Independent AI agent for EU Deforestation Regulation compliance, not affiliated with the EU. Scope & disclaimer →

Data Processing Agreement

Last reviewed 2026-05-17. Served live at /legal/dpa.

Template Data Processing Agreement under Art. 28(3) GDPR between the Customer (controller) and Vortx AI Private Limited (processor) for use of the hosted eudr.dev instance at eudr.dev. A signable PDF version is available on request to avijeet@vortx.ai.

Preamble

The Customer is the controller of the personal data processed under this Agreement, within the meaning of Art. 4(7) GDPR.
Vortx AI Private Limited, India (the "Processor") processes personal data on behalf of the Customer in connection with the hosted eudr.dev service.
emem.dev, operated by Vortx AI Private Limited, India, is a sub-processor for satellite-derived signal lookup (Art. 28(2) and 28(4) GDPR).
This Agreement is concluded under Art. 28(3) GDPR and supplements the Terms of Service between the parties.

1. Subject matter and duration

Subject matter: processing of personal data necessary for the compilation of an Annex II Due Diligence Statement under Reg. (EU) 2023/1115 (as amended by Reg. (EU) 2025/2650).
Duration: the term of the Customer's subscription to the hosted service, plus the retention period set out in § 7 below.

2. Nature and purpose of processing

The Processor will process operator, supplier, plot, and product data on the Customer's instructions in order to:

validate Annex II data fields against Reg. 2023/1115;
query satellite-derived deforestation, ecosystem, and legality signals;
compute a risk verdict and emit a signed receipt (ed25519 over canonical JSON);
compile and return the Annex II Due Diligence Statement.

3. Type of personal data

Operator natural-person details (name, address, EORI under Reg. (EU) 952/2013 Art. 9 where the operator is a natural person).
Plot geolocations (Polygon or Point), which may be personal data of a smallholder where the geometry identifies an individual.
Supplier contact details (name, address, identifier under Art. 9(1)(e) Reg. 2023/1115).
Account-management data (sign-in email, session metadata) of the Customer's authorised users.

No special categories of personal data under Art. 9 GDPR are processed. No data concerning criminal convictions or offences under Art. 10 GDPR are processed.

4. Categories of data subjects

Operators (natural persons or natural-person contacts of legal persons).
Smallholders whose plot geometry is supplied for due diligence.
Suppliers and their contact persons.
Downstream-customer contact persons named on a Due Diligence Statement.
Authorised users of the Customer's account.

5. Processor's obligations

The Processor will, in accordance with Art. 28(3)(a) to (h) GDPR:

(a) Documented instructions. Process personal data only on the documented instructions of the Customer, including with regard to transfers to a third country, unless required to do so by Union or Member-State law. The Processor will inform the Customer of any such legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
(b) Confidentiality. Ensure that persons authorised to process personal data are bound by confidentiality.
(c) Security (Art. 32). Implement the technical and organisational measures listed in Annex 2.
(d) Sub-processors. Engage sub-processors only with the Customer's prior general written authorisation (granted by signature of this Agreement) and subject to the change-notice procedure in Annex 3. Each sub-processor is bound by data-protection obligations equivalent to those of this Agreement.
(e) Data-subject requests. Assist the Customer, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests under Art. 12 to 22 GDPR. The engine ships Art. 15 export and Art. 17 erasure endpoints out of the box; see /privacy.
(f) Art. 32 to 36 assistance. Assist the Customer in ensuring compliance with Art. 32 (security), Art. 33 and 34 (breach notification), Art. 35 (data-protection impact assessment), and Art. 36 (prior consultation), taking into account the nature of processing and the information available to the Processor.
(g) End of processing. At the Customer's choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless Union or Member-State law requires storage. Records mandated by Reg. 2023/1115 Art. 4(3) (five-year retention) remain with the Customer's archive.
(h) Audits. Make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. Reasonable notice (at least 14 days) and confidentiality undertakings apply.

Breach notification

The Processor will notify the Customer of a personal-data breach without undue delay, and in any event within 72 hours after becoming aware of it, to enable the Customer's notification to the competent supervisory authority under Art. 33(1) GDPR. The notification will contain the elements listed in Art. 33(3) GDPR to the extent then known.

6. Sub-processors

Current sub-processors are listed at /legal/subprocessors. The Customer's signature on this Agreement constitutes prior general written authorisation under Art. 28(2) GDPR for those sub-processors. The Processor will give the Customer at least 30 days' notice of any intended change to the list and the Customer may object on data-protection grounds within that period (Annex 3).

