Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Athanix OÜ, a company registered in Estonia (registration number 17508234), registered office Sepapaja tn 6, 15551 Tallinn, Estonia, operating EPR Clear ("EPR Clear", "we", "us"), and the organization that holds the workspace ("you"). It governs how we process the seller data your organization loads into its workspace, consistent with our Privacy Notice at /privacy and our Terms at /terms. Where this DPA and the Terms conflict on data processing, this DPA controls. You accept this DPA by using the Service for your organization; to sign it as a standalone document, email legal@eprclear.com.

1. Definitions

Terms such as controller, processor, personal data, processing, data subject, personal data breach, and supervisory authority have the meanings given in the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"). "Applicable data protection law" means the GDPR and any other data protection law that applies to the processing under this DPA. "Seller data" means the seller lists and verification workspace data you load into or produce in your workspace: seller business and trading names, VAT and EPR registration identifiers, any seller contact details you provide, and the verification results and evidence log entries derived from them. "Subprocessor" means a third party we engage to process seller data on your behalf.

2. Roles and responsibilities

EPR Clear is a business-to-business service, and most seller data describes companies. Some of it is nevertheless personal data: a sole trader's business name identifies a natural person, and the seller contact details you provide can identify the people behind a seller account. This DPA exists for that data.

For seller data, you are the controller and we are the processor. You decide which sellers to load and verify; we process their data on your behalf to provide the Service. For two other sets of data we are an independent controller, as described in our Privacy Notice, and this DPA does not apply to them: the account data we hold about you and your users (Privacy Notice section 5), and the snapshots of public national producer registers we capture ourselves as verification source material (Privacy Notice section 6).

Each party complies with the data protection law that applies to it. You are responsible for having a lawful basis to load seller data, which for marketplace verification will usually follow from the verification duty in PPWR Article 45 or from your legitimate interest in meeting it, and for any notices you owe your sellers.

3. Scope, duration, and your instructions

We process seller data only to provide the Service: checking seller registration numbers against national producer register snapshots, monitoring for changes such as revocations and re-checking on schedule, writing checks into your timestamped evidence log, sending the seller invitations you trigger (campaign and seller portal email), and making your workspace data available to you for export. The subject matter, duration, nature, and purpose of the processing, the types of personal data, and the categories of data subjects are described in Annex I.

Your documented instructions are the configuration choices you make in the Service (the sellers you load, the checks and campaigns you trigger, the schedules you set) and the terms of this DPA. We will not process seller data for any other purpose unless the law requires it, in which case we will tell you first where we are permitted to. If an instruction would, in our reasonable view, breach applicable data protection law, we will inform you and may decline to act on it. Processing continues for the duration of your use of the Service and ends as set out in section 11.

4. Confidentiality of personnel

Access to seller data within EPR Clear is limited to personnel who need it to operate, support, or secure the Service. Those people are bound by confidentiality obligations, whether by contract or by law, that survive the end of their engagement. We grant access on a least-privilege basis and remove it when it is no longer required.

5. Security measures

We implement appropriate technical and organizational measures to protect seller data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk to data subjects. These measures are described in Annex II and include encryption in transit, per-organization isolation of workspace data, passwordless sign-in with hashed single-use tokens, and least-privilege access. We review and adjust these measures as the Service evolves and as new risks emerge. You are responsible for the security of your own account: for protecting the inboxes that receive your sign-in links and for who in your organization can access seller data.

6. Subprocessors

You give general authorization for us to engage subprocessors to process seller data. Our current subprocessors are listed in Annex III. Each is engaged under a written contract that imposes data protection obligations consistent with this DPA, and we remain responsible to you for their performance.

When we add or replace a subprocessor that processes seller data, we will give you reasonable notice so you can object on legitimate grounds. If we cannot resolve a reasonable objection, you may stop using the affected feature or terminate the related part of the Service as your remedy.

7. Assistance with data subject requests

Sellers whose data you load, including sole traders, may ask you to access, correct, or delete it. Because you are the controller, those requests are yours to handle, and the Service lets you view, correct, and remove sellers from your workspace and export your data directly. Where a request needs more than those tools, we will provide reasonable assistance, taking into account the nature of the processing and the information available to us. If a seller contacts us directly about data you loaded, we will refer them to you rather than act on the request ourselves. A sole trader's objection to appearing in our own register snapshots is a controller matter for us, handled as described in section 6 of the Privacy Notice, not under this DPA.

8. Assistance with security, breach, impact assessments, and consultation

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance to help you comply with your obligations to keep seller data secure, to notify personal data breaches, to carry out data protection impact assessments, and to consult supervisory authorities where required.

9. International transfers and Standard Contractual Clauses

We design processing to run in the European Union: the application is hosted in the EU, and email delivery is EU-based. Several of our providers are US-incorporated companies, so they may be subject to US law even when they host data in the EU, and some processing can occur outside the EEA. Where seller data is transferred outside the European Economic Area to us or to a subprocessor, we rely on an adequacy decision where one applies (such as the EU-US Data Privacy Framework) or on appropriate safeguards.

