Data processing agreement

This agreement sets out how we process personal data for companies that use TagOrbit, as Article 28 of the GDPR requires. It applies automatically when a company creates a TagOrbit account.

1. Parties and scope

This data processing agreement is made between:

• ΑΦΟΙ ΚΑΛΟΦΟΡΙΔΗ ΟΕ (AFOI KALOFORIDI OE), Chr. Smirnis 67, 151 21 Athens, Greece, company registration (Γ.Ε.ΜΗ.) 069222103000 ("we", "us", the processor), and
• the company that uses TagOrbit ("you", "the customer", the controller).

It is part of our terms of service. It takes effect when a company creates a TagOrbit account, and it lasts as long as we process personal data for that company. You do not need to sign it. If your company needs a signed copy, write to us.

This agreement covers the personal data that the customer and its users put into TagOrbit. It also covers the account data of the customer's users, as far as we process it to provide TagOrbit to the customer. We also use account data for our own purposes, such as signing people in and keeping TagOrbit secure. Our privacy policy covers that use, and our public website.

Where this agreement and the terms of service disagree about personal data, this agreement prevails. Changes to this agreement follow the rules for changes in the terms of service.

2. Roles of the parties

The controller decides why and how personal data is used. The processor uses it only on the controller's behalf.

• The customer is the controller. It decides what it records in TagOrbit, whom it invites and which role each person gets. It is responsible for having a lawful basis for the personal data it records, and for informing the people concerned.
• We are the processor. We process the data only to provide TagOrbit to the customer, and only on its instructions.

Records about staff. TagOrbit records who holds which item and who made each change. In some countries, records like these bring extra duties for employers, for example consulting a works council in Germany. Meeting those duties is the customer's responsibility. We give the customer the information it reasonably needs for this, for example for a data protection impact assessment (an assessment of the risks of the processing).

3. Our obligations

• Documented instructions. We process personal data only on the customer's documented instructions. This includes sending data to other countries. The instructions are this agreement, the terms of service, and the settings and actions the customer's users choose in TagOrbit. If European Union law or the law of a European Union country requires us to do otherwise, we tell the customer first, unless that law forbids it. If we think an instruction breaks data protection law, we tell the customer at once.
• Confidentiality. Everyone we authorise to process the data is bound to keep it confidential.
• Security. We apply the measures in Annex 2, as Article 32 of the GDPR requires.
• Sub-processors. We use sub-processors only as section 4 describes.
• Requests from data subjects. We help the customer answer requests from the people whose data it records (Articles 15 to 22 of the GDPR), as far as the nature of the processing allows. The customer can find, correct and export records itself in TagOrbit. Where that is not enough, for example to erase a person's data completely, the customer can write to us and we will help.
• Security, breaches and assessments. We help the customer meet its duties under Articles 32 to 36 of the GDPR, taking into account the information available to us. These duties cover security, notifying breaches, data protection impact assessments and prior consultation (asking the authority before high-risk processing).
• Deletion or return. At the end, we return or delete the data as section 6 describes.
• Information and audits. We provide information and allow audits as section 7 describes.

4. Sub-processors

A sub-processor is another company that processes the customer's personal data for us, so that we can provide TagOrbit.

• The customer gives us general permission to use the sub-processors listed in Annex 3.
• Before we add or replace a sub-processor, we tell the customer's administrators by e-mail, so that the customer can object.
• If the customer objects on reasonable data protection grounds, we look for a solution together. If there is none, the customer may end the agreement.
• Each sub-processor is bound by contract to the same data protection obligations as this agreement. We remain fully liable to the customer for their work.

5. Personal data breaches

If a breach affects personal data we process for the customer, we tell the customer without undue delay after we become aware of it. Our message describes:

• what happened;
• the kinds of data and the approximate number of people and records concerned;
• the likely consequences;
• what we have done or propose to do about it;
• whom to contact for more information.

If we cannot give all of this at once, we give it in stages, without further undue delay.

