Data Processing Agreement

Last updated: 2026-08-14 Effective version: 1.0

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Preferium AS (Org. nr. 999 323 286), a limited company registered in Norway with registered address Sponheimveien 19, 1613 Fredrikstad, Norway (the "Processor"), and the customer ("Controller") for the provision of Preferium AI Edge (the "Service"). It implements Article 28 of Regulation (EU) 2016/679 (GDPR) and Schedule 1 of the UK Data Protection Act 2018.

1. Definitions

Terms defined in the GDPR have the same meaning when used in this DPA. "Personal Data" means any information relating to an identified or identifiable natural person processed by the Processor on behalf of the Controller in connection with the Service.

2. Subject matter and duration

3. Roles

The Controller determines the purposes and means of processing. The Processor processes Personal Data only on documented instructions from the Controller, including with regard to transfers to third countries.

4. Processor obligations

The Processor shall:

1. Process Personal Data only on documented instructions from the Controller, including transfers to third countries — unless required to do so by Union or Member State law.
2. Ensure that persons authorized to process the Personal Data are bound by confidentiality obligations.
3. Take all measures required pursuant to Article 32 GDPR (security of processing — see §6).
4. Respect the conditions for engaging Sub-Processors (§5).
5. Assist the Controller in fulfilling its obligations to respond to data subject requests.
6. Assist the Controller in ensuring compliance with Articles 32–36 GDPR.
7. At the Controller's choice, delete or return all Personal Data after the end of the provision of services and delete existing copies (see §10).
8. Make available all information necessary to demonstrate compliance with Article 28 GDPR.

5. Sub-Processors

The Controller authorizes the Processor to engage the following Sub-Processors:

The canonical, always-current version of this list is docs/legal/sub-processors.md, published at https://trust.preferium.com/sub-processors. Where this table and that list differ, that list governs.

The Processor will inform the Controller of any intended changes to this list at least 30 days before the change takes effect, allowing the Controller to object. If the Controller objects in writing within 14 days of that notice, the Processor will work with the Controller to find a mutually acceptable resolution; failing that, the Controller may terminate the Service with pro-rata refund.

6. Security measures

The Processor maintains the following technical and organizational measures (Article 32 GDPR):

• Encryption in transit: TLS 1.2+ on all customer-facing endpoints, including the dashboard, API worker, edge worker, and OAuth flows.
• Encryption at rest: Database storage encrypted (Supabase managed encryption). OAuth tokens encrypted with AES-GCM in worker memory; encryption key never reaches Postgres.
• Access control: Multi-tenant isolation via PostgreSQL Row-Level Security with explicit tenant_id filters in application code. Service-role keys held in Cloudflare Worker secrets; never in source.
• Audit logging: All privileged actions logged to an append-only, tamper-evident hash-chained audit_logs table with tenant_id, user_id, action, and timestamp. Retained 24 months, except billing, single-sign-on, and data-subject-request actions, which are retained 5 years because Bokføringsloven §13 requires accounting documentation to be kept that long (Art. 6(1)(c) legal obligation). Records are hard-deleted when they age out; surviving records are re-chained in the same transaction so the trail stays independently verifiable. This statutory retention survives an Art. 17 erasure and a §10 tenant deletion — in both cases the data subject's identifiers are removed from the retained records rather than the records themselves being destroyed.
• Backups: Daily Postgres backups with 30-day retention (Supabase Daily Backups). Weekly snapshots to Cloudflare R2 with 90-day retention.
• Incident response: Sentry-driven alerting on error-rate spikes, p99 latency degradation, and webhook failures. On-call rotation for production incidents.
• Secret management: Wrangler Secrets for production; never committed to git. Rotation every 90 days.
• Vulnerability management: Dependency scanning via GitHub Dependabot. Penetration tests annually.

7. Personal Data breach

The Processor will notify the Controller without undue delay (target: within 24 hours) after becoming aware of a Personal Data breach affecting the Controller's data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

8. Data subject requests

The Processor will assist the Controller, by appropriate technical and organizational measures, in responding to requests for exercising data subject rights under Articles 15–22 GDPR.

