Data Processing Addendum

1.Parties and how this applies

This Data Processing Addendum (“DPA”) is entered into between:

Processor

AtlasAPX Kamil Krawczyk, Poland (address of record: public CEIDG entry for NIP 8291758710), NIP 8291758710 (“TracePath”, “we”)

Controller

the customer identified in the account that accepted the Terms of Service (“Customer”, “you”)

Contact

[email protected]

This DPA forms part of the Terms of Service (the “Agreement”) and takes effect automatically when you begin using the Service, for as long as we process personal data on your behalf. No separate signature is required for it to bind both Parties.

2.Definitions

“GDPR” means Regulation (EU) 2016/679. “UK GDPR” means the GDPR as retained in the law of the United Kingdom. “Data Protection Law” means the GDPR, the UK GDPR, the Polish Act on the Protection of Personal Data of 10 May 2018, the ePrivacy Directive 2002/58/EC as implemented, and any other privacy or data protection law applicable to a Party’s processing under this DPA.

“Controller”, “Processor”, “Data Subject”, “Personal Data”, “Personal Data Breach”, “Processing” and “Supervisory Authority” have the meanings given in the GDPR.

“Customer Personal Data” means Personal Data contained in Customer Data that TracePath processes on the Customer’s behalf under the Agreement.

“SCCs” means the standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

“Subprocessor” means any processor engaged by TracePath to process Customer Personal Data.

3.Scope and roles

1. For Customer Personal Data, the Customer is the Controller (or a processor acting for a further controller) and TracePath is the Processor (or sub-processor). Each Party complies with the obligations that Data Protection Law places on it in that role.
2. The Customer is responsible for the lawfulness of the collection and transmission of Customer Personal Data, for having a valid legal basis, for providing the required privacy information to Data Subjects, and for the accuracy and adequacy of the data it sends. The Customer decides what its applications transmit to the Service.
3. TracePath acts as an independent Controller for Account Data, billing data, support correspondence and website data, as described in the Privacy Policy. This DPA does not cover that processing.
4. Annex 1 describes the subject matter, duration, nature and purpose of the processing, the categories of Data Subjects and the types of Personal Data, as required by Article 28(3) GDPR.
5. Where the Customer is itself a processor acting for one or more further controllers, the Customer warrants that it is authorised to appoint TracePath as a sub-processor on these terms, and that the instructions it gives reflect those of its controllers.

4.Processing on documented instructions

1. TracePath processes Customer Personal Data only on the Customer’s documented instructions, including as to transfers to a third country, unless required to do otherwise by Union or Member State law to which TracePath is subject. In that case TracePath informs the Customer of that legal requirement before processing, unless the law prohibits it on important grounds of public interest.
2. The Agreement, this DPA, the Documentation, and the configuration the Customer makes in the Service (projects, retention settings, alert rules, monitors, masking options, access controls, API calls) constitute the Customer’s complete documented instructions. Additional or different instructions must be agreed in writing, and TracePath may charge for instructions that require material work beyond the Service as offered.
3. TracePath immediately informs the Customer if, in its opinion, an instruction infringes Data Protection Law, and may suspend performance of that instruction until it is confirmed, withdrawn or amended.
4. TracePath does not use Customer Personal Data for its own purposes, does not sell it, does not use it to train machine-learning models, and does not use it for advertising or profiling.

5.Confidentiality of personnel

1. TracePath ensures that every person authorised to process Customer Personal Data is bound by an appropriate obligation of confidentiality, whether contractual or statutory, that survives the end of their engagement.
2. Access is limited to the personnel who need it to provide, secure or support the Service, on a least-privilege basis, and is recorded.
3. Personnel receive instruction on their data protection obligations before being granted access to production systems.

6.Security of processing

1. TracePath implements and maintains the technical and organisational measures set out in Annex 2, designed to ensure a level of security appropriate to the risk, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, as required by Article 32 GDPR.
2. TracePath may update those measures over time provided the level of security is not materially reduced. Material reductions are notified in advance.
3. The Customer is responsible for the security measures within its own control: the secrecy of its credentials, API tokens and ingest keys, the roles it grants its users, whether it enforces multi-factor authentication, and the masking and scrubbing configuration of its SDKs. Minimising what is sent to the Service is the single most effective control available to the Customer.

