes. Email-confirmation and password-reset tokens, Odoo app pairing codes and Odoo app tokens are stored only as hashes.

Encryption in transitThe service is served over HTTPS only. Connections to source and destination systems use HTTPS.

Job payloadsA background job carries a migration id and nothing else. Credentials and records are fetched inside the job and never travel through a queue, a log line or a dashboard.

No record storageRows read from a source CRM are written to the destination inside the migration job. Shuttio does not store them, apart from up to three example values per field in the encrypted Fields cache and the failed-value text above.

Access controlEvery request checks that the signed-in user belongs to the organisation that owns the migration. A test fails the build on a database query that does not name its organisation.

Staff accessAn allowlist of VentuRise LLC staff emails (environment setting ADMIN_EMAILS) opens the internal admin view. It shows account email, migration settings, status and failure receipts. Credentials are not readable there. With the allowlist empty, the admin view is off.

Rate limitingFailed sign-ins, sign-ups and account emails are counted per email address and per IP address.

Least privilegeEach connection belongs to one migration, uses the narrowest scopes the connector needs, and is revocable by you in your own CRM at any time.

RollbackA rollback deletes what a migration created in your destination, in reverse order, from a ledger written as each item was made.

HostingApplication servers on Vercel in Cleveland, Ohio (region cle1). Database on Neon, AWS us-east-2 (Ohio). Both are in the United States.

CertificationShuttio holds no SOC 2 or ISO 27001 report at the date above.

The security page describes the same mechanisms for a reviewer who is not a lawyer.

Annex III: subprocessors

The current list, with purpose, data and location of each, is at shuttio.com/subprocessors.

Contact

VentuRise LLC (Wyoming filing ID 2026-002092905), 30 N Gould St Ste R, Sheridan, WY 82801, USA · help@shuttio.com