All of the tooling below is operator-fulfilled on written request to the Processor's DPO. There is no self-service deletion or "my data" tab in the dashboard. Requests are answered within 30 days.

• Right of access: Operator-fulfilled export of the data subject's records as a downloadable JSON bundle, produced by the Processor's internal DSAR endpoint (privileged-role + MFA gated).

• Right to erasure: Two distinct obligations with two distinct mechanisms, because purging a tenant and erasing a person are not the same act:

  • Tenant-level — an operator-initiated teardown places the workspace in the 30-day grace window described in §10 (serving stops immediately, Cloudflare hostnames are released, the subscription is cancelled), after which the tenant's row graph is destroyed and the §10.5 deletion certificate is written.
  • Individual-level — the data subject's personal data is erased and their identifiers are removed from the audit trail by a chain-safe re-hashing routine, so the tamper-evidence chain described in §6 stays verifiable. See §6 (Audit logging) for what is retained by statute after this runs.

  Cached optimized content for the affected hostnames is deleted from the edge key-value store outright as part of teardown — an explicit delete, not an expiry. Cloudflare's key-value propagation to all edge locations may take up to 60 seconds, and responses already delivered to a downstream cache may persist for up to a further 60 seconds before revalidation.

• Right to rectification: The Controller can update domain content directly via the dashboard or by re-publishing the source HTML.

• Right to data portability: CSV export of the Controller's per-domain optimization data (both current overrides and deployed state) via the dashboard and API, plus the operator-fulfilled JSON bundle described under Right of access.

9. International transfers

For transfers of Personal Data outside the EEA, UK, or Switzerland, the Processor uses the European Commission's Standard Contractual Clauses (SCCs) (2021/914/EU) as updated. Where Sub-Processors are located in jurisdictions without an adequacy decision, supplementary measures apply (encryption-in-transit-and-at-rest by default, plus contractual obligations on the Sub-Processor).

10. Return or deletion

Upon termination of the Service, the Processor will:

1. Stop accepting new requests within 24 hours of termination notice.
2. Make all Personal Data available for export throughout a 30-day grace window that begins at termination. Service delivery stops at the start of this window; the data remains readable for export, and the deletion remains reversible, until the window closes.
3. Delete all Personal Data from production systems at the close of that same 30-day window — i.e. within 30 days of termination, not 30 days after the export window closes. The export window and the deletion deadline are one and the same 30 days (consistent with §2 above, PRIVACY.md §6, and TERMS.md §9).
4. Delete from backups within the natural backup-rotation window (90 days for R2, 30 days for Supabase) — the Processor cannot selectively erase from backup snapshots without invalidating the entire snapshot.
5. Issue a written certification of deletion within 7 days of completion.

Retained by exception: audit-trail records of the Controller's own privileged actions are kept under the statutory carve-out described in §6 (Audit logging) after the tenant record itself is destroyed. Purging a tenant and erasing an individual data subject are separate obligations with separate mechanisms — see §8.

11. Audits

The Controller may, no more than once per calendar year and at its own cost, audit the Processor's compliance with this DPA. The Processor may satisfy this obligation by providing a current SOC 2 Type II report or equivalent third-party assessment. Audits requiring on-premises access require 30 days' written notice and may be subject to confidentiality undertakings.

12. Liability and termination

This DPA is governed by Norwegian law. Disputes will be resolved by Oslo District Court. Liability under this DPA is subject to the limitations set out in §11 of the Terms of Service; nothing in this DPA limits the Controller's right to bring claims directly against the Processor under the GDPR.

13. Changes

The Processor will notify the Controller of material changes to this DPA at least 30 days before they take effect. The Controller may terminate the Service if it does not accept the changes.

Signed for and on behalf of the Processor:

Robert Andre Johansen, CEO Preferium AS Org. nr. 999 323 286 Sponheimveien 19, 1613 Fredrikstad, Norway post@preferium.no

Signed for and on behalf of the Controller:

The Controller accepts this DPA by subscribing to the Service; no counter-signature is required. A counter-signed copy naming the Controller's legal entity and signatory is available on request to post@preferium.no.