Data Processing Agreement

1.1 The parties. This DPA is entered into between:

• CycleForge — the Service is operated by [LEGAL ENTITY NAME], located at [REGISTERED ADDRESS] (“CycleForge,” “we,” “us,” “our”); and
• The Customer — the business (a used-goods reseller) that subscribes to the Service and accepts the Terms of Service (“Customer,” “you,” “your”).

CycleForge and the Customer are each a “party” and together the “parties.”

1.2 Role of the parties. With respect to Customer Personal Data (as defined in Annex I and the Privacy Policy), the parties acknowledge and agree that:

• The Customer is the Controller (or, where the Customer is itself acting as a processor for a third party, the Customer is a processor and CycleForge is a sub-processor); and
• CycleForge is the Processor, Processing Customer Personal Data on the Customer’s behalf and on its documented instructions.

This DPA addresses only that Processor relationship. For Account Data and Usage/Telemetry Data — described in the Privacy Policy — CycleForge acts as an independent Controller, and that Processing is governed by the Privacy Policy, not by this DPA.

1.3 Incorporation and order of precedence. This DPA is incorporated into and forms an integral part of the Terms of Service. The Terms of Service, the Privacy Policy, and this DPA are intended to be read together. In the event of a conflict:

1. the Standard Contractual Clauses (where they apply under Section 11) prevail over this DPA on matters within their scope;
2. this DPA prevails over the body of the Terms of Service and the Privacy Policy on any matter concerning the protection of Customer Personal Data; and
3. the Terms of Service otherwise control.

This DPA is governed by the same governing law and venue as the Terms of Service — [GOVERNING-LAW STATE], USA — except where Data Protection Laws or the Standard Contractual Clauses require otherwise.

For the purposes of this DPA:

• “Data Protection Laws” means all laws and regulations applicable to the Processing of Personal Data under this DPA, including, as applicable: the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); the GDPR as it forms part of the law of the United Kingdom (“UK GDPR”) together with the UK Data Protection Act 2018; and the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (“CCPA”).
• “Personal Data” means any information relating to an identified or identifiable natural person, and includes “personal information” as defined under the CCPA, that is contained within Customer Data and Processed by CycleForge under this DPA (“Customer Personal Data”).
• “Processing” (and “Process”) means any operation performed on Personal Data, whether or not by automated means — such as collection, recording, organization, storage, retrieval, use, transmission, disclosure, erasure, or destruction.
• “Data Subject” means the identified or identifiable natural person to whom Personal Data relates; this includes a “consumer” under the CCPA.
• “Sub-processor” means any third party engaged by CycleForge to Process Customer Personal Data on CycleForge’s behalf in order to provide the Service.
• “Supervisory Authority” means an independent public authority responsible for monitoring the application of Data Protection Laws, including the UK Information Commissioner’s Office and the relevant data protection authorities in the EEA.
• “Standard Contractual Clauses” or “SCCs” means (a) the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission in Decision (EU) 2021/914 (the “EU SCCs”); and (b) the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (“UK Addendum”).
• “Business,” “Service Provider,” “Sell,” “Share,” and “Business Purpose” have the meanings given in the CCPA. As between the parties, the Customer is the Business and CycleForge is the Service Provider.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise Processed.

“Controller” and “Processor” have the meanings given under GDPR/UK GDPR.

3.1 Scope of Processing. CycleForge will Process Customer Personal Data only for the purposes of providing, maintaining, securing, and supporting the Service in accordance with the Terms of Service, this DPA, and the Customer’s lawful, documented instructions. The subject matter, nature, purpose, duration, categories of Data Subjects, and types of Customer Personal Data are described in Annex I.

3.2 Documented instructions. The Customer’s complete and final set of instructions to CycleForge in respect of Customer Personal Data consists of:

• the Terms of Service and this DPA;
• the Customer’s configured use of the Service — including the integrations the Customer connects with its own credentials, the data the Customer imports or enters, the workflow node-graphs the Customer builds, and the settings the Customer selects; and
• any further written instructions agreed by the parties.

CycleForge will not Process Customer Personal Data for any other purpose, and in particular will not Process it for CycleForge’s own independent commercial purposes, except as permitted by Section 14 (CCPA) and the Privacy Policy.

3.3 Unlawful instructions. CycleForge will inform the Customer if, in its reasonable opinion, an instruction infringes Data Protection Laws, and may suspend the affected Processing (without liability) until the instruction is confirmed, amended, or withdrawn. CycleForge is not obligated to perform a legal review of the lawfulness of the Customer’s instructions.

