1. Parties
- Controller: the customer organisation registered in Sourevo (importer, operator, trader or forwarder / authorised representative). It decides what data it uploads and why.
- Processor: Juan Cantón Rodríguez (Spanish tax ID 45492167F), Carrer de Pau Casals 19, 4º 2ª, 08213 Polinyà (Barcelona), España, trading as «Francodesystems».
This agreement covers the data your organisation enters, imports or receives in the tool for its due diligence, including the operator details for TRACES NT and the content of statements. User account data, and the data suppliers manage in their own portal, are processed by us as controller under the privacy policy. When a supplier shares a plot with you, your use of it in your due diligence falls within this agreement.
If your organisation in turn processes that data on behalf of another company (for example a forwarder or authorised representative working for an operator), this agreement works as a sub-processing agreement: you warrant that the controller allows you to engage us and you will pass on to it any information from this document it needs.
2. Subject matter, data and duration
- Categories of data subjects: suppliers and producers who are natural persons (including smallholders), contact persons of suppliers and operators, and people appearing in the evidence you upload.
- Categories of data: name, email, phone, country, tax ID, plot geolocation and area (point or polygon), evidence documents, details of the operator and its contact person, and the content of due diligence statements (DDS). TRACES NT web-service credentials are used for nothing other than the operations you instruct and are stored encrypted.
- Nature of processing: hosting, recording, organisation, consultation, validation, transmission to TRACES NT on your instruction, tax ID checks against public registries, retention and erasure.
- Purpose: providing the service described in the terms, so that you can prepare, submit and document your due diligence under Regulation (EU) 2023/1115.
- Duration: for as long as your account lasts, plus the retention period in section 8.
No special categories of data under article 9 GDPR are processed. If you upload data not needed for due diligence, that decision and responsibility are yours.
3. Instructions
We process the data only on your documented instructions, which are these terms and the actions you take in the application or through an integration: for example, instructing the submission of a DDS to TRACES NT is an instruction to transmit that data to the European Commission. If we believe an instruction infringes the GDPR or other law, we will tell you immediately.
We would only process the data otherwise if Union or Spanish law requires us to. In that case we will tell you beforehand, unless that law prohibits it.
We do not use the data for our own purposes: not for profiling, model training, selling it or offering it to other customers.
4. Our obligations
- Keep the data confidential and require the same of anyone with access, also after the agreement ends.
- Apply the security measures of article 32 GDPR (see section 6).
- Help you respond to data subjects’ requests. If a request from one of your data subjects reaches us, we forward it to you without answering on our own.
- Notify you of a personal data breach without undue delay and in any case within 24 hours of becoming aware of it, with what we know at that point (what happened, which data and data subjects may be affected, likely consequences and measures taken), and complete the information later, so that you can notify the authority within your 72 hours (art. 33 GDPR).
- Assist you, as far as it depends on us, with impact assessments and prior consultations.
- Keep a record of processing activities as processor (art. 30(2) GDPR).
- Make available the information needed to demonstrate compliance and allow reasonable audits, with prior notice and without compromising security or other customers’ data.
- Not transfer data outside the European Economic Area except to the sub-processors in section 5 and with the safeguards stated there.
5. Sub-processors
You give us general authorisation to engage these sub-processors, with whom we have contracts imposing obligations equivalent to those of this agreement:
| Sub-processor | Location | Service | Safeguards |
|---|---|---|---|
| Hetzner Online GmbH | German company; server in its data centre in Finland (EU) | Server hosting, database, files and backups | Within the EU |
| Resend, Inc. | United States | Delivery of service emails (e.g. supplier invitations): recipient address, name and email content | Standard contractual clauses and EU-U.S. Data Privacy Framework |
| Google Cloud EMEA Limited (Google Workspace) | Ireland (EU), with possible transfers to the USA | Support mailbox. It only receives data under this agreement if you email it to us | Standard contractual clauses and EU-U.S. Data Privacy Framework |
| Cloudflare, Inc. | United States | Domain DNS only, no proxy: it does not receive traffic or data under this agreement. Listed for transparency | EU-U.S. Data Privacy Framework and standard contractual clauses |
The following are not sub-processors but recipients on your instruction: the European Commission (TRACES NT), which receives the statements you submit and processes them as controller, and the public tax registries (the European Commission’s VIES, Brazil’s CNPJ registry) we query to validate tax IDs.
If we add or replace a sub-processor, we will give you at least 30 days’ notice. You may object on reasonable grounds; if we cannot find an alternative, you may terminate the contract without penalty.
We remain liable to you for our sub-processors’ compliance with their data protection obligations (art. 28(4) GDPR).
6. Security measures
- Encryption in transit (HTTPS) and TRACES NT credentials encrypted at rest with AES-256-GCM.
- argon2id password hashing and signed sessions in HttpOnly, Secure cookies.
- Per-organisation isolation in every query and plot visibility controlled by the supplier.
- Audit log and append-only statement history.
- Login attempt limiting and staff access limited to the minimum necessary.
- Database backups, kept within the European Union.
We review these measures when the service or the risk changes. If any of them changes, we will keep at least the same level of protection.
7. Your organisation’s responsibilities
- Have a legal basis for the data you upload and inform data subjects (art. 14 GDPR), in particular producers whose geolocation you will include in a DDS submitted to the European Commission.
- Ensure the data is accurate and review each statement before submitting it.
- Manage who in your organisation has access and with which role.
- List us as processor in your record of processing activities.
8. When the agreement ends
When the relationship ends you have at least 30 days to ask us to return the data in a structured format (GeoJSON, CSV or JSON, plus the evidence files). After that we delete it, with two exceptions:
- The archive of submitted statements and their records. Unless you tell us otherwise, by accepting this agreement you instruct us to keep it blocked until 5 years after each submission, so that you can produce it if an authority asks during the retention period the EUDR imposes on you (arts. 4(3) and 12(5)). You may instruct us in writing to delete it earlier, once you have your copy.
- Anything Union or Spanish law requires us to keep, also blocked.
While blocked, the data is not used for anything except your request or a request from an authority or court.
9. Liability and contact
Each party is liable for its obligations under article 82 GDPR, subject to the limitations in the terms of service to the extent permitted by law.
For any question about this agreement, an audit or signing a specific contract if your legal department prefers: juan.canton@sourevo.com.