Parties and incorporation
This Data Processing Addendum ("DPA") is between traceunified ("Processor," "we") and the customer organization that accepts this Addendum or an Order Form that incorporates it ("Controller," "Customer"). Version 2026-10-11, effective October 11, 2026.
This DPA forms part of the Terms of Service or Master Subscription Agreement between the parties (the "Agreement"). Capitalized terms not defined here have the meaning in the Agreement. If there is a conflict on Personal Data processing, this DPA controls.
Counsel may attach Standard Contractual Clauses (or successor modules) as an annex for transfers from the EEA, UK, or Switzerland. Technical measures below reflect the system as operated.
1. Definitions
Applicable Data Protection Law means GDPR, UK GDPR, Swiss FADP, CCPA/CPRA and similar laws that apply to the Processing of Personal Data under the Agreement.
Personal Data, Processing, Controller, Processor, Data Subject, Supervisory Authority, and Personal Data Breach have the meanings in Applicable Data Protection Law (CCPA "personal information," "business," and "service provider" apply analogously).
Customer Personal Data means Personal Data contained in Customer Data or account records that traceunified Processes on behalf of Customer in providing the Service.
Subprocessor means a third party engaged by traceunified to Process Customer Personal Data.
Security Incident means a confirmed Personal Data Breach or confirmed unauthorized access to Customer Personal Data in traceunified's possession or control.
2. Roles and instructions
For Customer Personal Data in the Service, Customer is Controller (or "business") and traceunified is Processor (or "service provider").
traceunified will Process Customer Personal Data only: (a) to provide, secure, and support the Service; (b) on documented instructions from Customer (including configuration of the Service); and (c) as required by law (in which case traceunified will notify Customer unless legally prohibited).
traceunified will not "sell" or "share" Customer Personal Data as those terms are defined under CCPA/CPRA, or combine it with data from other customers to build advertising profiles.
3. Nature, purpose, and duration
Subject matter: Hosted ALM / QMS platform (requirements, tests, risks, architecture, traceability, reviews, training, audit, e-signatures).
Duration: Term of the Agreement plus retention and deletion periods in Section 10.
Nature: Hosting, storage, transmission, display, backup, security monitoring, and support.
Purpose: Provide the Service per the Agreement.
Data Subjects: Customer's Authorized Users; individuals named in Customer-entered content.
Personal Data: Account identity (name, email, role/group, auth metadata); audit/security logs; any Personal Data Customer chooses to enter into records.
Special category data: Not required for the Service. Customer will not submit special-category data unless separately agreed in writing.
4. Security measures
traceunified maintains technical and organizational measures appropriate to the risk, including: encryption in transit (TLS) and encryption at rest for primary data stores; role-based access control with optional SSO enforcement and multi-factor authentication; per-tenant database isolation; tamper-evident, hash-chained audit trail and cryptographic binding for electronic signatures; secrets in a managed secret store; security headers and Content Security Policy; monitoring, backups, and point-in-time recovery for managed databases; and personnel access limited to need-to-know for operations and support.
Details may evolve as traceunified improves controls; material degradations will not be introduced without notice. No security program guarantees the absence of all incidents.
5. Subprocessors
Customer authorizes traceunified to engage Subprocessors listed at https://traceunified.com/legal/subprocessors (AWS, Cloudflare, and Zoho Mail where Customer has not configured its own email transport). Customer-chosen AI providers (BYOK) and Customer-configured email transports are not traceunified Subprocessors.
traceunified will give Customer at least 30 days' prior notice before adding or replacing a Subprocessor that Processes Customer Personal Data, except for emergency replacements required for security or continuity, in which case notice follows as soon as practicable.
Customer may object on reasonable data-protection grounds within fifteen (15) days of notice. The parties will discuss in good faith; if unresolved, Customer may terminate the affected Service for convenience without penalty for the unused prepaid portion attributable to the objection.
traceunified remains liable for Subprocessors' performance of obligations under this DPA as for its own acts, subject to the Agreement's liability limits.
6. Data Subject requests
traceunified provides product capabilities so Customer can access, correct, export, and delete Personal Data it controls.
If traceunified receives a Data Subject request directly, it will redirect the requester to Customer where feasible and notify Customer's administrators, unless legally prohibited.
traceunified will provide reasonable assistance to Customer, at Customer's expense if the request is excessive or unfounded, taking into account the nature of Processing.
7. Security Incidents (breach notification)
After confirming a Security Incident affecting Customer Personal Data, traceunified will notify Customer's designated administrator without undue delay and no later than 72 hours after confirmation, unless a shorter period is mandatory under Applicable Data Protection Law.
Notice will include, to the extent known: nature of the incident; categories and approximate volume of data/subjects; likely consequences; measures taken or proposed; and a contact point.
traceunified will investigate, contain, and remediate, and will reasonably cooperate with Customer's own notification obligations. Notification is not an admission of fault or liability.
Customer is responsible for notifications to Data Subjects and Supervisory Authorities when Customer is Controller, except where law requires traceunified to notify directly.
8. International transfers
Primary Processing occurs in AWS us-east-1 (United States).
Where Customer Personal Data is transferred from the EEA, UK, or Switzerland to the United States (or another third country), the parties will rely on: the EU Standard Contractual Clauses (Module 2 Controller→Processor) and UK Addendum / Swiss adaptations as applicable, incorporated by reference when Customer is established in those regions or so elects in an Order Form; and/or any valid adequacy decision or successor transfer mechanism.
On request, traceunified will execute or restate SCCs in a form suitable for Customer's records.
9. Assistance, DPIAs, and audits
Taking into account the nature of Processing, traceunified will assist Customer with DPIAs and consultations with Supervisory Authorities where required.
Upon written request no more than once annually (unless a Supervisory Authority or Security Incident requires more), traceunified will make available information reasonably necessary to demonstrate compliance with this DPA, which may include responses to security questionnaires, summaries of policies and control descriptions, and third-party audit reports when available (for example SOC 2), under NDA.
On-site audits are available only if questionnaire/report evidence is insufficient and Customer bears reasonable costs; audits must not unreasonably interfere with operations or other customers' security.
10. Return and deletion
During the Term, Customer may export Customer Data using product features.
Within 30 days after termination or expiry of the Agreement (or earlier written request), traceunified will delete or return Customer Personal Data from production systems (Customer's choice of return vs delete where return is technically feasible), except where retention is required by law or necessary for dispute resolution, security, or residual encrypted backups.
Residual backups containing Customer Personal Data are purged on a rolling schedule not to exceed 90 days after production deletion, except for legal holds.
11. Confidentiality of Processing
traceunified ensures persons authorized to Process Customer Personal Data are bound by confidentiality obligations and receive appropriate training.
12. Governing law
This DPA is governed by the governing law of the Agreement (Delaware, USA, unless an MSA states otherwise). Dispute resolution follows the Agreement.
13. Contact
Privacy: privacy@traceunified.com. Security / incidents: security@traceunified.com. Legal: legal@traceunified.com.