7.Subprocessors

1. The Customer gives TracePath general written authorisation to engage Subprocessors for the processing described in Annex 1.
2. The current Subprocessors are listed on the subprocessors page and reproduced in Annex 3. That page is the authoritative, maintained list.
3. TracePath gives at least 30 days’ notice of the intended addition or replacement of a Subprocessor, by email to the address on the Customer’s account. Customers may subscribe to notifications by writing to [email protected].
4. The Customer may object on reasonable data-protection grounds within that notice period. The Parties will discuss the objection in good faith. If TracePath cannot provide the Service without the Subprocessor and cannot offer a commercially reasonable alternative, the Customer may terminate the affected part of the Service without penalty, with a pro-rata refund of prepaid fees for the unused remainder of the Billing Period.
5. TracePath imposes on each Subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, including the relevant obligations of Article 28(3) GDPR, and remains fully liable to the Customer for the Subprocessor’s performance.

8.Assistance with data subject rights

1. Taking into account the nature of the processing, TracePath assists the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests to exercise Data Subject rights under Chapter III GDPR.
2. The Service itself provides part of the assistance: the Customer can search and inspect data within its own projects through the dashboard, and read it through the documented query API using a personal access token.
3. Bulk export of stored telemetry is not yet a self-service function of the Service. TracePath performs it on the Customer’s written instruction to [email protected], within 30 days of the request and at no charge.
4. If a Data Subject contacts TracePath directly about Customer Personal Data, TracePath will not respond substantively. It will tell the Data Subject to contact the Customer and, without undue delay, inform the Customer of the request.
5. Where the Service does not let the Customer fulfil a request itself, TracePath provides reasonable additional assistance. TracePath may charge a reasonable fee for assistance that requires substantial effort, having first told the Customer what it will cost.

9.Assistance with Articles 32 to 36

Taking into account the nature of processing and the information available to it, TracePath assists the Customer in ensuring compliance with the obligations in Articles 32 to 36 GDPR — security of processing, breach notification to the Supervisory Authority and to Data Subjects, data protection impact assessments, and prior consultation. The information in Annex 1, Annex 2, the subprocessors page and the security page is provided to support the Customer’s own assessment, and is designed to be usable directly in a DPIA.

10.Personal data breach

1. TracePath notifies the Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data.
2. The notification describes, to the extent known: the nature of the breach and, where possible, the categories and approximate number of Data Subjects and records concerned; the likely consequences; the measures taken or proposed to address it and to mitigate its effects; and a contact point for more information. Where the full information is not yet available, it is provided in phases without further undue delay.
3. TracePath does not notify a Supervisory Authority or Data Subjects on the Customer’s behalf unless the Customer instructs it to and applicable law permits it. That decision is the Customer’s.
4. Notification of an incident is not an admission by TracePath of fault or liability.
5. Suspected incidents may be reported to TracePath at any time at [email protected].

11.Return and deletion

1. During the Agreement, the Customer can read Customer Personal Data at any time through the dashboard and the documented query API, and can export its dashboard configuration as JSON. A bulk export of stored telemetry is produced by TracePath on written request to [email protected] within 30 days, at no charge.
2. On termination, the Customer has 30 days in which to read its data and to request an export. TracePath deletes Customer Personal Data within 60 days after the end of the Agreement, unless Union or Member State law requires it to be stored — in which case TracePath informs the Customer of that requirement and continues to protect the data.
3. During the Agreement, telemetry is deleted automatically when the retention period of the Customer’s plan expires; this deletion is enforced by the storage layer.
4. On written request, TracePath confirms deletion in writing.

12.Information and audits

1. TracePath makes available to the Customer the information necessary to demonstrate compliance with Article 28 GDPR, including this DPA, the security page, the subprocessor list, and reasonable written answers to a security questionnaire.
2. The Customer may audit TracePath’s compliance, or mandate an independent auditor to do so, at most once in any twelve-month period, on at least 30 days’ written notice, during normal business hours, without unreasonable disruption, and subject to confidentiality. The Customer may audit more often where a Supervisory Authority requires it or following a confirmed Personal Data Breach affecting its data.
3. An audit must not compromise the security or confidentiality of other customers’ data, and does not extend to access to other customers’ Personal Data, to shared infrastructure that cannot be segregated, or to TracePath’s own commercially confidential material.
4. TracePath may satisfy an audit request by providing existing documentation and written responses where these reasonably answer the Customer’s questions. TracePath does not currently hold an independent third-party security certification or audit report; if it obtains one it will be offered in place of an on-site audit.
5. The Customer bears its own audit costs and TracePath’s reasonable costs of supporting an on-site audit.

