For GDPR Art. 28, German customers usually need an Auftragsverarbeitungsvertrag (AVV). We do not offer in-app clickwrap. Counsel must review the draft before it is signed.
Roles: you are the controller of your workspace content and of personal data you put into the product. Some Tech Work UG (haftungsbeschränkt) is the processor for that content. For our own billing, security logs, and marketing-site visitors, we are the controller. See Privacy and Subprocessors.
Request a signed copy: privacy@goals.ac. Internal engineering outline (not a contract): docs/legal/dpa-template.md in the product repository.