Data Processing Agreement

1. LEGAL REVIEW REQUIRED BEFORE GENERAL AVAILABILITY

This document is published for review. It has not yet completed legal review and is not presented as legally approved or as an executed agreement.

Business customers can request it for review and signature by emailing support@dpplogic.com. It takes effect for a customer only when signed by that customer and DPPLogic. Until then, the Terms of Service (https://pilot.dpplogic.com/legal/terms/) and Privacy Notice (https://pilot.dpplogic.com/legal/privacy/) describe how personal data is handled.

2. Parties and roles

This Data Processing Agreement (“DPA”) is between the customer organisation that signs it (the “Customer”) and Ryan Jarvis trading as DPPLogic (“DPPLogic”), Nanny Cay, Tortola, British Virgin Islands. It supplements the DPPLogic Terms of Service.

For Customer Personal Data, the Customer is the controller and DPPLogic is the processor. “Customer Personal Data” means personal data contained in the content the Customer's organisation enters into the DPPLogic service, and in the organisation's membership and activity records as processed to provide the workspace to the Customer.

DPPLogic is a separate controller for account sign-in, billing, support and service-security data, as described in the Privacy Notice. This DPA does not cover that processing.

3. Details of the processing

Subject matter and purpose: providing the DPPLogic service to the Customer, which means storing, organising, displaying, reviewing and exporting the Customer's DPP preparation data, and the sign-in, security, backup and support activities needed to do so.

Duration: for as long as DPPLogic provides the service to the Customer, and afterwards until the data is deleted as described in Deletion and return.

Categories of data subjects: the Customer's authorised users; contacts at the Customer's suppliers, manufacturers, economic operators and other business partners, including people who send answers through a secure response link the Customer shared; and other individuals the Customer names in its content.

Types of personal data: names, job titles, departments, business email addresses and phone numbers; free-text notes; correspondence and request records; evidence reference descriptions and links; and user identifiers, roles, assignments and audit attribution (who did what, and when).

Special categories of personal data: none are intended. The Customer must not enter special category data or data about criminal convictions.

Nature of the processing: hosting, storage, retrieval, display, organisation, export, backup and deletion. DPPLogic does not use Customer Personal Data for its own marketing or to train AI models, and does not contact data subjects.

4. Instructions

DPPLogic processes Customer Personal Data only on the Customer's documented instructions. The Terms of Service, this DPA and the Customer's use and configuration of the service are the Customer's instructions. Further instructions must be agreed in writing.

If the law requires DPPLogic to process Customer Personal Data in another way, DPPLogic will tell the Customer before doing so, unless the law prohibits this. DPPLogic will tell the Customer if, in its opinion, an instruction infringes applicable data protection law.

5. Confidentiality

DPPLogic keeps Customer Personal Data confidential. Access to production systems and Customer Personal Data is limited to the operator of DPPLogic and is used only to provide, support and secure the service or to meet legal obligations. Anyone else DPPLogic authorises to process Customer Personal Data will be bound by confidentiality obligations.

6. Security measures

DPPLogic applies the following technical and organisational measures, which are implemented in the service today.

Encryption in transit: the service is served over HTTPS only, and browsers are told (HTTP Strict Transport Security, one year) to use HTTPS for every visit.

Authentication: sign-in through WorkOS with a verified email address. DPPLogic never receives or stores passwords. The one-time sign-in token is used only to establish a session and is not stored.

Sessions: a random 256-bit session token is kept in a __Host- prefixed cookie that is Secure, HttpOnly and SameSite=Lax, and only a SHA-256 hash of the token is stored. Sessions end after 30 minutes of inactivity and after 12 hours at most; each account has at most five active sessions; and the sign-in session is re-checked with WorkOS on every request, so sign-out or revocation takes effect immediately.

Re-authentication: sensitive actions (invitations, membership and role changes, ownership transfer, and account export and deletion) require a sign-in within the previous 15 minutes.

Tenant isolation: every record belongs to exactly one organisation, and every workspace request is checked on the server against the user's active membership of that organisation. Requests for another organisation's data are refused.

Secure response links (Professional and Business): the only access without membership. A link carries a random 256-bit token, of which only a SHA-256 hash is stored; the token is shown to the Customer once and is not kept in logs or exports. A link gives whoever holds it the open items of one request and nothing else, never a session or a role. It expires after at most 30 days and can be revoked or replaced by the Customer at any time. It does not work while the request is closed or archived, while nothing is left to answer, or while the Customer's plan does not include it; every page load and every submission re-checks these conditions on the server. Invalid, expired and revoked links all receive the same answer. Answers are recorded as proposals for the Customer's review and are attributed to the link, not to a person. Link pages are never cached, never indexed by search engines, run no analytics and send no referrer.

Role-based authority: owner, admin, manager, contributor and viewer permissions are enforced on the server for every change, with database rules that, for example, keep at least one owner in every organisation and allow only permitted roles. A role change ends the affected person's sessions.

