Data Processing Agreement

Last reviewed 2026-09-27. Served live at /legal/dpa.

Template Data Processing Agreement under Art. 28(3) GDPR between the Customer (controller) and Vortx AI Private Limited (processor) for use of the hosted eudr.dev instance at eudr.dev. A signable PDF version is available on request to avijeet@vortx.ai.

Preamble

• The Customer is the controller of the personal data processed under this Agreement, within the meaning of Art. 4(7) GDPR.
• Vortx AI Private Limited, India (the "Processor") processes personal data on behalf of the Customer in connection with the hosted eudr.dev service.
• emem.dev, operated by Vortx AI Private Limited, India, is a sub-processor for satellite-derived signal lookup (Art. 28(2) and 28(4) GDPR).
• This Agreement is concluded under Art. 28(3) GDPR and supplements the Terms of Service between the parties.

1. Subject matter and duration

• Subject matter: processing of personal data necessary for the compilation of an Annex II Due Diligence Statement under Reg. (EU) 2023/1115 (as amended by Reg. (EU) 2025/2650), and, where the Customer uses them, keeping farm records, farm visits with their files, supplier-intake submissions and buying decisions.
• Duration: the term of the Customer's subscription to the hosted service, plus the retention period set out in § 7 below.

2. Nature and purpose of processing

The Processor will process operator, supplier, plot, and product data on the Customer's instructions in order to:

• validate Annex II data fields against Reg. 2023/1115;
• query satellite-derived deforestation, ecosystem, and legality signals;
• compute a risk verdict and emit a signed receipt (ed25519 over canonical JSON);
• compile and return the Annex II Due Diligence Statement;
• keep farm records (fields, boundaries, crops, history) and read satellite data for them;
• store the photos, video, voice notes and documents sent with a farm visit or a supplier's form, by content hash, and read the capture time and GPS a JPEG photo carries;
• compute and store buying decisions per destination, with any override and the arrival outcome the Customer records.

3. Type of personal data

• Operator natural-person details (name, address, EORI under Reg. (EU) 952/2013 Art. 9 where the operator is a natural person).
• Plot geolocations (Polygon or Point), which may be personal data of a smallholder where the geometry identifies an individual.
• Supplier contact details (name, address, identifier under Art. 9(1)(e) Reg. 2023/1115).
• Account-management data (sign-in email, session metadata) of the Customer's authorised users.
• Farmer details (name, contact, farm location and boundaries, crops) and the commercial details of a negotiation (asking price, whether the farmer agreed, substances declared).
• Inspector names and visit dates.
• Photos, video, voice recordings and documents from farm visits and supplier forms, with each file's hash and, for JPEG photos, the capture time and GPS position written by the camera.

No special categories of personal data under Art. 9 GDPR are processed. Photos may show people's faces and recordings carry voices; the Processor does not process them to identify anyone (Art. 4(14) GDPR) and does not blur faces automatically, so the Customer instructs its staff to ask before recording people. No data concerning criminal convictions or offences under Art. 10 GDPR are processed.

4. Categories of data subjects

• Operators (natural persons or natural-person contacts of legal persons).
• Smallholders whose plot geometry is supplied for due diligence.
• Suppliers and their contact persons.
• Downstream-customer contact persons named on a Due Diligence Statement.
• Authorised users of the Customer's account.
• Farmers and their contact persons, whether or not in the EU.
• The Customer's inspectors and field staff.
• People who appear in photos or recordings taken at a farm.

5. Processor's obligations

The Processor will, in accordance with Art. 28(3)(a) to (h) GDPR:

