Data Processing Agreement

"Personal data", "processing", "controller", and "processor" have the meanings given in UK GDPR. "Service" means the TraceStax background job monitoring platform. "Event data" means telemetry payloads submitted by the Controller's systems to the TraceStax ingest API.

The parties acknowledge that in respect of any personal data included in event payloads, the Controller is the data controller and TraceStax is the data processor. TraceStax processes personal data only to the extent necessary to provide the Service and in accordance with the Controller's documented instructions.

TraceStax strongly recommends that Controllers do not include personal data (names, email addresses, national identifiers, etc.) in job payloads or task arguments transmitted to the Service.

The Controller warrants that:

• It has a lawful basis for any personal data it submits to the Service
• It has provided appropriate notices to data subjects
• It will not submit special category data (health, biometric, etc.) to the Service without explicit prior agreement

TraceStax shall:

• Process personal data only on the Controller's documented instructions
• Ensure all personnel authorised to process the personal data are bound by confidentiality obligations
• Implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction
• Notify the Controller without undue delay (and no later than 72 hours) upon becoming aware of a personal data breach affecting the Controller's data
• Assist the Controller in responding to data subject rights requests to the extent technically feasible
• Delete or return personal data at the end of the service relationship upon written request

The Controller authorises TraceStax to engage the following sub-processors, who are contractually bound to equivalent data protection obligations:

• Cloudflare Inc (infrastructure, edge compute, D1 database, and transactional email, USA / global edge)
• Clerk Inc (authentication, USA)
• Stripe Inc (payment processing, USA)

TraceStax will provide at least 14 days notice of any new sub-processor. If the Controller objects, it may terminate the Service without penalty within that notice period.

Personal data may be processed in countries outside the UK/EEA by the sub-processors listed above. Where transfers occur, TraceStax relies on UK IDTA or Standard Contractual Clauses as the transfer mechanism. Copies are available on request.

TraceStax will provide the Controller with information necessary to demonstrate compliance with this DPA, including making available relevant audit reports. The Controller may request an audit with 30 days written notice, subject to reasonable confidentiality terms and at the Controller's cost.

Liability under this DPA is subject to the limitations set out in the Terms of Service. Each party shall be responsible for its own violations of applicable data protection law.

Data protection queries: privacy@tracestax.com. TraceStax Ltd, registered in England and Wales.