Data Processing Agreement

1. Definitions

"UK GDPR", "Personal Data", "processing", "controller", "processor", "data subject", and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018 ("Data Protection Laws"). "Sub-processor" means any processor engaged by us to process Personal Data on your behalf.

2. Roles and Scope

You are the controller and we are your processor in respect of the Personal Data described in Annex I. Each party will comply with its obligations under Data Protection Laws. You are responsible for the lawfulness of the Personal Data you provide and of your instructions, and for ensuring you have a lawful basis and all necessary notices and consents. Because Hosted Pages are public, you must not place Personal Data in any public DPP field.

The core Service processes Product Data, which is commercial business information and generally does not contain Personal Data. This DPA applies only to the limited extent that we process Personal Data on your behalf in providing the Service.

No direct identification of consumers. The Service does not collect or store data that directly identifies a consumer or any individual who scans a Code. Scan data is limited to the approximate location described in the Terms and is not linked by us to any identifiable individual. We do not process special category Personal Data, and we do not build consumer profiles. If you choose to add your own tracking or data capture into your Hosted Pages, that processing is yours as controller and falls outside this DPA.

Account data (processed by us as controller). As part of account management we collect and store the names and business email addresses of your authorised users, together with your company contact details. We process this account data as a controller (not as processor under this DPA) in order to administer accounts, provide support and billing, and keep your users informed about system functionality updates, security notices, and similar service communications. This processing is described in our Privacy Policy.

3. Our Processing Obligations

We will:

• process Personal Data only on your documented instructions (including those set out in the Terms and this DPA), unless required to do otherwise by law, in which case we will inform you unless legally prohibited;
• ensure that persons authorised to process Personal Data are bound by appropriate confidentiality obligations;
• implement and maintain the technical and organisational security measures described in Annex II, taking account of Article 32 of the UK GDPR;
• taking into account the nature of the processing, assist you by appropriate measures, insofar as possible, to respond to requests from data subjects exercising their rights;
• assist you in ensuring compliance with your obligations under Articles 32 to 36 of the UK GDPR (security, breach notification, data protection impact assessments, and prior consultation), taking into account the nature of processing and the information available to us;
• at your choice, delete or return all Personal Data to you after the end of the provision of the Service, and delete existing copies unless legal requirements (or, in respect of Hosted Pages, an active EU 10-Year Hosting Guarantee under the Terms) require continued storage.

4. Personal Data Breach

We will notify you without undue delay, and in any event within 72 hours of becoming aware, of any personal data breach affecting Personal Data we process on your behalf, and will provide information reasonably available to us to help you meet your own notification obligations. You are responsible for notifying the Information Commissioner's Office and affected data subjects where required.

5. Sub-processors

You provide general authorisation for us to engage Sub-processors to process Personal Data, provided that we impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remain responsible to you for their performance. The categories of Sub-processor we engage are set out in Annex III, and the current list of named Sub-processors is available to any client with an active account on request at any time. We will inform you of any intended addition or replacement of a Sub-processor and give you at least 30 days to object on reasonable data-protection grounds.

6. International Transfers

By signing up to and using the Service, you specifically authorise and instruct us to host and process your data in the United Kingdom, unless a different hosting location is specifically agreed with you in writing. Where any Sub-processor processes Personal Data outside the United Kingdom, we will not make that transfer unless an appropriate safeguard is in place, namely the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any supplementary measures required.

The United Kingdom is our default hosting location, and customers in other regions, including the European Union and the United States, are normally served from our UK servers. Where specifically agreed with you in writing, the Service itself may instead be hosted in another region, for example a European Union or United States data-centre instance, which we may add for a client or reseller partner that requires local hosting. Even in that case, you acknowledge and agree that account management is carried out from our United Kingdom office using UK-based servers, and that your business account information (the names and business email addresses of your authorised users and your company contact details) will be stored in the United Kingdom.

7. Audit and Information

We will make available to you information reasonably necessary to demonstrate compliance with this DPA, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate, on reasonable prior notice, no more than once per year except where required by a supervisory authority or following a personal data breach, subject to confidentiality and to not compromising the security of other customers.

8. Liability and Duration

This DPA takes effect on the start of the Terms and continues for as long as we process Personal Data on your behalf, including any period covered by an EU 10-Year Hosting Guarantee. Liability under this DPA is subject to the limitations of liability in the Terms of Use. In the event of conflict between this DPA and the Terms in respect of the processing of Personal Data, this DPA prevails.

Annex I — Details of Processing

• Subject matter: provision of the id.codes Service, including GS1 code generation, hosting and resolution of Digital Product Passports and Hosted Pages.
• Duration: the term of the Terms, plus any EU 10-Year Hosting Guarantee period.
• Nature and purpose: hosting, storing, organising, reproducing, translating, routing, and displaying Product Data; serving Hosted Pages; recording approximate scan-location data for product-location reporting to you.
• Types of Personal Data: the names and business email addresses of your authorised users, and your company contact details (held by us as controller for account management); approximate, non-identifying scan-location data; and any Personal Data you choose to include in Product Data, which should be minimised and must not appear in public fields. The Service does not store data that directly identifies a consumer.
• Categories of data subject: your personnel and authorised users; and, in the limited non-identifying form described above, individuals who scan Codes.

Annex II — Security Measures

Technical and organisational measures include: hosting in a UK Tier IV, ISO 27001 certified data centre; encryption of data in transit (TLS) and at rest; role-based access controls and least-privilege access; logging and monitoring; resilience and backup arrangements supporting the EU 10-Year Hosting Guarantee; and staff confidentiality undertakings and data-protection training. Credentials you provide for Connected Systems are encrypted using a hardware-backed, non-exportable key held in a Hardware Security Module certified to FIPS 140-2 Level 3 (Google Cloud Key Management Service) and are stored only as ciphertext. We review these measures periodically and update them to maintain a level of security appropriate to the risk.

Annex III — Sub-processors

We engage the following categories of Sub-processor to provide the Service. The current list of named Sub-processors may be requested by any client with an active account at any time, and we will notify you of changes in line with Section 5.

• Hosting and data-centre provider (United Kingdom) - hosting and resolution of Codes and Hosted Pages.
• Email delivery provider - account, support, and service-update communications.
• Payment processor - subscription billing.
• Optional AI translation provider - used only where you choose to enable AI-assisted translation.

Contact

For any data-protection matter under this DPA, please send us a message. id.codes is a trading name of Fashion Business Collective Ltd, London, United Kingdom.