1.WHO THIS AGREEMENT IS BETWEEN, AND WHEN IT APPLIES
1.1.This Data Processing Agreement (the “DPA”) is between Trustloom UAB, legal entity code 308100906, registered office at Jasinskio g. 12, LT-01112 Vilnius (“Trustloom”, “we”) and the customer identified in the account through which the Trustloom Terms and Conditions (the “Terms”) were accepted (“Customer”, “you”).
1.2.This DPA forms part of the Agreement between us under Clause 1.3 of the Terms. It is accepted when you accept the Terms and requires no separate signature. A countersigned copy is available on request.
1.3.This DPA applies only to Customer Personal Data as defined in Clause 2. It does not apply to the personal data contained in Reports, to account, billing and usage data, or to the identifiers you enter to order Reports and your order history, all of which we process as an independent controller under Clause 19 of the Terms. If you do not upload Customer Personal Data to such a feature, this DPA does not apply.
1.4.Terms defined in the Terms have the same meaning in this DPA. “GDPR” means Regulation (EU) 2016/679, and “controller”, “processor”, “sub-processor”, “personal data”, “processing”, “data subject”, “supervisory authority” and “personal data breach” have the meanings given in the GDPR.
2.WHAT WE PROCESS FOR YOU
2.1.“Customer Personal Data” means personal data about natural persons that you upload to a screening, monitoring or validation feature of the Services, where we offer one, for processing on your instructions, together with the results of that processing insofar as they are returned to you as part of your account. It does not include the identifier you enter to order a Report, such as a company name or registration code.
2.2.The subject matter, duration, nature and purpose of the processing, and the categories of data subject and of personal data, are set out in Annex 1.
2.3.You are the controller of Customer Personal Data and we are your processor. You determine the purposes and means of that processing. We process Customer Personal Data only in order to provide the Services to you.
3.YOUR INSTRUCTIONS
3.1.We will process Customer Personal Data only on your documented instructions. Your documented instructions are: (a) the Terms and this DPA; (b) the configuration choices and requests you make through the Services; and (c) any further written instruction you give us that is consistent with the Agreement.
3.2.We may process Customer Personal Data otherwise than on your instructions where required to do so by Union or Member State law to which we are subject. In that case we will inform you of the legal requirement before processing, unless that law prohibits us from doing so on important grounds of public interest.
3.3.We will inform you without delay if, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection law. We may suspend performance of that instruction until it is confirmed or withdrawn.
4.YOUR RESPONSIBILITIES
4.1.You warrant that you have a lawful basis under Article 6(1) GDPR for uploading Customer Personal Data to the Services and for the processing you instruct, and that you have provided data subjects with the information required by Articles 13 and 14 GDPR.
4.2.You must not upload personal data revealing special categories under Article 9 GDPR, or personal data relating to criminal convictions and offences under Article 10 GDPR. The Services are not designed to receive such data. If you do so in breach of this Clause, you are solely responsible for the consequences and Clause 22 of the Terms applies.
4.3.You must not upload personal data about individuals other than those connected with a commercial counterparty you are assessing for the Use, and must not upload more personal data than is necessary for that purpose.
5.CONFIDENTIALITY OF OUR PERSONNEL
5.1.We will ensure that persons authorised to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that they process Customer Personal Data only on our instructions.
6.SECURITY
6.1.We will implement and maintain the technical and organisational measures described in Annex 3, and such other measures as are appropriate to the risk under Article 32 GDPR, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing.
6.2.We may update Annex 3 from time to time provided that the updated measures do not materially reduce the overall level of security.
7.SUB-PROCESSORS
7.1.You give us general written authorisation to engage sub-processors. The sub-processors we engage at the effective date of this DPA are listed in Annex 2, together with their location and, where they are outside the European Economic Area, the transfer safeguard relied on.
7.2.We will give you at least 30 days’ notice of any intended addition or replacement of a sub-processor, by email to your registered address or by notice within the Services, and will update Annex 2 accordingly.
7.3.You may object to the addition or replacement of a sub-processor on reasonable data protection grounds by written notice within that 30-day period. If we cannot accommodate your objection, you may terminate the affected Services by written notice, and we will refund any Fees paid for the unexpired part of a paid Subscription period. If you do not object within the period, the change is deemed accepted.
7.4.We will impose on each sub-processor, by written contract, data protection obligations that are no less protective than those in this DPA, and we remain fully liable to you for the performance of each sub-processor’s obligations.
8.INTERNATIONAL TRANSFERS
8.1.We will not transfer Customer Personal Data to, or permit it to be accessed from, a country outside the European Economic Area, and will not permit a sub-processor to do so, unless an appropriate safeguard under Chapter V GDPR is in place: an adequacy decision of the European Commission, or the standard contractual clauses adopted by the European Commission together with any supplementary measures required by our transfer impact assessment.
8.2.Annex 2 identifies each sub-processor located outside the European Economic Area and the safeguard relied on. On request we will provide a summary of our transfer impact assessment.
9.ASSISTANCE WITH DATA SUBJECT RIGHTS
9.1.Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as this is possible, in fulfilling your obligation to respond to requests from data subjects to exercise their rights under Chapter III GDPR.
9.2.If we receive a request directly from a data subject which relates to Customer Personal Data, we will forward it to you within 3 Business Days and will not respond to it on your behalf, except to acknowledge receipt and to inform the data subject that the request has been forwarded to you.
