Data processing agreement (DPA)

• Controller: the customer, that is, the organisation that subscribes to Granel.
• Processor: Thinktier OÜ, Estonian registry code 17249293, VAT EE102949399, Lõõtsa tn 5, 11415 Tallinn, Estonia.

The data Thinktier processes as controller — each user’s account data, billing data and contact form data — is governed by the privacy policy, not by this agreement.

• Subject matter: the personal data the customer enters into the Service or sends to it through the capture channels.
• Duration: that of the contractual relationship, plus the time needed to return or delete the data under section 10.
• Nature: hosting, storage, retrieval, calculation, export and, where the customer uses capture, AI-assisted extraction of the text of messages.
• Purpose: solely to provide the Service to the customer.

• Data subjects: the customer’s users; the contact people at its counterparties (customers, suppliers, forwarders and others); and the senders of the messages the customer forwards for capture.
• Data: name, email, phone number and messaging username; the full text of captured messages; the commercial deal data linked to those people; the documents the customer uploads, and an extract of the customer’s catalogue (name, type and country of up to 20 counterparties; name, category and unit of up to 20 products) sent with each message for AI extraction.
• Special categories: the Service is not designed for them and the customer undertakes not to enter them.

Thinktier processes the data only on the customer’s documented instructions — these terms and the way the customer configures the Service — including with regard to international transfers, unless Union or Member State law requires otherwise; in that case it will inform the customer before processing, unless that law prohibits it. If Thinktier considers that an instruction infringes the GDPR, it will tell the customer immediately.

The people Thinktier authorises to process the data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.

Thinktier applies the technical and organisational measures required by Article 32 GDPR. Those in place today are described on the security page, including:

• isolation of each organisation’s data through row-level security policies in the database;
• a second authentication factor (TOTP) that each user can enable and that, once enabled, the database also enforces;
• API keys stored only as a hash, with a limited role, expiry and revocation;
• an insert-only audit log and rate limits on sign-in, the API and webhooks.

The customer gives a general authorisation for Thinktier to engage the sub-processors listed in the privacy policy. Thinktier will inform the customer of any addition or replacement before it takes place, so that the customer can object, and will impose on each sub-processor, by contract, data protection obligations equivalent to those in this agreement. Thinktier remains liable to the customer for its sub-processors’ compliance.

Some sub-processors process data outside the European Economic Area; in particular, text sent for AI-assisted extraction is processed in the United States. The transfers and their safeguards are described in the privacy policy.

• Data subject rights: Thinktier assists the customer, through appropriate technical and organisational measures, in responding to requests for access, rectification, erasure, restriction, portability and objection. The customer can view and correct its data from the Service itself and export as CSV or Excel its deals and cost lines, counterparties and products; the rest (payments, contracts, claims, comments and issued documents) is delivered by Thinktier on written request. If a data subject contacts Thinktier directly, they will be referred to the customer.
• Personal data breaches: Thinktier will notify the customer without undue delay of any breach affecting personal data it processes on the customer’s behalf, with the information available to it so that the customer can comply with Articles 33 and 34 GDPR.
• Impact assessments and prior consultation: Thinktier will provide the information within its reach that the customer needs for them.

When the provision of the Service ends, and at the customer’s choice, Thinktier will return or delete the data, together with existing copies, unless the law requires them to be kept. While the organisation exists, the customer can export its deals, counterparties and products as CSV or Excel from the Service; the rest of its data is delivered on written request. Deletion is requested in writing to privacy@granel.io.

Thinktier will make available to the customer the information needed to demonstrate compliance with this agreement and will allow for and contribute to audits, including inspections, carried out by the customer or an auditor it mandates, on terms the parties will agree in writing.

For any question about this agreement, write to privacy@granel.io.