DPPora — Data processing and service exit annex
Version: 17 October 2026. This annex forms part of the DPPora business terms when DPPora processes personal data on a customer's behalf. Spanish version: /legal/data-processing-es.txt. Mandatory law prevails. Existing customers must receive notice of material changes before they take effect.

1. Parties and roles
The customer organisation is the controller for personal data it instructs DPPora to process in its workspace and passports. Christopher Alan Peachey, trading as Faro Digital Media, NIF Y0270240G, Paseo de la Dirección 161, Madrid 28039, Spain, is the processor. Contact: admin@farodigitalmedia.com. DPPora separately acts as controller for its own account administration, billing, security and support processing, described in the Privacy Policy.

2. Subject, duration, nature and purposes
The processing covers collection, hosting, organisation, storage, retrieval, translation when requested, versioning, publication of selected fields, export and deletion of customer-submitted product records and evidence. It lasts while these services are provided, including instructed private continuity storage after public hosting ends, until return or deletion under section 10. It is solely for the contracted service and documented lawful instructions.

3. Data and people
Data may include professional names, contact details, identifiers and personal data contained in customer records, images and documents. People may include the customer's staff, representatives, suppliers and contacts. Customers must minimise personal data and must not submit special-category data or criminal-record information without a separate written agreement and suitable safeguards. Customer personal data must not be placed in a regulated Digital Product Passport without the explicit consent required by applicable product-passport law.

4. Instructions and confidentiality
Use of the documented service, settings and written requests are the customer's instructions, including chosen publication and translation. DPPora shall process data only on these instructions, including for transfers, unless EU or Member State law requires otherwise. In that case DPPora shall inform the customer before processing unless legally prohibited. DPPora shall immediately inform the customer if an instruction infringes applicable data-protection law. Authorised personnel must be subject to confidentiality obligations. DPPora shall not sell customer personal data or use it for unrelated purposes.

5. Security
DPPora shall implement and maintain appropriate technical and organisational measures under GDPR Article 32, proportionate to risk: authenticated access and organisation role checks; restricted administrative access; transport encryption; supplier-managed storage protections; access monitoring; backups and restoration arrangements; and incident response. Customers control public field selection and account authorisations. DPPora shall provide relevant security information on request. Measures must be reviewed as risks change; a general disclaimer does not replace these obligations.

6. Subprocessors
The customer gives general written authorisation for the following service categories and providers as actually used: Cloudflare (delivery, hosting, security and requested Workers AI processing), Supabase (database, authentication and storage), Microsoft Azure (requested translation), and Resend (service-message delivery). DPPora shall maintain a current list of relevant legal entities, processing locations and functions, available at admin@farodigitalmedia.com. Stripe, Apple, Google and Google Analytics may have separate controller roles depending on the service; this authorisation does not treat every provider as a processor.
DPPora shall give at least 30 days' prior written notice of an intended new or replacement subprocessor, allowing objections on reasonable data-protection grounds. The parties shall seek a suitable alternative; if unresolved, the customer may end the affected processing and obtain an export. DPPora shall bind each subprocessor to equivalent Article 28 obligations and remains responsible for its performance.

7. International transfers
DPPora shall not make a restricted international transfer without a valid GDPR Chapter V mechanism. Where needed this includes the applicable standard contractual clauses, transfer assessment and supplementary measures, or a valid adequacy decision within its scope. EU database hosting alone does not establish that all processing stays in the EEA. DPPora shall identify the actual recipients, countries and safeguards and provide a copy or access to safeguards on request, with necessary confidential information protected. No unverified certification or blanket global-compliance claim is made.

8. Assistance and incidents
Taking account of the processing and information available, DPPora shall assist the customer with data-subject requests, security, breach notifications, impact assessments and supervisory-authority consultations under Articles 32–36. DPPora shall notify the customer without undue delay after becoming aware of a personal-data breach, provide available details about its nature, affected records and people, likely consequences and mitigation, and supply updates as facts become available. DPPora shall forward requests concerning customer-controlled data without unnecessary disclosure and shall not answer on the customer's behalf except on instructions or where required by law.

9. Evidence and audits
DPPora shall make available information necessary to demonstrate compliance with Article 28 and allow and contribute to audits, including inspections by the customer or a mandated auditor. Practical scheduling and confidentiality arrangements must not obstruct required oversight or urgent investigations. DPPora shall maintain records of processing and instructions as required by law.

10. Personal account deletion and organisation records
Deleting a user's account removes that person's account and access, not the organisation, product records, passports or history. If the last owner leaves, renewal is cancelled and hosting is honoured through the paid subscription period. Another remaining owner continues normal control. Afterwards, ownerless records remain private for authorised continuity and recovery, not automatic public hosting. A new registration does not establish authority over an existing organisation.
An authorised organisation representative can instruct return or permanent deletion separately by emailing admin@farodigitalmedia.com. Authority must be verified proportionately, protecting other members and data subjects. On termination of processing, at the customer's choice, DPPora shall return or delete the personal data and delete existing copies unless EU or Member State law requires storage. Private continuity storage is not permission to retain unnecessary personal data indefinitely. Statutory individual privacy rights remain independently available; identity or authority checks must not be excessive or used to defeat those rights.
Required legal or claims records must be separated, access-restricted and retained only for the applicable period. Backup deletion and any justified delay must be explained to the customer; deleted data must not be returned to active use on restoration. DPPora shall confirm completion or explain a lawful exception.

11. Switching and export
Where the EU Data Act applies to the service, this section supplies additional exit terms and statutory rights prevail. A customer may request switching to another provider, an on-premises system, or erasure by contacting admin@farodigitalmedia.com. No contractual notice period is required to initiate switching. The ordinary transition is no more than 30 calendar days after the request, subject only to statutory exceptions; the customer may extend it once. If that period is technically unfeasible, DPPora shall explain and justify this within 14 working days and state an alternative period no longer than the statutory maximum of seven months.
DPPora shall provide reasonable assistance, preserve continuity and security during transition, cooperate in good faith, and supply all exportable customer data and digital assets in a structured, commonly used, machine-readable format. These include product records, passport fields and history, supplied files, organisation data and relevant metadata. DPPora's protected internal software and confidential infrastructure information are excluded only to the extent permitted by law, without obstructing switching. Any data-format limitations must be disclosed before contracting.
After transition, the customer has at least 30 calendar days to retrieve data before erasure. The service contract ends on successful completion of switching or, where the customer chooses erasure, at the end of the applicable notice period. No switching or data-egress charge is imposed. Ordinary subscription charges until termination are distinct; any proposed early-termination charge must be expressly disclosed before contracting and lawful. DPPora shall not treat deleting an individual login as an instruction to erase the organisation or start a migration.

12. Product-passport continuity
A subscription is not a guarantee of permanent regulatory hosting. The responsible economic operator must arrange continuity or migration before hosting ends. For regulated battery passports, the applicable requirements include interoperability, role-based free access and continued availability after the responsible operator ceases activity. A downloaded copy alone does not necessarily satisfy availability duties. DPPora must agree and verify any additional continuity service before a customer relies on it for mandatory product-passport compliance.

Current export methods, data structures, formats and limitations: https://dppora.com/legal/export-formats-en.txt