7. International transfers

Processing under this Agreement primarily takes place in the EU (AWS eu-central-1 compute, eu-north-1 SES).
Flows to emem.dev for satellite-signal lookup are intra-entity remote processing: eudr.dev and emem.dev are operated by the same legal person (Vortx AI Private Limited), so under EDPB Guidelines 05/2021 the flow is not a Chapter V transfer to another controller or processor and SCCs are structurally unavailable for it. The full analysis, including the supplementary measures protecting the flow (identity stripping at source, TLS, signed content-addressed responses, 5-ha DPIA observability), is the Transfer impact assessment, reviewed annually. The data is restricted to plot geometry, HS code, country, and quantity; no operator or supplier identity is sent. Art. 6(1)(c) GDPR (the EUDR due-diligence duty) remains the processing basis; Art. 49(1)(d) is retired as the transfer basis and cited only for completeness should a supervisory authority take a broader view of "transfer".
For any third-party sub-processor located outside an adequacy decision under Art. 45 GDPR, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 3) will be executed before the transfer begins and made available on request.

8. Liability and term

Any liability of the Processor under this DPA is subject to the limitation-of-liability clause in the Terms of Service. Liability under this DPA does not aggregate with liability under the Terms — the cap stated in the Terms applies to the entire commercial relationship between the Customer and the Provider, including all claims under or in connection with this DPA.

For the avoidance of doubt, and consistent with Art. 28 and Art. 4(7) and 4(8) GDPR: the Customer is the controller of the personal data processed under this Agreement and bears the controller's obligations under Art. 5, 6, 13, 14, 24 and 35 GDPR. The Processor is a processor only and acts solely on the Customer's documented instructions under § 5(a) above. The Processor is not a joint controller within the meaning of Art. 26 GDPR.

This Agreement terminates with the underlying subscription.

9. Governing law

This Agreement is governed by the same law and jurisdiction as the Terms of Service (Section 7): Indian law, exclusive jurisdiction of the competent courts of Jharkhand, India. EEA-based Customers retain all non-waivable rights under GDPR (Arts. 12–22, 77–79) regardless of this choice.

Annex 1 — Details of processing

Item	Value
Subject matter	Compilation of an Annex II Due Diligence Statement under Reg. (EU) 2023/1115
Duration	Term of subscription + retention under § 7 of this Annex
Nature and purpose	Validation, satellite-signal lookup, risk computation, signed receipt issuance
Type of personal data	Operator details, plot geolocation, supplier contacts, account-management data
Categories of data subjects	Operators, smallholders, suppliers, downstream contacts, authorised users
Lawful basis (Customer side)	Art. 6(1)(c) GDPR — legal obligation under Reg. 2023/1115
Place of processing	AWS `eu-central-1` (compute, primary data store), AWS `eu-north-1` (transactional email via SES)
Retention	7 days default in the engine's working memory (`EUDR_TASK_RETENTION_DAYS`); the Customer's regulatory archive sits outside the engine and is retained for 5 years under Reg. 2023/1115 Art. 4(3)

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

Control	Measure
Transport	TLS 1.2+ enforced on every external endpoint
At-rest encryption	AWS KMS-managed keys for the primary store and for SES message storage
Authenticity of output	ed25519-signed receipts over canonical JSON; CID re-derivable; offline verify path documented in `PRIVACY.md`
Authentication	Magic-link sign-in only (no password vault); 32-byte CSPRNG token, SHA-256 at rest, 15-minute TTL, single use
Session security	`__Host-` prefix cookie, `HttpOnly`, `Secure`, `SameSite=Lax`; IP-drift detection
CSRF	Double-submit `X-Requested-With: eudr-app` header required for cookie-authenticated mutations
Rate-limit	5 magic links per email / 30 per IP per hour
Audit log	Append-only `audit_log` table; subjects pseudonymised under a server-pinned salt; no PII in free text
Retention sweep	Hourly background sweep enforces task-memory horizon and deletes already-erased shipment rows
Principle of least privilege	Account-scoped API keys; per-org isolation; production-key boot refusal when dev key is present
Data residency (primary)	EU (Frankfurt, `eu-central-1`) for the primary store; AWS SES in Stockholm (`eu-north-1`) for outbound mail
Backups	KMS-encrypted, retention aligned to § 7; restore tested at least annually
Vulnerability handling	`avijeet@vortx.ai` per `/.well-known/security.txt`; CVE intake and triage logged

Annex 3 — Approved sub-processors and change-notice policy

The list of approved sub-processors is maintained at /legal/subprocessors and re-published with each change.

The Processor will give the Customer at least 30 days' written notice before adding or replacing a sub-processor, by email to the address on file and by update to the live page.
The Customer may object on data-protection grounds within the notice period. If the parties cannot agree, the Customer may terminate the affected service component on reasonable notice and receive a pro-rata refund.
Each sub-processor is bound by data-protection terms equivalent to this Agreement under Art. 28(4) GDPR.