Data Processing Agreement

This Data Processing Agreement ("DPA") supplements the Terms of Service and governs EasyPPAP's processing of personal data on behalf of corporate Customers under GDPR Art. 28 / UK GDPR.

Activation: Customers may execute this DPA by emailing admin@easyppap.com from a verified domain associated with the Account.

1. Subject Matter and Duration

This DPA applies to EasyPPAP's processing of personal data on behalf of Customer when such personal data is contained in PPAP Material or otherwise transmitted to EasyPPAP for processing. The duration is the term of the Account.

2. Roles

• Customer: data controller (or, if Customer is itself a processor for an upstream controller, sub-processor)
• EasyPPAP: data processor

3. Nature and Purpose of Processing

Processing is for the purpose of providing the Service: parsing PPAP Material, generating analysis Output, and storing the Output for the retention period set forth in the Privacy Policy.

4. Categories of Data Subjects and Personal Data

• Data subjects: Customer's employees, suppliers' employees, or other individuals whose personal data may appear in PPAP Material (e.g., signers of PSW forms, FMEA reviewers, control plan owners)
• Categories of personal data: name, employee ID, signature image, email address, phone number, role title; not intended to include special categories of personal data under GDPR Art. 9

Customer is responsible for not uploading PPAP Material containing special categories of personal data without first informing EasyPPAP.

5. EasyPPAP's Obligations

EasyPPAP will:

• Process personal data only on documented instructions from Customer
• Ensure that personnel authorized to process personal data are bound by confidentiality
• Implement appropriate technical and organizational measures (see Annex II)
• Engage sub-processors only under written terms providing equivalent protection
• Assist Customer with data subject requests (Articles 12-22 GDPR), security incidents (Article 33), DPIAs (Article 35), and consultations (Article 36)
• Notify Customer without undue delay (within 72 hours where feasible) upon becoming aware of a personal data breach
• Delete or return personal data at Customer's choice upon termination, subject to legal retention obligations
• Make available information necessary to demonstrate compliance and contribute to audits

6. Sub-processors

Customer authorizes EasyPPAP to engage the sub-processors listed at easyppap.com/sub-processors. EasyPPAP will give thirty (30) days advance notice of additions of new sub-processors that materially expand the scope or geographic footprint of processing.

7. International Transfers

Transfers of personal data from the EEA, UK, or Switzerland to the US are made under the Standard Contractual Clauses, Module 2 (Controller to Processor), incorporated by reference into this DPA. Where Customer is a processor and EasyPPAP a sub-processor, Module 3 applies. The UK Addendum (issued by the ICO) applies to transfers of UK-origin personal data.

8. Data Subject Rights

EasyPPAP will, taking into account the nature of the processing, assist Customer in fulfilling Customer's obligation to respond to data subject requests. EasyPPAP will route any such request received directly to it back to Customer without action.

9. Personal Data Breach

Upon becoming aware of a personal data breach affecting Customer's data, EasyPPAP will notify Customer without undue delay and provide description of the breach, likely consequences, measures taken or proposed, and contact point for further information.

10. Audits

EasyPPAP will make available to Customer this DPA, a summary of EasyPPAP's technical and organizational measures, sub-processor list, and written responses to Customer's reasonable security questionnaires. On-site audits may be arranged with reasonable advance notice (at least 30 days), at Customer's expense, no more than once per year.

11. Liability

The limitations of liability in the Terms of Service apply to liability arising under this DPA, except where applicable law prohibits limitation.

Annex I — Description of Processing

• Subject matter: see Section 1
• Categories of data subjects and personal data: see Section 4
• Sensitive data: not intended (see Section 4)
• Frequency of transfer: continuous
• Nature of processing: collection, storage, analysis, deletion
• Purpose: see Section 3
• Duration: see Section 1

Annex II — Technical and Organizational Measures

1. Encryption: TLS 1.2+ in transit; AES-256 at rest (database, object storage)
2. Pseudonymization: not applied to PPAP Material content (full content needed for analysis)
3. Access control: RLS at database level; role-based access for EasyPPAP staff; MFA required for all production access
4. Monitoring: Sentry error tracking with PII scrubbing; PostHog analytics with autocapture denylist
5. Backup: encrypted backups, max 30-day retention, recovery testing semi-annually
6. Incident response: documented runbook; 24-hour internal response target
7. Personnel: confidentiality agreements; security awareness training annually
8. Sub-processor management: written agreements; annual review

Annex III — List of Sub-processors

See easyppap.com/sub-processors for the current list.