Data Processing Addendum

1. Scope and roles

This DPA applies where a customer is a controller, or a processor acting for another controller, and Lytheron OÜ processes personal data on the customer's documented instructions through Lytheron Pallet.

The DPA forms part of the applicable service agreement when incorporated by reference, accepted with the service terms, or included in a signed order.

2. Processing details

• Subject matter: hosting and operation of Lytheron Pallet and related support/security functions.
• Duration: for the term of the service plus limited post-termination retention required for return, deletion, backups or law.
• Nature and purpose: storage, organisation, retrieval, transmission, access control, audit, backup and support for customer-directed pallet and logistics operations.
• Data subjects may include customer staff, Client Portal users, drivers, contacts, counterparties and other individuals whose data the customer lawfully enters.
• Data may include identity/contact details, role and account data, operational references, documents, evidence, timestamps, audit events and other customer-supplied information.

3. Processor obligations

• Process personal data only on documented customer instructions unless law requires otherwise.
• Ensure persons authorised to process personal data are bound by confidentiality.
• Implement appropriate technical and organisational measures.
• Assist the customer, taking into account the nature of processing, with data-subject requests, security obligations, breach response and impact assessments where reasonably applicable.
• Delete or return personal data at the end of the service, subject to legal obligations and backup cycles.
• Make available information reasonably necessary to demonstrate compliance and support proportionate audits under agreed confidentiality and security conditions.

4. Security measures

• Tenant-scoped access controls and database-level authorisation.
• Role-based access for internal users and isolated Client Portal membership.
• TLS/HTTPS for application traffic.
• Provider-managed encryption and security controls for hosted infrastructure.
• Audit events for sensitive access and membership changes.
• Restricted privileged credentials and no service-role secret exposed to browser code.
• Document storage policies scoped to authorised organisations and portal visibility.

5. Subprocessors

Customer authorises the subprocessors listed on the Subprocessors page. Lytheron remains responsible for imposing data-protection obligations on subprocessors appropriate to the services they perform.

Lytheron will update the published list before or when a material new subprocessor begins processing customer personal data. Customers with a contractual right to object may contact legal@lytheron.com.

6. Personal-data breaches

Lytheron will notify the affected customer without undue delay after becoming aware of a personal-data breach affecting customer personal data and will provide information reasonably available to support the customer's obligations.

7. International transfers

Where a transfer of personal data outside the EEA requires a transfer mechanism under GDPR, the parties will rely on an applicable lawful mechanism, including approved standard contractual clauses where appropriate.

8. Order of precedence

If this DPA conflicts with another service term concerning processing of customer personal data, this DPA prevails for that subject. A separately signed DPA may supersede this standard version.