Data Processing Agreement

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between the client and Diego Ahumada, trading as Dexffo (eenmanszaak, Amsterdam, the Netherlands; KvK — registration pending).

• Controller (verwerkingsverantwoordelijke): the client (the operator), who determines the purposes and means of processing the producer and supply-chain data uploaded to the platform.
• Processor (verwerker): Dexffo, which processes that data solely on the client’s documented instructions.

Dexffo processes personal data exclusively to provide the EUDR compliance service: collection, validation, storage, structuring, transmission to the EU Information System, retention, and deletion of Due Diligence Statement (DDS) data under Regulation (EU) 2023/1115. Dexffo does not use the client’s or the producers’ personal data for any other purpose, including marketing, profiling, training or calibrating models, or sale to third parties.

Processing lasts for the term of the service contract and, after it ends, for as long as needed to keep the file for at least 5 years from the later of the submission of the DDS and the placing on the market or export of the products, so that the client can meet its record-keeping duties under EUDR Arts. 4(3), 9(1) and 12(5). See Clause 9.

• Producer / landowner identity (name) per production plot
• Plot geolocation (WGS84 coordinates, ≥6 decimals; points or polygons)
• Production data (commodity, species, quantities, dates)
• Legality documents (land titles, permits, licences, certifications)
• Operator/declarant details (legal name, EORI, address)

Data subjects: producers, authorised representatives, and the client’s employees.

Dexffo, as processor, undertakes to:

• Process personal data only on the controller’s documented instructions;
• Ensure persons authorised to process the data are bound by confidentiality;
• Implement the technical and organisational measures in Clause 6;
• Assist the controller with data-subject requests and DPIAs (Art. 35–36);
• Notify the controller without undue delay of any personal-data breach;
• Delete or anonymise the data after the retention period (Clause 9).

• Encryption in transit (TLS 1.3) and at rest (AES-256);
• Role-based access control and two-factor authentication for admin access;
• Immutable audit trail of data operations;
• Pseudonymisation where compatible with the EUDR purpose;
• Encrypted backups and a documented patching policy;
• Least-privilege access restricted to the data controller (Diego Ahumada).

The controller authorises the following sub-processors. Dexffo will give 30 days’ notice of any intended change, during which the controller may object:

Personal data is processed within the EEA by default. Where a transfer outside the EEA occurs (e.g. a US-based sub-processor), it is governed by the European Commission’s Standard Contractual Clauses (Decision 2021/914) and a transfer impact assessment.

On the client’s instructions, personal data is kept for at least 5 years from the later of the submission of the DDS and the placing on the market or export of the products, so that the client, as controller, can meet its record-keeping duties under EUDR Arts. 4(3), 9(1) and 12(5) (for the client, a legal obligation within GDPR Art. 6(1)(c)). This reconciles the GDPR storage-limitation principle (Art. 5(1)(e)) with those duties. After that period, data is anonymised or securely deleted (NIST SP 800-88), and a deletion certificate is available on request.

The controller may verify Dexffo’s compliance through documentary review, a security questionnaire, or — at most once per year — an on-site audit with reasonable notice. A recognised certification (e.g. ISO 27001, targeted Q4 2026) may be accepted in lieu of an on-site audit.

Dexffo will notify the controller within 72 hours of becoming aware of a personal-data breach, with the information required under GDPR Art. 33(2). The controller remains responsible for notifying the supervisory authority and data subjects where required.

DPO contact: dpo@dexffo.com. The competent supervisory authority is the Dutch Autoriteit Persoonsgegevens.

This DPA is governed by Dutch law (Burgerlijk Wetboek). Disputes fall under the exclusive jurisdiction of the Rechtbank Amsterdam (Handelskamer). Where the SCCs apply, they prevail in case of conflict.

See also our Terms of Service and Privacy Policy.