This agreement (“DPA”) forms part of the contract between the organization using EUlabel (the “Customer”) and Búzios e Tartarugas, Lda., Rua Gil Vicente, 2, 2775-198 Parede, Portugal (“EUlabel”). It meets the requirements of Article 28 of Regulation (EU) 2016/679 (GDPR). Terms defined in the GDPR have the same meaning here.
The Customer accepts this DPA with the Platform Terms. No signature is needed. The Portuguese text prevails over any translation. To receive a countersigned copy, write to legal@eulabel.eu.
1. Roles and scope
1.1 For personal data in Customer Data, the Customer is the controller, or a processor for another controller, and EUlabel is the processor, or a sub-processor. The Customer confirms that any controller it acts for has authorised this DPA.
1.2 Annex 1 describes the subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subjects.
1.3 EUlabel is a separate controller for the data described in its privacy notice as its own: its website, newsletter, sign-in, account security, and contract records. This DPA does not cover that data.
2. Instructions
2.1 EUlabel processes personal data only on the Customer’s documented instructions, including for transfers. The Customer’s instructions are this DPA, the Platform Terms, the Customer’s use of the dashboard and API, and any further written instruction both parties agree.
2.2 If Union or Member State law requires other processing, EUlabel will tell the Customer first, unless that law forbids it.
2.3 EUlabel will tell the Customer at once if it believes an instruction infringes data protection law, and may pause that instruction until the Customer confirms or changes it.
2.4 EUlabel does not sell personal data, and does not use it for its own purposes.
3. The Customer’s responsibilities
The Customer is responsible for having a lawful basis, for informing data subjects, for the accuracy of the data, and for deciding what to publish. Public passport fields are visible to anyone, so the Customer must not put personal data there unless it intends to publish it. The Customer must not enter special categories of data or data about criminal convictions. Each product page links EUlabel’s notice, and the Customer can add its own under Settings → Data and legal.
4. Confidentiality
EUlabel ensures that everyone authorised to process personal data is bound by confidentiality, by contract or by law.
5. Security
5.1 EUlabel maintains the technical and organisational measures in Annex 2, as Article 32 GDPR requires.
5.2 EUlabel may update those measures if the level of protection does not fall.
5.3 The Customer is responsible for the measures in its control, including managing members, roles, API keys and access grants.
6. Subprocessors
6.1 The Customer gives general authorisation for EUlabel to use subprocessors. Those in use on the date of acceptance are listed in Annex 3.
6.2 EUlabel will give the Customer’s owners at least 30 days’ notice by email before adding or replacing a subprocessor. The email will name the subprocessor, and will say that the Customer agrees unless it objects in time. A shorter period applies only if the Customer agrees to it by email.
6.3 The Customer may object on any reasonable ground within 14 days of the notice. The parties will then try to resolve the objection, and EUlabel will not use the new subprocessor for that Customer’s data until they do or the contract ends. If it is not resolved, the Customer may end the contract without charge, and EUlabel may end it under section 13 of the Platform Terms.
6.4 EUlabel binds each subprocessor by contract to data protection obligations in substance no less protective than those in this DPA, and stays fully liable to the Customer for the subprocessor’s performance, as clause 13.1 explains.
6.5 Subprocessors use their own sub-processors, under their own published lists, which are linked on the subprocessors page.
7. Transfers outside the EEA
7.1 EUlabel transfers personal data outside the European Economic Area only on the Customer’s instructions and under Chapter V GDPR. Annex 3 identifies the transfers and their safeguards. By accepting this DPA, the Customer instructs EUlabel to make those transfers.
7.2 Where a transfer relies on the Standard Contractual Clauses (Commission Decision (EU) 2021/914), EUlabel has entered into Module Three with the subprocessor through that subprocessor’s data processing terms. EUlabel will give a copy on request, with commercial terms removed.
7.3 If a safeguard stops being valid, the parties will rely on another lawful safeguard. If none is available, EUlabel will tell the Customer, and the Customer may end the contract without charge.
7.4 If the Customer is established outside the EEA, Module Four of the same clauses applies between the parties, and Portuguese law and courts are chosen for that module.
7.5 If EUlabel receives a request from a public authority for personal data, it will refer the authority to the Customer where it can, tell the Customer unless the law forbids it, and disclose only what the law requires.
8. Assisting with data subject requests
8.1 If EUlabel receives a request from a data subject about Customer Data, it will pass the request to the Customer without undue delay and will not answer it, except to refer the person to the Customer.
8.2 EUlabel helps the Customer respond, through the dashboard, API and export, and by reasonable further assistance where those are not enough.
9. Personal data breaches
9.1 EUlabel will notify the Customer’s owners by email without undue delay, and in any case within 48 hours of becoming aware of a personal data breach affecting Customer Data.
9.2 The notice will state, as far as is known, the nature of the breach, the categories and approximate number of data subjects and records, the likely consequences, the measures taken or proposed, and a contact point. Further information may follow in phases.
9.3 EUlabel will take reasonable steps to contain and remedy the breach, and keep a record of it. Notifying a breach is not an admission of fault.
10. Assisting with compliance
Taking into account the nature of the processing and the information available to it, EUlabel will reasonably assist the Customer with security, breach notification, data protection impact assessments, and prior consultation (Articles 32 to 36 GDPR).
11. Deleting or returning data
11.1 During the contract the Customer can export and delete Customer Data itself.
11.2 When the contract ends, the retrieval period in the Platform Terms applies. EUlabel then deletes Customer Data, and backups are overwritten within 30 days, unless Union or Member State law requires it to keep the data.
11.3 EUlabel deletes records according to Annex 1 during the contract.
12. Audits and information
12.1 EUlabel makes available all information needed to demonstrate compliance with Article 28 GDPR, and answers reasonable written questions within 30 days.
