Data Processing Addendum

1. Parties and roles

The processor is IEMSuite, currently a pre-incorporation project operated by its founder, an individual resident in Poland. A limited-liability company (sp. z o.o.) is being formed; until it is registered no paid subscriptions are sold and the Service is provided free of charge in beta. On registration this section will show the company name, registered address, KRS, NIP and REGON, the version number will change, and continued use will require re-acceptance where the change is material. Contact: [email protected] (legal), [email protected] (privacy).

You are the controller of personal data relating to your customers, suppliers, employees and users that you or your users submit to or synchronise with the Service. IEMSuite is a separate controller for its own account, billing and security data (see the Privacy Policy).

2. Subject matter, duration, nature and purpose

Subject matter: provision of a cloud inventory, manufacturing and quality-management service. Duration: the subscription term plus the 30-day post-termination export window and any statutory retention. Nature and purpose: hosting, storage, synchronisation with connected systems, backup, support, troubleshooting, security monitoring.

3. Categories of data and data subjects

Special-category data: the Service is not designed for it. Except for occupational-safety incident records, you undertake not to submit special-category data; where you do, meeting Art. 9 conditions is your responsibility. Safety records are permission-gated and excluded from the AI assistant.

4. Controller obligations

You are responsible for the lawfulness of the processing and for informing data subjects (including your employees where production-floor features are used - see our guidance on employee monitoring), for the lawfulness of your instructions, and for not submitting data the Service is not designed for.

5. Processor obligations

1. Process only on your documented instructions (these Terms, the DPA, your configuration and use of the Service), including with regard to international transfers, unless required by EU or Member State law - in which case we inform you before processing unless the law prohibits it.
2. Ensure persons authorised to process the data are bound by confidentiality.
3. Implement the measures in Annex II (Art. 32).
4. Engage sub-processors only as set out in section 7, under written terms imposing the same obligations, and remain fully liable for them.
5. Assist you, taking into account the nature of the processing, in responding to data-subject requests (Arts. 15-22).
6. Assist you with Arts. 32-36 (security, breach notification, DPIAs, prior consultation).
7. At your choice delete or return all personal data at the end of the service (section 8).
8. Make available the information necessary to demonstrate compliance and allow audits (section 9).
9. Immediately inform you if an instruction, in our opinion, infringes data-protection law.

6. Personal-data breach

We notify you without undue delay, and in any event within 72 hours of becoming aware, of a personal-data breach affecting your data, describing its nature, the categories and approximate numbers of data subjects and records, likely consequences, and the measures taken or proposed. Notification may be phased as information becomes available. It does not replace your own duty to notify your supervisory authority.

7. Sub-processors and international transfers

You authorise the sub-processors listed at /subprocessors (Annex I). We give at least 14 days' notice of additions or replacements; you may object on reasonable data-protection grounds and, if unresolved, terminate the affected subscription without penalty. Transfers outside the EEA rely on an adequacy decision (Canada; EU-US Data Privacy Framework for certified US providers) or on the 2021 EU Standard Contractual Clauses with a transfer impact assessment, which we keep on file and share on request.

8. Termination, return and deletion

For 30 days after termination you may export all data yourself (Settings → Organisation, newline-delimited JSON) or request it from us in a structured, machine-readable format. After the window, uploaded files are deleted from storage, then every database record, and user accounts belonging to no other organisation are anonymised. Backup copies age out within 30 days. We retain only what EU or Member State law requires us to keep (our own billing records).

9. Audits and information

On request we provide the current sub-processor list, our security overview, the latest penetration-test summary and completed security questionnaires. You may audit, including through an independent auditor bound by confidentiality, once per year on 30 days' notice, at your cost, during business hours and without disrupting other tenants, where the documentation above is not sufficient.

10. Liability

Liability under this DPA is subject to the limitations and carve-outs in Terms §9 and §9.1; nothing limits either party's liability to data subjects under Art. 82 GDPR.

Annex I - Sub-processors

Annex II - Technical and organisational measures

• Encryption in transit (TLS 1.2+); passwords hashed (bcrypt/pbkdf2); integration tokens (Shopify, QuickBooks) encrypted at rest with AES-256-GCM; SEO/API credentials encrypted.
• Tenant isolation: every query scoped by organisation id; role-based access control with least privilege; optional or mandatory two-step verification for administrators; sessions invalidated on password change, role change or deactivation.
• Audit logging of workspace actions (12 months) and platform-admin actions (24 months); error monitoring with PII scrubbing; rate limiting; HMAC-verified webhooks; Content-Security-Policy with frame-ancestors restriction.
• Secure development: code review, typed APIs, automated tests, dependency vulnerability scanning, additive-only database migrations, independent penetration test (July 2026, all findings fixed), vulnerability disclosure policy (/security).
• Availability: EU hosting, daily backups with 30-day retention, documented incident-response runbook, quarterly restore tests.
• Data lifecycle: automatic retention sweeps, verified deletion of files before records, erasure tombstones for AI chat history.
• Organisational: single accountable owner until a team exists; access to production limited and logged; staff AI-literacy and security onboarding.

Annex III - Notification of changes

New or replaced sub-processors: e-mail to organisation administrators at least 14 days in advance, with the right to object. Changes to Annex II that reduce protection: 30 days' notice.