3.4 Compliance with law. Each party will comply with its respective obligations under Data Protection Laws. Where CycleForge is required by applicable law to Process Customer Personal Data other than on the Customer’s instructions, it will (unless legally prohibited) inform the Customer of that legal requirement before Processing.

The Customer, as Controller, represents, warrants, and undertakes that:

• Lawful basis. It has, and will maintain throughout the term, a valid lawful basis under Data Protection Laws for the Processing of Customer Personal Data via the Service, including for the end-customer / buyer Personal Data (names, shipping addresses, emails, phone numbers) it imports from connected marketplaces and records from walk-in sales.
• Notices and consents. It has provided all required privacy notices to, and obtained all required consents or authorizations from, the relevant Data Subjects (including its Authorized Users, buyers, and suppliers) so that CycleForge’s Processing under this DPA is lawful.
• Accuracy and right to transfer. The Customer Data it submits is accurate, lawfully obtained, and that it has the right to transfer it to CycleForge and to authorize the Processing described in this DPA.
• Special-category data. It will not upload, import, or otherwise cause CycleForge to Process special categories of Personal Data (Article 9 GDPR), data relating to criminal convictions (Article 10 GDPR), or other sensitive data beyond the categories the Service is designed to handle (Annex I). The Service is a reseller-operations platform; it is not designed or intended to Process special-category data.
• Connected integrations. Where the Customer connects third-party integration partners using its own credentials (e.g. Amazon SP-API, eBay, Ecwid, Square, Zoho, Google, Zendesk, and the carriers UPS / FedEx / USPS), and Customer-controlled infrastructure (its own NAS over WebDAV, and its own local Ollama LLM via its Cloudflare tunnel), those are the Customer’s relationships and instruments, not CycleForge Sub-processors, and the Customer is responsible for its compliance and configuration in respect of them, as further described in the Privacy Policy and Terms of Service.

CycleForge will ensure that any person it authorizes to Process Customer Personal Data:

• is subject to a binding contractual or statutory duty of confidentiality;
• Processes Customer Personal Data only on CycleForge’s instructions and as necessary to perform their role; and
• has received appropriate training on their responsibilities under Data Protection Laws and CycleForge’s security policies.

Access to Customer Personal Data is granted on a least-privilege, need-to-know basis (see Annex II).

6.1 Technical and organizational measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to Data Subjects, CycleForgewill implement and maintain appropriate technical and organizational measures designed to ensure a level of security appropriate to the risk, in accordance with Article 32 GDPR / UK GDPR. Those measures are described in Annex II and include, among others: encryption in transit (TLS 1.2+) and at rest; AES-256-GCM encryption of integration credentials in a KMS-keyed secret vault; PostgreSQL Row-Level Security for hard per-tenant isolation under a non-bypass database role; role-based access control; full audit logging; and rate-limiting.

6.2 No reduction in protection. CycleForgemay update or modify the measures in Annex II from time to time, provided that such updates do not materially reduce the overall level of security of the Service.

6.3 No certifications claimed. CycleForgedoes not, by this DPA, represent that it holds any specific third-party security certification or attestation (for example SOC 2, ISO/IEC 27001, or HIPAA) unless and except as separately and expressly stated in writing.

7.1 General authorization. The Customer provides CycleForge with general written authorization to engage Sub-processors to Process Customer Personal Data, subject to this Section 7. The Sub-processors engaged as at the Effective Date are listed in Annex III.

7.2 Notice of changes and right to object. CycleForge will notify the Customer of any intended addition or replacement of a Sub-processor (for example by updating Annex III and/or the Sub-processor page referenced in the Privacy Policy, and/or by email to the Customer’s billing or administrative contact) at least [NUMBER, e.g. 14] days before the new Sub-processor begins Processing Customer Personal Data, giving the Customer the opportunity to object on reasonable, documented data-protection grounds. The parties will work together in good faith to resolve the objection. If the objection cannot be reasonably resolved and CycleForge nonetheless proceeds, the Customer may, as its sole remedy, terminate the affected subscription and receive a pro-rata refund of any prepaid, unused fees for the terminated portion.

7.3 Flow-down obligations. CycleForge will impose on each Sub-processor, by written contract, data-protection obligations that are no less protective than those set out in this DPA, in particular providing sufficient guarantees to implement appropriate technical and organizational measures meeting the requirements of Article 28 GDPR.

7.4 Liability for Sub-processors. CycleForge remains fully liable to the Customer for the performance of each Sub-processor’s data-protection obligations to the same extent CycleForge would be liable if performing the services directly, subject to the limitations of liability in the Terms of Service.

