Data processing agreement

You are the controller for the data you provide to us. We are the processor and do nothing with it beyond what you instruct us to do and what is needed to deliver the service.

This agreement is part of the terms and conditions and applies for as long as you are a customer.

Product data, materials, certificates, waybills and the companies in your chain. In addition the name and work email address of the people who work in the environment, because they need to be able to log in.

Traffic runs over TLS. Data is encrypted on disk. Access to production data is limited to the people who need that access, and that access is logged.

A key you enter with us, such as a Shopify Admin token, goes through our server to the provider of that system and does not end up in a URL or in a log line.

We use sub-processors for hosting, map material and email. By name: Vercel for hosting and Mapbox for the map on the passport. Both are American and work under standard contractual clauses; the other sub-processors are in the European Economic Area.

Mapbox receives the IP address of whoever opens a passport with a map, and nothing else: we send no product data along and their usage measurement is off. Without a key the map falls back to a drawn version and nothing goes outside.

If we add one, we tell you thirty days in advance. If you do not agree, you may cancel without a notice period.

In case of a data breach we report it within 24 hours after we know, with what happened, which data it concerns and what we are doing about it. You then decide whether it goes to the Dutch Data Protection Authority.

If you receive a request for access, correction or deletion, we help you carry it out. If the request reaches us, we pass it on to you and do not answer it ourselves.

If you stop, you get an export of your data in a readable format and we delete the rest within thirty days, except what we are legally required to keep.

This environment is a prototype. There is no server running: what you enter stays in your own browser. The agreements above apply once the service runs in production, and not to what you do on this site now.