6. Deletion and return of data

• The customer can export its data at any time as CSV or Excel files.
• When the agreement ends, the customer first gets the chance to export its data. Then we delete the personal data we process for the customer from TagOrbit, unless European Union law or the law of a European Union country requires us to keep it.
• Copies in our daily backups are deleted after 14 days, and copies in our weekly backups after 90 days. We also keep one backup from the first day of each month; these monthly backups do not have a set end date yet.
• AI requests and error reports are deleted after 30 days at the latest, and together with the customer's data when that is deleted.
• The customer can ask us in writing to delete its data sooner, and we will do so.

7. Information and audits

• On written request, we give the customer the information it needs to check that we meet Article 28 of the GDPR. This includes a description of our security measures and the current list of sub-processors.
• If that information is not enough, the customer may audit us, itself or through an independent auditor who is bound by confidentiality and is not our competitor.
• Audits must be announced in reasonable time, take place during business hours and not disrupt our work more than necessary.

8. International transfers

The customer's data is stored in the European Union, on servers of Hetzner Online GmbH in Nuremberg, Germany. Some sub-processors in Annex 3 are based in the United States.

When personal data goes to a provider outside the European Economic Area, the transfer is made under the European Commission's Standard Contractual Clauses (contract terms the Commission has approved for this purpose) and, where the provider is certified, under the EU-US Data Privacy Framework.

9. Liability

Towards the people whose data is processed, each party is liable as Article 82 of the GDPR provides. Between the customer and us, the limits of liability in the terms of service apply, as far as the law allows. We remain fully liable to the customer for the work of our sub-processors.

10. Governing law and courts

This agreement is governed by the laws of Greece. The competent courts of Athens, Greece, decide any dispute about it.

Annex 1: Details of the processing

Subject matter. Providing TagOrbit to the customer.

Duration. For as long as the agreement lasts, plus the deletion periods in section 6.

Nature and purpose. We store, organise, show, search, report on, export, back up and delete the data the customer records in TagOrbit. When a user asks an AI feature for help, we send what the feature needs to Anthropic and show the answer to the user. We send account e-mails. We keep AI requests and error reports for 30 days to find and fix problems. The purpose is to let the customer track what it owns, who holds it, what it needs and when.

Types of personal data. Whatever the customer records, for example:

• the names, e-mail addresses and phone numbers of its staff, customers and suppliers;
• custody history: who held which item, and when;
• notes, and the values of any fields the customer adds;
• documents and photos it uploads, such as receipts and invoices;
• the history of changes: who made each change, when, and the values before and after;
• the account data of the customer's users: name, e-mail address and role;
• AI requests and error reports, linked to the user who made them, for 30 days.

Categories of data subjects.

• the customer's staff;
• the customer's customers, suppliers and other contacts;
• the people the customer invites to use TagOrbit;
• any other person the customer chooses to record.

Special categories of data. TagOrbit is not built for special categories of personal data, such as health data (Article 9 of the GDPR). The customer decides what it records. If it records such data, it is responsible for having a lawful basis.

Annex 2: Technical and organisational measures

• Location. TagOrbit's database, files and backups are on servers of Hetzner Online GmbH in Nuremberg, Germany.
• Encryption in transit. All connections use HTTPS. Traffic reaches our servers through an encrypted tunnel.
• Separation of customers. Every company's data is kept apart from every other company's by rules inside the database itself (row-level security), not only by the application.
• Roles. Within a company, the roles Admin, Editor and Viewer limit who can change what.
• History. Every change is logged with its author and time, and with the values before and after.
• Backups. We back up all data every day. Daily backups are kept 14 days, weekly backups 90 days. We also keep one backup from the first day of each month; these monthly backups do not have a set end date yet.
• AI features. They send only what the feature needs. AI never changes data by itself: a user always decides. There is a daily usage limit per company.
• Support data. AI requests and error reports are kept 30 days and are not shown in the application.

Annex 3: Sub-processors

This list is current as of the date at the top of this page.

Questions about this agreement

For any question about this agreement, to ask for a signed copy, to object to a sub-processor or to arrange an audit, write to us:

• ΑΦΟΙ ΚΑΛΟΦΟΡΙΔΗ ΟΕ (AFOI KALOFORIDI OE)
• Chr. Smirnis 67, 151 21 Athens, Greece
• Company registration (Γ.Ε.ΜΗ.): 069222103000
• VAT number (Α.Φ.Μ.): 999267630
• E-mail: info@tagpulse.ai