8.1 Assistance to the Controller. Taking into account the nature of the Processing, CycleForge will, by appropriate technical and organizational measures and insofar as reasonably possible, assist the Customer in fulfilling the Customer’s obligation to respond to requests from Data Subjects exercising their rights under Data Protection Laws (including rights of access, rectification, erasure, restriction, data portability, objection, and, under the CCPA, the rights to know, delete, correct, and opt out).

8.2 Self-service tooling. The Service provides functionality enabling the Customer to access, correct, export, and delete Customer Personal Data within its workspace, which the Customer may use to respond to many Data-Subject requests directly.

8.3 Routing of direct requests. If CycleForge receives a request directly from a Data Subject relating to Customer Personal Data, CycleForge will not respond to that request itself (other than to acknowledge receipt and direct the individual to the Customer where appropriate), and will promptly forward the request to the Customer (typically via privacy@cycleforge.ai workflows), unless legally prohibited from doing so.

9.1 Notification. CycleForge will notify the Customer without undue delay, and in any event with a target of no later than seventy-two (72) hours after CycleForge becomes aware of and confirms a Personal Data Breach affecting Customer Personal Data.

9.2 Content of notice. To the extent known and available at the time, and supplemented as further information becomes available, the notice will include the information described in Article 33(3) GDPR, namely:

• a description of the nature of the Personal Data Breach, including, where possible, the categories and approximate number of Data Subjects and records concerned;
• the name and contact details of CycleForge’s data-protection contact (security@cycleforge.ai / dpo@cycleforge.ai) from whom more information can be obtained;
• the likely consequences of the Personal Data Breach; and
• the measures taken or proposed to be taken to address it and to mitigate its possible adverse effects.

9.3 Cooperation. CycleForge will cooperate with the Customer and take reasonable steps as directed by the Customer to assist in the Customer’s investigation, mitigation, and remediation of the Personal Data Breach, including assisting the Customer with any notifications it is required to make to Supervisory Authorities or Data Subjects.

9.4 No admission. CycleForge’s notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

Taking into account the nature of the Processing and the information available to it, CycleForge will provide reasonable assistance to the Customer in fulfilling the Customer’s obligations to carry out data protection impact assessments (Article 35 GDPR) and to engage in prior consultation with a Supervisory Authority (Article 36 GDPR), where the Customer reasonably considers such assistance to be required and where the relevant Processing concerns CycleForge’s provision of the Service. CycleForge may make reasonable documentation (such as security and architecture summaries) available to support this.

11.1 Transfer mechanism. To the extent CycleForge’s Processing of Customer Personal Data involves a transfer of Personal Data originating in the EEA, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, the parties agree that such transfers will be subject to the EU SCCs and, where the UK GDPR applies, the UK Addendum, which are hereby incorporated into this DPA by reference.

11.2 Module and operative provisions. For these transfers:

• Module Two (Controller-to-Processor) of the EU SCCs applies (or Module Three (Processor-to-Processor) where the Customer is itself a processor);
• the Customer is the “data exporter” and CycleForge is the “data importer”;
• the optional docking clause (Clause 7) applies;
• under Clause 9, Option 2 (general written authorization) applies, with the notice period set out in Section 7.2;
• under Clause 11, the optional independent-dispute-resolution language does not apply;
• under Clause 17, the governing law is that of [EU MEMBER STATE — e.g. Ireland], and under Clause 18, the forum is the courts of that member state; and
• Annexes I, II, and III to this DPA populate, respectively, the Annexes to the EU SCCs (parties and processing details; technical and organizational measures; list of Sub-processors).

For the UK Addendum, Table 4 ends/terminates as set out in the Addendum, and the information required by its Tables 1–3 is taken from this DPA and its Annexes.

11.3 Conflict. If there is any conflict between the SCCs (including the UK Addendum) and this DPA, the SCCs prevail with respect to the transfers they govern.

11.4 Onward transfers. Where a Sub-processor is located in a country without an adequacy decision, CycleForge will ensure appropriate onward-transfer safeguards are in place (such as the SCCs or another valid transfer mechanism) before Customer Personal Data is transferred to that Sub-processor.

12.1 Export window. Following expiry or termination of the Agreement, and for a period of [NUMBER, e.g. 30] days thereafter (the “Export Window”), CycleForge will, upon request, make Customer Personal Data available to the Customer for export through the Service’s export functionality.

12.2 Deletion or return. At the Customer’s choice, following the Export Window CycleForge will delete or return all Customer Personal Data then in its possession or control, and delete existing copies, unless retention is required by applicable law.

12.3 Certification. Upon the Customer’s written request, CycleForge will provide written certification that it has complied with this Section 12.

