AIDEALT EUDR BRIDGE

Data Processing Agreement

Last updated: 2 September 2026

Standard B2B service terms for the current AIDEALT EUDR Bridge. A customer-specific order form or executed agreement may supplement or override these pages where expressly stated.

1. Scope

This DPA applies where AIDEALT processes personal data on behalf of a customer in delivering EUDR supplier-evidence workflows. The customer is controller and AIDEALT is processor unless applicable law determines otherwise.

2. Processing details

Subject matter: operation of supplier requests and evidence workspaces. Duration: the subscription plus the agreed deletion period. Data subjects may include customer personnel, suppliers, producers and authorised contacts. Data may include identity, contact, property, shipment, document, access and communication data.

3. Instructions and confidentiality

AIDEALT processes personal data only on documented customer instructions, including agreed international transfers, unless legally required otherwise. Personnel authorised to process customer data are bound by confidentiality obligations.

4. Security and incidents

AIDEALT implements measures appropriate to risk and will notify the customer without undue delay after becoming aware of a confirmed personal-data breach affecting customer data.

5. Subprocessors

The customer provides general authorisation for the subprocessors listed on the Subprocessors page. Material changes will be notified through the agreed channel with a reasonable objection period.

6. Assistance and deletion

Taking account of the nature of processing, AIDEALT will reasonably assist with data-subject requests, security, breach response, impact assessments and regulatory consultation. On termination, customer data will be returned or deleted according to the agreed retention schedule.