• (a) Documented instructions. Process personal data only on the documented instructions of the Customer, including with regard to transfers to a third country, unless required to do so by Union or Member-State law. The Processor will inform the Customer of any such legal requirement before processing, unless the law prohibits such information on important grounds of public interest.
• (b) Confidentiality. Ensure that persons authorised to process personal data are bound by confidentiality.
• (c) Security (Art. 32). Implement the technical and organisational measures listed in Annex 2.
• (d) Sub-processors. Engage sub-processors only with the Customer's prior general written authorisation (granted by signature of this Agreement) and subject to the change-notice procedure in Annex 3. Each sub-processor is bound by data-protection obligations equivalent to those of this Agreement.
• (e) Data-subject requests. Assist the Customer, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests under Art. 12 to 22 GDPR. The engine ships Art. 15 export and Art. 17 erasure endpoints out of the box; see /privacy.
• (f) Art. 32 to 36 assistance. Assist the Customer in ensuring compliance with Art. 32 (security), Art. 33 and 34 (breach notification), Art. 35 (data-protection impact assessment), and Art. 36 (prior consultation), taking into account the nature of processing and the information available to the Processor.
• (g) End of processing. At the Customer's choice, delete or return all personal data after the end of the provision of services, and delete existing copies unless Union or Member-State law requires storage. Records mandated by Reg. 2023/1115 Art. 4(3) (five-year retention) remain with the Customer's archive.
• (h) Audits. Make available to the Customer all information necessary to demonstrate compliance with Art. 28 GDPR, and allow for and contribute to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer. Reasonable notice (at least 14 days) and confidentiality undertakings apply.

Breach notification

The Processor will notify the Customer of a personal-data breach without undue delay, and in any event within 72 hours after becoming aware of it, to enable the Customer's notification to the competent supervisory authority under Art. 33(1) GDPR. The notification will contain the elements listed in Art. 33(3) GDPR to the extent then known.

6. Sub-processors

Current sub-processors are listed at /legal/subprocessors. The Customer's signature on this Agreement constitutes prior general written authorisation under Art. 28(2) GDPR for those sub-processors. The Processor will give the Customer at least 30 days' notice of any intended change to the list and the Customer may object on data-protection grounds within that period (Annex 3).

7. International transfers

• Processing under this Agreement primarily takes place in the EU (AWS eu-north-1: compute, primary data store and SES).
• Flows to emem.dev for satellite-signal lookup are intra-entity remote processing: eudr.dev and emem.dev are operated by the same legal person (Vortx AI Private Limited), so under EDPB Guidelines 05/2021 the flow is not a Chapter V transfer to another controller or processor and SCCs are structurally unavailable for it. The full analysis, including the supplementary measures protecting the flow (identity stripping at source, TLS, signed content-addressed responses, 5-ha DPIA observability), is the Transfer impact assessment, reviewed annually. The data is restricted to plot geometry, HS code, country, and quantity; no operator or supplier identity is sent. Art. 6(1)(c) GDPR (the EUDR due-diligence duty) remains the processing basis; Art. 49(1)(d) is retired as the transfer basis and cited only for completeness should a supervisory authority take a broader view of "transfer".
• For any third-party sub-processor located outside an adequacy decision under Art. 45 GDPR, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 (Module 3) will be executed before the transfer begins and made available on request.

8. Liability and term

Any liability of the Processor under this DPA is subject to the limitation-of-liability clause in the Terms of Service. Liability under this DPA does not aggregate with liability under the Terms — the cap stated in the Terms applies to the entire commercial relationship between the Customer and the Provider, including all claims under or in connection with this DPA.

For the avoidance of doubt, and consistent with Art. 28 and Art. 4(7) and 4(8) GDPR: the Customer is the controller of the personal data processed under this Agreement and bears the controller's obligations under Art. 5, 6, 13, 14, 24 and 35 GDPR. The Processor is a processor only and acts solely on the Customer's documented instructions under § 5(a) above. The Processor is not a joint controller within the meaning of Art. 26 GDPR.

This Agreement terminates with the underlying subscription.

9. Governing law

This Agreement is governed by the same law and jurisdiction as the Terms of Service (Section 7): Indian law, exclusive jurisdiction of the competent courts of Jharkhand, India. EEA-based Customers retain all non-waivable rights under GDPR (Arts. 12–22, 77–79) regardless of this choice.

Annex 1 — Details of processing

Annex 2 — Technical and organisational measures (Art. 32 GDPR)

Annex 3 — Approved sub-processors and change-notice policy

The list of approved sub-processors is maintained at /legal/subprocessors and re-published with each change.

• The Processor will give the Customer at least 30 days' written notice before adding or replacing a sub-processor, by email to the address on file and by update to the live page.
• The Customer may object on data-protection grounds within the notice period. If the parties cannot agree, the Customer may terminate the affected service component on reasonable notice and receive a pro-rata refund.
• Each sub-processor is bound by data-protection terms equivalent to this Agreement under Art. 28(4) GDPR.

This page last changed on 2026-09-27. It describes the Regulation as it stood then; where a date or a code matters to a decision, check it against the EUR-Lex text it cites.