12.4 Backup-expiry caveat. Customer Personal Data residing in routine, encrypted backups will be deleted in the ordinary course in accordance with CycleForge’s backup-retention and rotation cycle, and will remain protected by the measures in Annex II until then. CycleForge will not restore such backups for the purpose of further Processing.

13.1 Information. CycleForge will make available to the Customer information reasonably necessary to demonstrate compliance with the obligations laid down in Article 28 GDPR and this DPA.

13.2 Audits. CycleForge will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer, subject to the following:

• the Customer gives reasonable prior written notice (at least [NUMBER, e.g. 30] days, except where a Supervisory Authority requires shorter notice or following a confirmed Personal Data Breach);
• audits occur no more than once per twelve (12) months, unless required by a Supervisory Authority or following a confirmed Personal Data Breach affecting the Customer’s data;
• audits are conducted during business hours, in a manner that minimizes disruption, and subject to confidentiality obligations; and
• audits do not require access to data, systems, or facilities of CycleForge’s other customers, nor to CycleForge confidential information unrelated to the Customer’s Processing.

13.3 Third-party report option. Where available, CycleForge may satisfy an audit request by providing existing audit reports, security documentation, or summaries of relevant certifications or assessments (to the extent CycleForge holds any), and the Customer agrees to accept such materials where they reasonably address the Customer’s audit objective.

13.4 Costs. Each party bears its own costs of an audit, except that the Customer reimburses CycleForge’s reasonable costs for audits that exceed the scope or frequency contemplated by this Section 13.

This Section 14 applies to Customer Personal Data that constitutes “personal information” subject to the CCPA.

14.1 Roles. The Customer is a Business and CycleForge is a Service Provider. CycleForgeProcesses personal information solely to perform the services under the Terms of Service (the “Business Purpose”) and on the Customer’s behalf.

14.2 Restrictions. CycleForge will not:

• Sell or Share the personal information;
• retain, use, or disclose the personal information for any purpose other than the Business Purpose, including for any commercial purpose other than providing the Service, except as permitted by the CCPA;
• retain, use, or disclose the personal information outside the direct business relationship between CycleForge and the Customer; or
• combine the personal information with personal information received from, or on behalf of, any third party, or collected from CycleForge’s own interactions, except as permitted by the CCPA.

14.3 Certification. CycleForge hereby certifies that it understands the restrictions set out in this Section 14 and will comply with them.

14.4 Compliance and notice. CycleForge will provide the same level of privacy protection to personal information as is required of Service Providers under the CCPA, and will notify the Customer if it determines it can no longer meet its obligations under the CCPA. The Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of personal information. CycleForge will assist the Customer in responding to verifiable consumer requests as described in Section 8.

15.1 Liability. Each party’s liability arising out of or related to this DPA, whether in contract, tort, or any other theory, is subject to the exclusions and limitations of liability set out in the Terms of Service, and any reference in the Terms of Service to a party’s liability is deemed to include that party’s liability under this DPA. Nothing in this DPA limits any liability that cannot be limited under applicable law.

15.2 Term. This DPA takes effect on the Effective Date and remains in force for so long as CycleForge Processes Customer Personal Data under the Terms of Service. Its term tracks the term of the Terms of Service, and provisions that by their nature should survive termination (including Sections 12, 13, and 15) survive.

A. List of parties

B. Description of the transfer / processing

C. Competent Supervisory Authority

The Supervisory Authority of the EEA member state or, for UK-origin data, the UK Information Commissioner’s Office, determined in accordance with the SCCs / UK Addendum and the data exporter’s place of establishment: [COMPETENT SUPERVISORY AUTHORITY].

CycleForge maintains the following measures (Article 32 GDPR / UK GDPR):

CycleForge may update these measures provided the overall level of security is not materially reduced (Section 6.2).

The following infrastructure Sub-processors Process Customer Personal Data to provide the Service as at the Effective Date:

Not Sub-processors

The following are not CycleForge Sub-processors and are excluded from this Annex:

• Customer-connected integration partners that the Customer connects with its own credentials and at its own direction — Amazon Selling Partner API (SP-API), eBay, Ecwid, Square, Zoho (Inventory), Google (Sheets / Gmail / Photos), Zendesk, and the shipping carriers UPS, FedEx, and USPS. These are the Customer’s own relationships.
• Customer-controlled infrastructure — the Customer’s own NAS (Synology / UGREEN) used for direct browser-to-NAS photo storage over WebDAV, and the Customer’s own local Ollama LLM accessed via the Customer’s Cloudflare tunnel. CycleForge does not host or access these.