Data Processing Addendum

1. Roles and definitions

The customer is the data fiduciary (or controller, or business) and Trace Global is the data processor (or service provider). Customer personal data means personal data in bills, account records, utility files and user accounts that Trace Global processes under the agreement. Terms not defined here have the meaning given in the applicable data protection law.

2. Details of processing

Purpose: audit of utility bills, filing of refund claims, AP workflow and reporting. Duration: the term of the agreement and the retention period in section 9. Data subjects: customer personnel, utility account contacts and, rarely, sole proprietor account holders. Data types: names, business contact details, service addresses, account and meter identifiers, usage and billing data.

3. Our commitments

Trace Global will process customer personal data only on the customer's documented instructions, which are the agreement and this DPA, and will tell the customer if an instruction appears to breach the law. Personnel with access are bound by confidentiality.

Trace Global will not sell customer personal data, will not share it for cross-context behavioral advertising, will not retain, use or disclose it outside the direct business relationship, and will not use it to train machine learning models.

4. Security measures

Trace Global maintains the measures in its security program, including AES-256 encryption at rest, TLS 1.3 in transit, role-based and least-privilege access, multi-factor authentication, read-only utility portal access, administrative logging, vulnerability management, annual penetration testing and a SOC 2 Type II report that we share under NDA on request.

5. Subprocessors

The customer authorizes Trace Global to use the subprocessors at /legal/subprocessors, under written terms no less protective than this DPA. Trace Global stays responsible for their performance. We give at least 30 days notice of a new or replacement subprocessor by email to the account contact. The customer may object on reasonable data protection grounds within that period, and we will work with the customer to resolve the objection or allow termination of the affected service without penalty.

6. International transfers

Customer personal data is hosted in the United States (AWS us-east-1 and us-west-2). Trace Global staff in India access it remotely. Where the law requires a transfer mechanism, the parties rely on the standard contractual clauses or equivalent terms, which are incorporated by reference. Transfers from India follow the DPDP Act and any restrictions notified under it.

7. Assistance with rights and obligations

Trace Global will help the customer respond to requests from individuals to access, correct, erase or port their data, and to grievances, by providing tools or information within 10 business days of a request. If an individual writes directly to Trace Global about customer data, we direct them to the customer unless the law requires otherwise. We will also assist with data protection impact assessments and consultations with regulators where reasonably required.

8. Personal data breach

Trace Global will notify the customer without undue delay and in any case within 48 hours after becoming aware of a personal data breach affecting customer personal data, with the information available about its nature, the data affected, likely consequences and steps taken. We will keep the customer updated and support its notices to authorities and individuals.

9. Return and deletion

On request or at the end of the agreement, Trace Global will return customer data in a standard format and then delete it from active systems within 60 days and from backups within a further 35 days, except for records needed for open claims, the survival of fees under the Recovery Agreement, or retention the law requires.

10. Audits

Trace Global will give the customer the information needed to show compliance with this DPA, including its current SOC 2 Type II report and security questionnaire answers. Where that is not enough, the customer may audit once a year on 30 days notice, during business hours, subject to confidentiality and without disrupting operations, or more often after a breach.

11. Liability and governing law

Liability under this DPA is subject to the limits in the Terms of Service. This DPA is governed by the laws of India, with the courts at Hanamkonda, Telangana, unless a data protection law requires otherwise. Contact: privacy@traceglobal.si.