Last updated: 15 July 2026

Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between the business customer ("Customer") and SENSONEO j. s. a. (company registration no. 50 746 057), Kollárova 27, 841 06 Bratislava, Slovakia ("Processor", "Sensoneo") for use of the DPP.GS platform (the "Service"). It governs the processing of personal data carried out by Sensoneo on behalf of the Customer and applies in accordance with Article 28 GDPR. Where this DPA conflicts with the Terms of Service on data-protection matters, this DPA prevails.

1. Roles of the parties

The Customer is the controller and Sensoneo is the processor in respect of any personal data contained in the Customer Content (including product/passport data). Sensoneo processes such personal data only on the Customer's documented instructions, which include the Terms of Service, this DPA, and the Customer's configuration and use of the Service. In respect of Sensoneo's own account, billing and security data, Sensoneo acts as an independent controller under its Privacy Policy.

2. Subject-matter, duration, nature and purpose

• Subject-matter — the provision of the DPP.GS Service, including creating, hosting and publishing Digital Product Passports.
• Duration — for the term of the Customer's account and until deletion or return of personal data as set out below.
• Nature and purpose — storage, hosting, structuring, display (including public publication of passports), transmission via EU and US infrastructure, and deletion, as necessary to provide the Service.

3. Categories of data and data subjects

• Categories of personal data — names and contact details of responsible persons and economic operators, and any other personal data the Customer chooses to include in passport data.
• Categories of data subjects — the Customer's personnel and authorised users; responsible persons and representatives named in product passports.

The Customer must not upload special categories of personal data (Art. 9 GDPR) unless expressly agreed in writing.

4. Processor obligations (Art. 28)

Sensoneo will:

• process personal data only on the Customer's documented instructions, including for international transfers, unless required by EU or Member State law (in which case Sensoneo will inform the Customer unless prohibited);
• ensure that persons authorised to process personal data are bound by confidentiality;
• implement the technical and organisational measures required by Article 32;
• respect the conditions for engaging sub-processors set out below;
• assist the Customer in responding to data-subject requests and in fulfilling its obligations under Articles 32-36;
• delete or return personal data at the end of the provision of services; and
• make available information necessary to demonstrate compliance and allow for audits.

5. Confidentiality

Sensoneo ensures that all personnel and contractors with access to personal data are subject to appropriate confidentiality obligations and receive suitable data-protection training.

6. Security (Art. 32)

Sensoneo maintains appropriate technical and organisational measures, including encryption of data in transit (TLS), password hashing, role-based access controls, network and edge protection, isolated production and staging environments, encrypted backups, logging and monitoring, and regular review of measures. Sensoneo benefits from the security posture of the Sensoneo group infrastructure.

7. Sub-processing

The Customer grants a general authorisation for Sensoneo to engage the sub-processors listed below. Sensoneo imposes data-protection obligations on each sub-processor equivalent to those in this DPA and remains responsible for their performance. Sensoneo will give the Customer reasonable notice of any intended addition or replacement of a sub-processor, and the Customer may object on reasonable data-protection grounds.

8. Assistance with data-subject requests

Taking into account the nature of the processing, Sensoneo will assist the Customer by appropriate technical and organisational measures, insofar as possible, in responding to requests to exercise data-subject rights under Chapter III GDPR. If Sensoneo receives such a request directly, it will forward it to the Customer without undue delay and will not respond except on the Customer's instructions.

9. Personal data breach notification

Sensoneo will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and will provide the information reasonably necessary to enable the Customer to meet its obligations under Articles 33 and 34.

10. Deletion or return on termination

On termination of the Service, Sensoneo will, at the Customer's choice, delete or return all personal data processed on the Customer's behalf and delete existing copies, unless retention is required by law. Residual copies in backups will be deleted in accordance with the rolling backup cycle. The Customer acknowledges that public passports may need to remain accessible for the regulatory lifetime of the relevant product.

11. Audits

Sensoneo will make available to the Customer information necessary to demonstrate compliance with Article 28 and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, subject to reasonable notice, confidentiality, and no more than once per year unless required by a supervisory authority. Sensoneo may satisfy audit requests by providing relevant certifications or third-party audit reports held by the Sensoneo group.

12. International transfers

The Service uses a US edge node (Ashburn, Virginia) and sub-processors that may process personal data outside the EEA. Where personal data is transferred to a third country, the parties rely on the European Commission's Standard Contractual Clauses (SCCs) together with supplementary measures, and, where applicable, the EU-US Data Privacy Framework. The SCCs are incorporated into this DPA by reference and, where the Customer is the data exporter and Sensoneo the data importer, apply between the parties.

13. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service. Nothing in this DPA limits any liability that cannot be limited under applicable data-protection law.

14. Contact

Data-protection contact for this DPA: [email protected].