13.International transfers and the SCCs

1. Customer Personal Data is stored in the European Union. The production infrastructure is operated by Hetzner Online GmbH in Helsinki, Finland (EU).
2. Some Subprocessors listed in Annex 3 process Personal Data outside the EEA. For each such transfer, TracePath ensures an appropriate safeguard under Chapter V GDPR is in place.
3. Incorporation of the SCCs. Where Data Protection Law requires an appropriate safeguard for a transfer of Customer Personal Data from the EEA and no adequacy decision applies, the SCCs are incorporated into this DPA by reference and apply, completed as follows:
   • Module. Module Three (processor to processor) applies where the Customer is a processor; Module Two (controller to processor) applies where the Customer is a controller. Module Four (processor to controller) applies to any transfer from TracePath back to a Customer established outside the EEA.
   • Clause 7 (docking). Applies.
   • Clause 9 (subprocessors). Option 2, general written authorisation, with the notice period in section 7.3 of this DPA.
   • Clause 11 (redress). The optional independent dispute resolution paragraph does not apply.
   • Clause 17 (governing law). Option 1, the law of Poland.
   • Clause 18(b) (forum). The courts of Poland.
   • Annexes. Annex I.A (parties) is completed by section 1 of this DPA; Annex I.B (description of transfer) by Annex 1; Annex I.C (competent supervisory authority) is UODO; Annex II (technical and organisational measures) by Annex 2; Annex III (subprocessors) by Annex 3.
4. Where the recipient is certified under the EU–US Data Privacy Framework and the European Commission’s adequacy decision covers the transfer, TracePath may rely on that adequacy decision. TracePath does not rely on it alone: SCCs are maintained in parallel with the relevant Subprocessors so that a valid transfer mechanism survives any suspension or annulment of the adequacy decision.
5. For transfers subject to the UK GDPR, the SCCs apply as amended by the UK International Data Transfer Addendum issued by the Information Commissioner. For transfers subject to Swiss law, the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent authority.
6. If a transfer mechanism is invalidated, the Parties will cooperate in good faith to put an alternative safeguard in place without undue delay. If none is available, the Customer may terminate the affected part of the Service without penalty.
7. In the event of a conflict between this DPA and the SCCs, the SCCs prevail for the transfer they govern.

14.Liability and order of precedence

Each Party’s liability under this DPA is subject to the limitations and exclusions in the Agreement, except where Data Protection Law does not permit such limitation — including Article 82 GDPR and Clause 12 of the SCCs, which are not limited by this paragraph as against Data Subjects.

In the event of a conflict, the order of precedence is: the SCCs (for the transfer they govern), then this DPA, then the Agreement.

15.Term

This DPA takes effect when the Customer starts using the Service and remains in force for as long as TracePath processes Customer Personal Data. The obligations in sections 5, 11, 13 and 14 survive its termination.

16.Annex 1 — Description of processing

A. Parties

Data exporter: the Customer, as identified in the account that accepted the Agreement, acting as Controller (or processor for a further controller). Data importer: AtlasAPX Kamil Krawczyk, Poland (address of record: public CEIDG entry for NIP 8291758710), acting as Processor. Contact for both roles: [email protected].

B. Description of the transfer and processing

C. Competent supervisory authority

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

17.Annex 2 — Technical and organisational measures

The measures below are those actually implemented in the Service. They correspond to the measures described in more detail on the security page, which is maintained alongside this annex. Measures that are not implemented are not listed, and TracePath does not claim certifications it does not hold.

18.Annex 3 — Subprocessors

These are the subprocessors that process Customer Personal Data contained in telemetry, and they are the ones the change-notification and objection right in section 7 applies to. Providers that only handle account, billing or marketing-website data are processed by TracePath as controller and are outside this DPA (see section 3.3); they are listed, with these, on the subprocessors page, which is the authoritative, maintained list. The table below is a summary as at the date of this DPA.

19.How to get a signed copy

This DPA is binding without signature. If your procurement or legal team needs an executed document, email [email protected] with your legal entity name, registered address, and the account or organisation it relates to. We will return a countersigned PDF, with the SCCs attached as a standalone annex if you need them that way. There is no charge for this.

TracePath does not offer a Business Associate Agreement and makes no HIPAA offering on any plan. Protected health information must not be transmitted to the Service. See the Acceptable Use Policy.