12.2 EUlabel allows and contributes to audits, including inspections, by the Customer or an auditor it mandates who is bound by confidentiality. The Customer will give 30 days’ notice, except after a personal data breach or where a supervisory authority requires otherwise, and will avoid unreasonable disruption.
12.3 Where the information under 12.1 is not enough to demonstrate compliance, an audit may take place. Audits do not extend to the premises or systems of subprocessors beyond what their terms allow. Their published certifications and reports are the primary evidence.
12.4 Each party bears its own audit costs.
13. Liability, duration and order of precedence
13.1 Liability between the parties under this DPA, including for a subprocessor’s performance (clause 6.4) and for recourse under Article 82(5) GDPR, follows section 18 of the Platform Terms, with the exceptions listed there, and as far as the law allows. Nothing here limits either party’s liability to data subjects or supervisory authorities.
13.2 This DPA lasts as long as EUlabel processes Customer Data.
13.3 This DPA prevails over the Platform Terms on data protection. The Standard Contractual Clauses, where they apply, prevail over both.
13.4 EUlabel may change this DPA as section 19 of the Platform Terms provides, or where the law or a supervisory authority requires it. Changes cannot reduce the Customer’s protection without its agreement.
13.5 Portuguese law governs this DPA, and the courts named in the Platform Terms have jurisdiction.
Annex 1: Description of the processing
Subject matter. Hosting and publishing digital product passports and wine e-labels, resolving product identifiers, controlling restricted access, and, where the Customer chooses, counting scans.
Duration. The term of the contract and the retrieval period, and then until backups are overwritten.
Nature and purpose. Storing, organising, retrieving, publishing, transmitting and deleting Customer Data, in order to provide the service.
Categories of data subjects.
- People named in supplier, operator or facility records, such as sole traders and contacts
- People named in passports, such as authorised representatives or repairers
- People or organizations given restricted access, named in access grants
- People who scan a product page, where the Customer has switched counting on, for as long as an IP address and request details are handled to work out a country and leave out automated traffic. Stored scan records are not intended to identify anyone
- Members of the Customer’s organization, as named in events and records
Types of personal data.
- Names, business contact details, VAT and location numbers of natural persons in supplier and facility records
- Whatever the Customer enters in passport, item and event fields
- Grantee name and location number, evidence for the grant, and the user who created it
- Restricted-read records: grant, product, serial number, audience and time
- Scan records: product, GTIN, country and day. No IP address, browser details or identifier is stored. Counting is off unless the Customer switches it on under Settings → Data and legal, after giving a link to its own privacy notice. That is its instruction, and its decision as controller. Wine products are never counted
- User identifiers attached to passport and item events
Special categories. None. Clause 3 forbids them.
Frequency. Continuous.
Retention.
| Data | Period |
|---|---|
| Customer Data | Until the Customer deletes it or the contract ends |
| Scan records, where counting is on | 12 months |
| Restricted-read records, and expired or revoked grants | 24 months |
| Backups | Overwritten within 30 days |
Annex 2: Technical and organisational measures
Location and hosting. Application functions run in the Frankfurt region. The database is stored in the Frankfurt region. Pages are delivered through a global network, as Annex 3 describes.
Encryption. All traffic uses TLS, with HTTP Strict Transport Security. The database provider encrypts data at rest with AES-256.
Secrets. Passwords are stored as scrypt hashes and checked against known breaches when set. API keys and access tokens are stored as SHA-256 hashes and shown once. Two-factor secrets are encrypted, and tokens from Google or Microsoft are not kept after sign-in.
Access control. Four organization roles, with permissions checked on each request and dashboard action. Dashboard and API access to Customer Data is checked against the Customer’s organization. API keys can be limited by permission and to a project, and can be revoked. Members can use passkeys and two-factor authentication, and can review and end their sessions. Restricted passport fields are filtered on the server, and access tokens can be time-limited and revoked.
Application security. Sign-in rate limits, request-origin checks on cookie-authenticated changes, a Content Security Policy and other security headers on each application, and validated input on API routes.
Change and vulnerability management. Code changes run automated type checks, tests and dependency audits, and dependency updates are monitored automatically. Vulnerability reports go to security@eulabel.eu.
Logging. Each restricted read is recorded. Passport status changes and item events are recorded with their date, and with the user where a person made them. There is no complete administrator audit log yet.
Availability. The database provider offers point-in-time restore. EUlabel promises no recovery time. Hosting includes platform DDoS mitigation.
Data minimisation. Scan records hold no IP address or browser details. Wine products are not counted. No analytics or advertising scripts run on any site. A daily job deletes data whose retention period has ended.
Staff. Access to production systems is limited to those who need it, and they are bound by confidentiality.
Limits. EUlabel holds no ISO 27001 or SOC 2 certification and has not yet commissioned an external penetration test. Its hosting and database providers hold their own certifications, listed on the subprocessors page.
Annex 3: Subprocessors and transfers
| Subprocessor | Service | Data location | Transfer safeguard |
|---|---|---|---|
| Vercel Inc., 440 N Barranca Ave #4133, Covina, CA, USA | Hosting, content delivery, firewall, logs | Functions in Frankfurt. Global delivery network. Logs may be processed in the USA | Data Privacy Framework and Standard Contractual Clauses |
| Databricks, Inc., 160 Spear St, San Francisco, CA, USA, and Neon, LLC | Database | Frankfurt (AWS eu-central-1) | Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend), 2261 Market St #5039, San Francisco, CA, USA | Service email and inbound mail | Sent from Ireland. Message data and logs stored in the USA | Standard Contractual Clauses |
The current list, and links to each subprocessor’s own list, are on the subprocessors page.