10.ASSISTANCE WITH SECURITY, BREACH NOTIFICATION AND IMPACT ASSESSMENT
10.1.Taking into account the nature of the processing and the information available to us, we will assist you in ensuring compliance with your obligations under Articles 32 to 36 GDPR.
10.2.We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, so far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as it becomes available.
10.3.We will provide reasonable assistance with any data protection impact assessment and any prior consultation with a supervisory authority that you are required to carry out in relation to the processing under this DPA.
11.DELETION AND RETURN
11.1.On termination of the Agreement, or earlier on your written request, we will, at your election, delete or return to you all Customer Personal Data, and delete existing copies, unless Union or Member State law requires us to retain it.
11.2.If you do not make an election within 30 days of termination, we will delete the Customer Personal Data. Deletion from backup media occurs in accordance with our backup rotation cycle and in any event within 90 days.
11.3.Deletion under this Clause does not affect the Trustloom Database or any Report, which we process as an independent controller under Clause 19 of the Terms.
12.INFORMATION AND AUDIT
12.1.We will make available to you all information necessary to demonstrate compliance with Article 28 GDPR and this DPA. In the first instance we will do so by providing, on request, our current security documentation, any third-party certifications or audit reports we hold, and written answers to reasonable questions.
12.2.Where that information is not sufficient to demonstrate compliance, you or an independent auditor mandated by you (and bound by confidentiality) may audit our compliance with this DPA, on not less than 30 days’ written notice, no more than once in any 12-month period unless required by a supervisory authority or following a personal data breach, during normal business hours, at your cost, and in a manner that does not unreasonably disrupt our operations or compromise the security of other customers’ data.
13.NO TRAINING ON CUSTOMER PERSONAL DATA
13.1.We do not use Customer Personal Data to train, fine-tune or improve any artificial intelligence or machine learning model, and we contractually prohibit our sub-processors from doing so.
14.LIABILITY
14.1.Each party’s liability under or in connection with this DPA is subject to Clause 21 of the Terms. Nothing in this DPA limits a party’s liability to a data subject under Article 82 GDPR.
15.TERM, PRECEDENCE AND CHANGES
15.1.This DPA takes effect when you first upload Customer Personal Data to a feature of the Services described in Clause 2.1, and continues for as long as we process Customer Personal Data on your behalf.
15.2.In respect of the processing of Customer Personal Data, this DPA prevails over any conflicting provision of the Terms. In all other respects, the Terms prevail.
15.3.We may amend this DPA in accordance with Clause 26 of the Terms. Changes to Annex 2 are governed by Clause 7 of this DPA. Changes to Annex 3 are governed by Clause 6.2 of this DPA.
15.4.This DPA is governed by the law of the Republic of Lithuania, and Clause 30 of the Terms applies to any dispute arising under it.
ANNEX 1 — DETAILS OF PROCESSING
Subject matter | Processing of personal data that the Customer uploads to a screening, monitoring or validation feature of the Services, such as screening individuals named by the Customer against sanctions and PEP lists, and delivery of the results to the Customer’s account |
|---|---|
Duration | The term of the Agreement, plus the deletion period in Clause 11 |
Nature of processing | Receipt, storage, name-matching and entity resolution, retrieval, presentation to the Customer, and erasure |
Purpose | Producing the screening or validation results requested by the Customer, for the Customer’s due diligence of its commercial counterparties |
Categories of data subject | Individuals identified by the Customer as directors, officers, owners, representatives or other persons connected with a counterparty; |
Categories of personal data | Names; role or position; company or registration references supplied by the Customer; nationality or country where supplied; |
Special categories and criminal offence data | None. The Customer must not upload such data (Clause 4.2). |
Frequency | Continuous, as initiated by the Customer |
ANNEX 2 — SUB-PROCESSORS
Sub-processor | Service | Location | Transfer safeguard |
|---|---|---|---|
Amazon Web Services EMEA SARL | Infrastructure hosting and storage | Frankfurt, Germany (eu‑central‑1) | n/a — EEA |
ANNEX 3 — TECHNICAL AND ORGANISATIONAL MEASURES
Access control. Role-based access on a least-privilege basis; multi-factor authentication for all administrative and production access; individual named accounts; prompt removal of access on role change or departure; quarterly access review.
Encryption. Encryption of Customer Personal Data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent); key management with segregation of duties.
Network and infrastructure security. Segregation of production from development and test environments; firewalling and network access controls; hardened baseline configurations; logging of administrative actions.
Logging and monitoring. Centralised logging of access to Customer Personal Data; alerting on anomalous access; log retention of at least 12 months.
Secure development and change management. Code review; dependency and vulnerability scanning; documented change approval; no Customer Personal Data in non-production environments.
Vulnerability management. Regular vulnerability scanning; patching within defined timescales by severity; periodic independent penetration testing.
Backup and continuity. Encrypted backups; tested restoration; documented business continuity and disaster recovery arrangements.
Personnel. Confidentiality undertakings; data protection and security training on joining and annually; AI literacy training under Article 4 of Regulation (EU) 2024/1689.
Supplier management. Due diligence on sub-processors; written contracts under Clause 7.4; periodic review.
Incident response. Documented incident response procedure; breach assessment and notification workflow meeting the 48-hour commitment in Clause 10.2.
Data minimisation and pipeline controls. Technical measures preventing the ingestion of special category and criminal offence data from Customer uploads; hard block on the output of national personal identification numbers.