Invitations: invitation codes are random, single-use, stored only as hashes, bound to the invitee's verified email address and expire after 72 hours.

Audit trail: every change to a workspace record creates an immutable revision recording who made it and when. Access, export and billing events are also recorded.

Web protections: requests that change data must come from the service's own origin with a service-specific header (protection against cross-site request forgery); a strict Content Security Policy allows scripts only from the service itself; other sites cannot frame the service; request sizes are limited; and private pages are marked no-store and are not indexed by search engines.

Rate limits: on sign-in, changes, search, export, invitations, organisation creation, checkout, and the creation and use of secure response links.

Payments: card details are entered on Stripe's checkout pages and never reach DPPLogic. Stripe notifications are accepted only with a valid signature, within a five-minute window and in the expected live or test mode, and prices come only from a server-side allowlist.

Secrets: provider keys are held as Cloudflare Worker secrets, not in source code, configuration files or logs.

Logging: DPPLogic's application logs record error codes and route patterns only, not workspace content, record identifiers, tokens, email addresses or IP addresses.

Backup and recovery: point-in-time recovery of the database for the previous 30 days, periodic copies to a separate database, and rehearsed restore and rollback procedures.

Separate environments: production has its own database, sign-in configuration and live payment mode. Test environments use synthetic data only.

DPPLogic does not hold ISO 27001, SOC 2 or similar certifications. DPPLogic may update these measures, provided the overall level of protection is not reduced.

7. Subprocessors

The Customer gives general authorisation for DPPLogic to use the following subprocessors for Customer Personal Data.

Cloudflare, Inc.: application hosting (Cloudflare Workers), database (Cloudflare D1, primary copy placed in the Western Europe region), network delivery, security and logs. Processes all Customer Personal Data.

WorkOS, Inc.: authentication of the Customer's authorised users. Processes authorised users' email addresses, sign-in identifiers and sign-in security data.

DPPLogic also uses Stripe (payments) and Google Workspace (the support mailbox) as a controller for billing and support. They do not receive workspace content, except personal data the Customer chooses to include in a support email.

DPPLogic uses each subprocessor under that provider's published data processing terms and remains responsible to the Customer for its subprocessors' processing of Customer Personal Data.

DPPLogic will give at least 30 days' notice of a new subprocessor by updating https://pilot.dpplogic.com/legal/privacy/#subprocessors and emailing the owners of organisations that have signed this DPA. The Customer may object on reasonable data protection grounds. If the objection cannot be resolved, the Customer may cancel its subscription and ask for its data to be deleted.

8. Assistance

Data subject requests: the Customer can correct and export its data in the workspace. DPPLogic will help with requests that the Customer cannot handle itself, such as erasing supplier contact details, which is not yet available in the workspace. DPPLogic will pass to the Customer any request it receives directly about Customer Personal Data.

DPPLogic will give reasonable help and information to support the Customer's security obligations, breach notifications, data protection impact assessments and consultations with supervisory authorities, taking into account the nature of the processing and the information available to DPPLogic.

9. Personal data breaches

DPPLogic will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, by email to the organisation's owners, with the information then available, and will provide further information as it becomes available.

10. Deletion and return

Return: members of the Customer's organisation can export its current records as JSON or CSV at any time, and READY packages as JSON. Exports do not include earlier revisions.

Deletion: organisation deletion is not yet self-service. On the Customer's written request to support@dpplogic.com, DPPLogic deletes the organisation's data from the live database. Requests are handled manually.

Cancelling a subscription does not delete data. The organisation continues on the Free plan until deletion is requested.

Supplier contact details: on the Customer's request to support@dpplogic.com, DPPLogic erases a contact's details, including earlier values in the record's revision history.

Backups: deleted data remains in point-in-time recovery for up to 30 days and in the separate backup copy until it is next replaced, after which it is overwritten.

DPPLogic may keep data where the law requires it.

11. Information and audits

On request, DPPLogic will provide the information reasonably necessary to demonstrate compliance with this DPA, including an up-to-date description of its security measures and subprocessors, and links to its providers' published security and compliance information.

Where applicable data protection law requires an audit or inspection, the parties will agree its scope, timing and conditions, including confidentiality, in advance.

12. International transfers

DPPLogic is operated from the British Virgin Islands, and its subprocessors may process Customer Personal Data outside the UK and the European Economic Area, including in the United States.

Where UK or EU transfer rules apply, transfers will be made with appropriate safeguards. The transfer mechanism for each transfer will be set out in this DPA when it is finalised after legal review.

13. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where applicable law does not permit this.

If this DPA conflicts with the Terms of Service on a data protection matter, this DPA prevails.

14. Term

This DPA applies from signature for as long as DPPLogic processes Customer Personal Data for the Customer.

15. Contact

support@dpplogic.com. Business correspondence address: Nanny Cay, Tortola, British Virgin Islands.