Where the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, "SCCs") are required for a transfer for which we act as your processor, the SCCs are incorporated into this DPA by reference, with Module Two (controller to processor) applying, you as data exporter and the relevant recipient as data importer, the optional docking clause included, the audit and subprocessor options aligned with this DPA, and the governing law and forum being those of an EEA member state. Annex I and Annex II serve as the corresponding annexes to the SCCs, and the subprocessor list in Annex III serves as the agreed list. Where the UK or Switzerland requires an addendum, the applicable addendum applies and is incorporated by reference. We will provide details of the safeguards that apply to a given transfer on request at privacy@eprclear.com.

10. Personal data breach notification

If we become aware of a personal data breach affecting seller data we process for you, we will notify you without undue delay. Our notice will describe, to the extent known, the nature of the breach, the categories of data and people likely affected, the likely consequences, and the measures we have taken or propose to take. We will provide reasonable cooperation to help you meet any notification obligations you have as the controller. A notice is not an admission of fault by either party.

11. Return and deletion of data

You can export your workspace data, including the evidence log, at any time while your account is active. On termination of the Service, you will have a reasonable period to export it, as the Terms provide. After that period we will delete or return the seller data we hold on your behalf, except where we are required to retain it by law. Deleted data is removed from active systems within a reasonable time and from backups in the ordinary course of backup rotation. Our own register snapshots are controller-side source material, contain no data you loaded, and are unaffected by workspace deletion.

12. Audit and information rights

On reasonable written request, and no more than once a year unless a regulator or a breach requires otherwise, we will provide information reasonably necessary to demonstrate our compliance with this DPA. We may satisfy such a request through documentation, written responses, or a summary of our security measures. Any audit must be at your expense, scheduled in advance, conducted during business hours, and carried out without disrupting the Service or compromising the confidentiality of other organizations' data.

13. US state privacy laws

To the extent US state privacy laws apply to your processing, EPR Clear acts as a service provider or processor, processes seller data only to provide the Service and on your instructions, does not sell or share seller data, and does not retain, use, or disclose it outside the direct business relationship or for any purpose other than providing the Service.

14. Liability, precedence, governing law, and contact

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms at /terms, which apply to this DPA as if stated here in full. Like the Terms, this DPA is governed by the laws of Estonia (European Union). In case of conflict between this DPA and the incorporated SCCs on a transfer governed by the SCCs, the SCCs prevail for that transfer. Questions about this DPA, or a request to sign it as a standalone document, go to legal@eprclear.com. Privacy and data subject matters go to privacy@eprclear.com. Postal: Athanix OÜ, Sepapaja tn 6, 15551 Tallinn, Estonia.

Annex I: Description of the processing

Subject matter: provision of the EPR Clear service (EPR registration verification, monitoring, and evidence logging) to the organization.

Duration: for the term of the organization's use of the Service, and until deletion as set out in section 11.

Nature and purpose: matching seller registration numbers against national producer register snapshots, monitoring registrations for changes and re-checking on schedule, recording checks in the organization's timestamped evidence log, sending the seller invitations the organization triggers, and making workspace data available for export.

Types of personal data: seller business and trading names, including sole-trader names that identify a natural person; VAT and EPR registration identifiers; seller contact details the organization provides (such as a contact email for invitations); and the verification verdicts and evidence entries derived from them.

Categories of data subjects: the organization's sellers, in particular sole traders and the individual contact persons of seller businesses.

Special categories of data: none intended. Organizations must not load special categories of data into the Service.

Frequency: continuous, for the duration of the processing.

Annex II: Technical and organizational measures

Encryption in transit: TLS for all traffic between browsers, the Service, and its providers.

Tenant isolation: workspace data is segregated per organization at the database layer (row-level security), so one organization cannot reach another organization's seller data.

Authentication and session security: passwordless sign-in by 15-minute single-use magic links; sign-in and session tokens stored hashed; sessions carried in httpOnly, secure cookies; state-changing console requests protected against cross-site request forgery.

Access control: least-privilege access on a need-to-know basis; restricted administrative access; personnel bound by confidentiality.

Infrastructure: managed EU-region cloud infrastructure for hosting, database, and object storage, with provider-managed encryption at rest and backups.

Logging and monitoring: system and security-relevant events are logged and monitored; defined incident response and the breach notification set out in section 10.

Subprocessor management: written contracts imposing equivalent obligations; current list maintained in Annex III.

Annex III: Subprocessors

This annex lists the providers that process personal data in the operation of the Service and forms part of this DPA; each row states what that provider actually processes. The list matches section 7 of the Privacy Notice. We give organizations reasonable notice before adding or replacing a subprocessor that processes seller data, as set out in section 6. To receive change notices, email privacy@eprclear.com.

We do not sell personal data, we run no advertising, and we do not use seller data to train models.