Data Processing Agreement (DPA)
DPA Version: v2.0-2026-10Regulatory Framework: GDPR Article 28 • UK GDPR • CCPA / CPRA
1. Controller vs. Processor Distinction
This Data Processing Agreement ("DPA", version v2.0-2026-10) supplements and forms an integral part of the LogiStock Master SaaS Agreement. It governs the processing of personal data and operational business records by LogiStock on behalf of Customer in accordance with GDPR Article 28, the UK Data Protection Act, and the California Consumer Privacy Act (CCPA/CPRA).
Customer is Data Controller: Customer determines the business purposes, categories, and means of processing Customer Data, maintaining legal ownership and statutory controller responsibilities.
LogiStock is Data Processor: LogiStock processes Customer Data solely on Customer’s documented instructions, within the scope of providing multi-tenant SaaS inventory management, sales, procurement, and accounting functions.
2. Customer Data Ownership
Customer retains exclusive ownership of, and all intellectual property rights in, all inventory counts, item catalogs, vendor details, commercial invoices, customer lists, purchase orders, and financial ledger records submitted to or created within the LogiStock platform ("Customer Data"). LogiStock acquires no ownership, proprietary interest, or commercial licensing rights in Customer Data.
3. Processing Restrictions & AI Protection Covenants
- No Commercial Sale or Rental: LogiStock shall not sell, rent, lease, release, disclose, or transfer Customer Data to any third party for monetary or commercial consideration.
- Strict AI Model Training Prohibition: Under no circumstances will Customer Data, inventory records, or user prompts be utilized, scraped, or retained to train, retrain, fine-tune, or calibrate public foundational Artificial Intelligence (AI) or Large Language Models (LLMs).
- Documented Instructions: LogiStock shall only process Customer Data in accordance with documented instructions from Customer, unless required to do so by applicable mandatory law.
4. Technical & Organizational Security Measures (TOMs)
LogiStock maintains comprehensive physical, administrative, and technical safeguards complying with modern security standards:
Enforced TLS 1.2+ / TLS 1.3 encryption across all network ingress points; AES-256 block encryption for databases and object storage.
Strict least-privilege role permissions preventing unauthorized internal access to operational data tables.
Mandatory Multi-Factor Authentication (TOTP) enforcement for root administrator and accounting personnel accounts.
Regular dependency auditing, static code security scanning, and proactive zero-day patching.
5. Mandatory 72-Hour Personal Data Breach Notification
In accordance with GDPR Article 33 and CCPA guidelines, LogiStock shall notify Customer in writing without undue delay and in any event within seventy-two (72) hours of becoming aware of a confirmed Personal Data Breach affecting Customer Data.
The notification will describe the nature of the breach, affected records, contact details of the Data Protection Officer, likely consequences, and remediation measures taken.
6. Authorized Subprocessors List
Customer grants general written authorization to LogiStock to engage the following subprocessors:
| Subprocessor Entity | Service Role & Function | Hosting Jurisdiction |
|---|---|---|
| Google Cloud Platform | Cloud Infrastructure & Vertex AI Assistant APIs | United States |
| Composio Inc. | OAuth Token Facilitation (Calendar & Email Sync) | United States |
| Neon / PostgreSQL Cloud | Managed Relational Database with Row-Level Security | United States (AWS / Neon US-East, Multi-AZ) |
| MinIO / S3 Storage | Encrypted Object Storage for Invoices, Reports & Assets | United States |
* LogiStock will provide at least thirty (30) days prior written notice via email or Legal Hub publication before engaging any new subprocessor, giving Customer the opportunity to object.
7. Data Retention, Export & Post-Termination Purge
30-Day Export Window: Upon termination or expiration of the subscription, Customer will retain access for thirty (30) calendar days solely to export and retrieve all Customer Data in standard structured formats (JSON, CSV, PDF, and Excel).
Irreversible Cryptographic Deletion: Following the thirty (30) day retrieval window, LogiStock will permanently delete, purge, and overwrite all Customer Data from primary databases and backup archives within thirty (30) additional days, unless statutory law mandates retention.
8. Data Protection & Security Contacts
For formal data processing inquiries, Data Protection Officer communications, or audit verification requests:
Legal & Privacy: legal@agents360ai.com
Security Incidents: security@agents360ai.com