Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you (“Customer”, the controller) and SIA "MICRON" (“Processor”, “we”). It applies whenever we process personal data on your behalf, and satisfies Art. 28(3) GDPR.

It applies automatically to every customer of Tagjet. You do not need to sign a separate copy; using the Service constitutes acceptance. If your procurement process requires a countersigned document, write to privacy@tagjet.app.

Roles. You are the controller for personal data contained in the Documents you submit, and we are your processor. For account, billing and telemetry data we act as an independent controller, governed by the Privacy Policy rather than this DPA.

Precedence. In the event of a conflict on the subject of personal-data processing, this DPA prevails over the Terms. On all other subjects the Terms prevail. Where required transfer mechanisms apply, the Standard Contractual Clauses prevail over both.

We will process personal data only on your documented instructions, including with regard to international transfers, unless required otherwise by EU or Member State law — in which case we will inform you before processing, unless that law prohibits it on important grounds of public interest.

Your instructions consist of: this DPA, the Terms, the configuration you set in your account (including retention period, parse-only mode, and webhook endpoints), and the API requests you send. We will inform you if, in our opinion, an instruction infringes the GDPR or other applicable data-protection law.

We will not process personal data for our own purposes, will not sell it, and will not use Documents or Extracted Data to train or improve machine-learning models.

We ensure that every person authorised to process personal data under this DPA is bound by an appropriate obligation of confidentiality, whether contractual or statutory, and is subject to it after their engagement ends. Access is granted on a need-to-know basis, is restricted to what is necessary to operate, support and secure the Service, and is logged.

Taking account of the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing, we implement the measures required by Art. 32 GDPR, including:

• Encryption. TLS for all data in transit; encryption at rest for the database and object store; sensitive application fields encrypted with a dedicated key.
• Credential handling. Passwords stored with a modern password-hashing function; API keys stored only as salted hashes and displayed once at creation; optional two-factor authentication with backup codes; short-lived access tokens with httpOnly refresh cookies.
• Access control. Role-based authorisation, least-privilege credentials for infrastructure, a private object store with public access blocked, and an audit log of sensitive administrative actions.
• Network and application security. A TLS-terminating reverse proxy with strict security headers, per-account and per-IP rate limiting, input validation on every endpoint, parameterised queries, and an SSRF guard on URL-fetch requests.
• Segregation. Logical separation of customer data by account identifier throughout the data model and the object-store key layout; separate development, test and production environments.
• Availability and resilience. Automated backups of the database, health checks with graceful shutdown, a retrying job queue with dead-lettering, and monitored error and latency metrics.
• Data minimisation and deletion. Configurable retention with automatic expiry, parse-only mode that stores nothing, and a one-call erasure endpoint that removes stored originals together with the associated records.
• Traceability. Structured logs with a correlation identifier propagated across the web tier, the queue and the extraction pipeline.

We may update these measures as the Service evolves, provided the level of protection is not reduced. The current version of this page is the authoritative description.

You give general authorisation for us to engage sub-processors. Each is engaged under a written contract imposing data-protection obligations no less protective than those in this DPA, and we remain fully liable to you for their performance.

The named list is provided to you on request — write to privacy@tagjet.app and we will send the current sub-processors by name, including the automated extraction provider. We publish categories rather than names here so that changing a provider does not require republishing this agreement; your right to be informed and to object is unaffected.

We will give you at least thirty (30) days’ notice before adding or replacing a sub-processor. If you reasonably object on data-protection grounds within that period, we will work with you in good faith to find an alternative; if none is available, you may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees for the unused term.

Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise data-subject rights. The Service provides self-service means for most of this: results are retrievable by scan identifier, stored originals expire automatically, and an authenticated call to DELETE /api/me/data erases stored content together with the account. If a data subject contacts us directly about data we process on your behalf, we will not respond substantively and will refer them to you without undue delay.

We will notify you without undue delay after becoming aware of a personal data breach affecting personal data processed on your behalf, and will provide the information reasonably available to us to help you meet your own notification obligations under Art. 33 and 34 GDPR. We will also provide reasonable assistance with data protection impact assessments and prior consultation under Art. 35 and 36, taking into account the nature of the processing and the information available to us. Our notification is not an acknowledgement of fault or liability.

Hosting, the database and the object store are located in the European Union. Where a sub-processor processes personal data outside the EEA, the transfer is made under the European Commission’s Standard Contractual Clauses, an adequacy decision, or the EU–US Data Privacy Framework, with supplementary measures where appropriate. Where the Standard Contractual Clauses apply, you act as data exporter and the module applicable to controller-to- processor transfers is incorporated by reference, with the docking clause enabled and the annexes populated by Annex I and Annex II of this DPA.

We will make available to you the information reasonably necessary to demonstrate compliance with Art. 28 GDPR and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate. Audits must be requested in writing with at least thirty (30) days’ notice, take place no more than once in any twelve-month period (except where required by a supervisory authority or following a breach), occur during normal business hours, respect the confidentiality of our other customers and our infrastructure, and not unreasonably disrupt operations. We may satisfy an audit request by providing existing documentation, questionnaire responses or third-party reports where these reasonably address the request. Costs of an on-site audit are borne by you.

On termination of the Terms, or earlier on your written request, we will delete personal data processed on your behalf. Deletion of your account removes stored originals, scan records, extracted results, API keys, usage records and webhook delivery history. Export what you need before terminating — deletion is permanent and we cannot restore it. We may retain personal data to the extent required by EU or Member State law (for example invoice records retained for statutory accounting periods), in which case it remains subject to this DPA and is processed only for the purpose that requires its retention. Residual copies in routine encrypted backups are overwritten on the normal backup cycle.

You warrant and undertake that:

• you have a valid lawful basis for each Document you submit and for our processing of it as your processor;
• you have given all notices and obtained all consents required from the data subjects concerned;
• your instructions comply with applicable data-protection law and do not require us to act unlawfully;
• you will not submit special-category or criminal-conviction data absent separate written agreement; and
• you apply data minimisation — you do not send us personal data your purpose does not require.

You are responsible for the accuracy, quality and legality of the personal data you submit and for the means by which you acquired it.

Each party’s liability under this DPA is subject to the exclusions and the aggregate cap in §14 of the Terms — the greater of the fees paid in the preceding twelve months or EUR 100 — except where applicable law does not permit that limitation. Nothing in this DPA limits either party’s liability to a data subject under Art. 82 GDPR, or excludes liability that cannot lawfully be excluded. You will indemnify us against claims, fines and penalties arising from your breach of §11, as set out in §16 of the Terms.

This DPA takes effect when you first use the Service and continues until all processing on your behalf has ceased and the associated personal data has been deleted or returned. We may update it to reflect changes in the Service or in law, with reasonable notice, provided the level of protection is not reduced. It is governed by the laws of the Republic of Latvia, with the courts of the Republic of Latvia having exclusive jurisdiction, without prejudice to any supervisory authority’s competence. Data-protection enquiries: privacy@tagjet.app.