Data Processing Agreement (DPA)

Last Updated: October 24, 2026

This Data Processing Agreement ("DPA") forms an integral part of the Terms of Service ("Principal Agreement") between TraceLogic Gateway ("Processor") and the Merchant/Customer ("Controller").

This DPA reflects the parties' agreement with regard to the processing of Personal Data in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

1. Definitions

2. Roles and Scope of Processing

2.1. Roles: For the purposes of the GDPR, You are the Data Controller and TraceLogic Gateway is the Data Processor. 2.2. Subject Matter and Nature: The Processor shall process Personal Data solely for the purpose of providing the compliance middleware, API validation, and supplier data synchronization services as described in the Principal Agreement. 2.3. Types of Personal Data: The Personal Data processed may include, but is not limited to: supplier names, business email addresses, phone numbers, and geolocation data (GPS coordinates/polygons) related to product origin. 2.4. Categories of Data Subjects: The Data Subjects include the Controller's employees, suppliers, contractors, and farming partners.

3. Obligations of the Processor

3.1. Processing Instructions: The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do otherwise by EU or Member State law. 3.2. Confidentiality: The Processor shall ensure that persons authorized to process the Personal Data have committed themselves to confidentiality. 3.3. Technical and Organizational Measures (TOMs): The Processor shall implement appropriate technical and organizational security measures to ensure a level of security appropriate to the risk, including encryption in transit, secure access controls, and regular system monitoring.

4. Sub-processing

4.1. General Authorization: The Controller provides a general authorization for the Processor to engage Sub-processors. Current Sub-processors include cloud hosting providers (e.g., Hetzner Cloud) and AI OCR services (e.g., OpenAI API configured with Zero Data Retention). 4.2. Notice of Changes: The Processor shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors, giving the Controller the opportunity to object.

5. Data Subject Requests and Assistance

5.1. Assistance: The Processor shall, insofar as this is possible, assist the Controller through appropriate technical and organizational measures to fulfill the Controller's obligation to respond to requests for exercising Data Subject rights (e.g., right to access, deletion, data portability). 5.2. Regulatory Audits: The Processor shall assist the Controller in ensuring compliance with obligations pursuant to GDPR Articles 32 to 36, taking into account the nature of processing and the information available to the Processor.

6. Personal Data Breach Notification

In the event of a Personal Data Breach affecting the Controller's Personal Data, the Processor shall notify the Controller without undue delay after becoming aware of the breach. The Processor shall provide reasonable cooperation and assistance to the Controller in handling the breach.

7. Data Transfers

The Processor will predominantly process Personal Data within the European Economic Area (EEA). Any transfer of Personal Data outside the EEA to a country not recognized as providing an adequate level of protection shall be governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission.

8. Deletion or Return of Data

Upon termination or expiration of the Principal Agreement, the Processor shall, at the choice of the Controller, delete or return all the Personal Data to the Controller and delete existing copies unless EU or Member State law requires storage of the Personal Data.

If you have any questions regarding this Data Processing Agreement, please contact us at support@tracelogicgateway.com.