Data Processing Agreement (DPA)
This agreement governs the processing, by the Publisher (processor), of the personal data that the Customer (controller) entrusts to it through the Werisco Service. It supplements the Terms of Service and prevails over them for anything concerning personal data.
1. Roles of the parties
- Controller: the Customer.
- Processor: the Publisher (Werisco).
The Publisher processes personal data only on the documented instructions of the Customer, for the sole purpose of providing the Service.
2. Subject matter, duration, nature and purpose
- Nature/purpose: ERP connection, data quality analysis and cleaning, ingestion and forecasting, at the Customer's request.
- Duration: the term of the contract, followed by return/deletion (section 9 below).
3. Categories of individuals and data (Annex 1)
See Annex 1.
4. Processor obligations
The Publisher undertakes to:
- Process data only on the Customer's instructions;
- Ensure confidentiality (authorized persons bound by a duty of confidentiality);
- Implement the security measures in Annex 3;
- Comply with the conditions for engaging a sub-processor (section 5);
- Assist the Customer in responding to data subject rights requests;
- Assist the Customer with security, data protection impact assessments (DPIAs) and breach notifications;
- Notify the Customer of any data breach without undue delay and at the latest within 48-72 hours of becoming aware of it;
- Make available the information necessary to demonstrate compliance and allow audits (section 8).
5. Sub-processing
The Customer authorizes the Publisher to engage the sub-processors listed in Annex 2. The Publisher informs the Customer of any change (addition/replacement) with 30 days' notice, during which the Customer may object on legitimate grounds. Each sub-processor is bound by the same obligations under contract.
6. International transfers
Any transfer outside the EU/EEA is covered by appropriate safeguards (Art. 46 GDPR, Standard Contractual Clauses). By default, hosting is provided by Railway (United States); a European region can be selected on request to keep data within the EU.
7. Assistance with data subject rights
The Publisher provides features allowing the Customer to access, rectify, export and delete the relevant data, and promptly forwards any request received directly from a data subject.
8. Audit
The Customer may, once per year and at its own expense, on reasonable notice, verify compliance with this DPA (questionnaire, reports, or document-based audit). The Publisher may provide reports/certifications where available to limit on-site audits.
9. End of contract - return and deletion
On termination, at the Customer's choice, the Publisher returns (exports) and then deletes the personal data, including existing copies, within 30 days, unless a legal retention obligation applies.
10. Liability
The allocation of liability follows the Terms of Service, subject to the mandatory provisions of Article 82 GDPR.
---
Annex 1 - Processing details
- Categories of individuals: the Customer's employees, supplier contacts, and possibly end customers if present in the imported ERP data.
- Categories of data: business identifiers, names and contact details present in the imported ERP records (products, inventory, orders, suppliers). No special-category data is required by the Service; the Customer undertakes not to import any.
- Operations: collection via connector, storage, cleaning, transformation, analysis, deletion.
Annex 2 - Sub-processors
| Sub-processor | Role | Location | Safeguards |
|---|---|---|---|
| Railway Corporation | Hosting / database | United States (EU region optional) | Standard Contractual Clauses (SCC) |
| Stripe | Payment / billing | United States / Ireland | SCC + Stripe DPA |
| Brevo | Transactional email | European Union | EU-based |
| Sentry | Error monitoring | United States | SCC |
Annex 3 - Security measures
Technical and organizational measures in place:
- Encryption in transit: HTTPS/TLS for all exchanges.
- Encryption of secrets at rest: ERP connection credentials encrypted (Fernet), isolated per organization (tenant).
- Authentication: hashed passwords (bcrypt), time-limited access tokens, role-based access (admin/manager/viewer), rate limiting against brute force, optional two-factor authentication.
- Security headers: HSTS, X-Frame-Options, Content-Security-Policy, and others.
- Multi-tenant isolation: every request is scoped to the user's organization.
- Logging: application and security logs, error monitoring.
- Backups: daily, with periodic restore testing.
- Internal access management: principle of least privilege.