Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the agreement between The Label Kitchen LLC ("Processor," "we," "us," or "our"), a limited liability company registered in the State of Minnesota, and the entity or individual using The Label Kitchen, including its API (the "Service," as defined in our Terms of Service) ("Controller," "you," or "your"). This DPA supplements our Terms of Service and governs the processing of personal data by us on your behalf.

By creating an account and accepting our Terms of Service, you enter into this DPA. This DPA satisfies the requirements of Article 28 of the UK General Data Protection Regulation ("UK GDPR"), the EU General Data Protection Regulation ("EU GDPR"), and any successor legislation.

If you have signed a separate data processing agreement with us, or a Managed plan agreement that includes data processing terms, those terms prevail over this DPA where they conflict, and later versions of this DPA do not change them unless that agreement says so. The Standard Contractual Clauses in Annex B prevail over both, as they require.

1. Definitions

"Personal Data" means any information relating to an identified or identifiable natural person, as defined in the UK GDPR and EU GDPR. "Processing" means any operation performed on Personal Data, including collection, storage, retrieval, use, transmission, erasure, and destruction. "Data Subject" means the identified or identifiable natural person to whom Personal Data relates. "Sub-processor" means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Scope and Purpose of Processing

Subject matter: The Processor provides a web-based label and document design platform. In the course of providing the Service, the Processor may process Personal Data submitted by the Controller through templates, address tables, related workspace data, uploaded data files (such as EDI documents), and requests to the API.

Duration: Processing continues for as long as the Controller has an account. Following account closure or termination, Personal Data is retained for up to 30 days solely to allow for export or recovery, after which it is erased.

Nature and purpose: Storage and retrieval of template configurations, address data, and workspace metadata necessary to operate the Service. Rendering and generation of labels and documents using data provided by the Controller, whether through the web application or the API. Data files and API request contents are processed only to produce the requested output and are not stored afterwards. The Processor records usage counts, which contain no Personal Data. If processing fails, the resulting error message may include a fragment of the input; such messages are kept in operational logs for up to 7 days.

Types of Personal Data: Names, postal addresses, email addresses, telephone numbers, company names, and any other data the Controller includes in templates, address tables, or API requests.

Categories of Data Subjects: The Controller's customers, suppliers, recipients, employees, or other individuals whose data the Controller includes in the Service.

3. Controller's Instructions

The Processor shall process Personal Data only on documented instructions from the Controller, unless required to do so by applicable law. The Controller's instructions are documented in this DPA, the Terms of Service, and any configuration the Controller makes within the Service. The Processor shall immediately inform the Controller if, in its opinion, an instruction infringes applicable data protection law. The Processor is not required to monitor the Controller's use of the Service or the content the Controller submits.

4. Confidentiality

The Processor ensures that all persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. This obligation survives the termination of this DPA and the Controller's account.

5. Security Measures

The Processor implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR and EU GDPR. These measures include: encryption of data in transit using TLS/HTTPS; access controls restricting database and system access to authorized personnel; access checks on every request, so that each customer can reach only its own workspaces and data; rate limiting of requests; internal security review of changes to the Service; logical separation of customer data by workspace; and secure deletion of data upon account termination.

6. Sub-processors

The Controller provides general written authorization for the Processor to engage Sub-processors. The Processor shall maintain a current list of Sub-processors, which is set out in Annex A. The Processor shall notify the Controller by email at least 14 days before adding or replacing a Sub-processor. If the Controller objects to a new Sub-processor on reasonable data protection grounds, it may close its account by telling the Processor through the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy within 14 days of the notice, stating its reasons. Reasonable data protection grounds means a specific concern that the new Sub-processor would not protect Personal Data as this DPA or applicable data protection law requires. The account closes on the date the Controller chooses, no later than the date the new Sub-processor begins processing. Fees already paid for the current billing period are not refunded, and no further fees are charged after the account closes. A minimum term under a separate written agreement, such as a Managed plan agreement, still applies unless the Processor agrees otherwise in writing.

Where the Processor engages a Sub-processor, the Processor shall impose on that Sub-processor the same data protection obligations as set out in this DPA by way of a contract. The Processor remains fully liable to the Controller for the performance of the Sub-processor's obligations.

7. Data Subject Rights

The Processor shall, taking into account the nature of the processing, assist the Controller by appropriate technical and organizational measures in fulfilling the Controller's obligation to respond to requests from Data Subjects exercising their rights under the UK GDPR and EU GDPR (including rights of access, rectification, erasure, restriction, portability, and objection). If the Processor receives a request from a Data Subject directly, the Processor shall promptly forward it to the Controller.

To support portability requests, the Processor provides the Personal Data held in the Controller's account as exportable data, in the formats described in the Switching and Data Portability section of the Terms of Service.

8. Breach Notification

The Processor shall notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach. The notification shall include: the nature of the breach, including the categories and approximate number of Data Subjects and records concerned; the likely consequences of the breach; and the measures taken or proposed to address the breach and mitigate its effects. The Processor shall assist the Controller in meeting the Controller's breach notification obligations under Articles 33 and 34 of the UK GDPR and EU GDPR.

9. Data Protection Impact Assessments

The Processor shall provide reasonable assistance to the Controller with data protection impact assessments and prior consultations with supervisory authorities, where required under the UK GDPR and EU GDPR, taking into account the nature of the processing and the information available to the Processor.

10. International Transfers

The Service is operated from infrastructure located in the European Union (Scaleway). Administrative access by the Processor's personnel may occur from the United States; such access is covered by the Standard Contractual Clauses referenced below. No general-purpose transfer of Personal Data to the United States occurs at rest.

For transfers of Personal Data from the European Economic Area to a third country without an adequacy decision, the parties incorporate the Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor), as set out in Annex B to this DPA. For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs (issued under Section 119A of the Data Protection Act 2018) applies.

11. Audit Rights

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations set out in this DPA and shall allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audits shall be conducted at the Controller's expense, with reasonable prior notice (at least 30 days), during normal business hours, and no more than once per calendar year unless required by a supervisory authority or following a data breach. Any auditor appointed by the Controller must sign a non-disclosure agreement and may not be a competitor of the Processor. The Processor will first respond to an audit request with written information, such as answers to the Controller's security questionnaire, the measures described in this DPA, and the certifications held by its Sub-processors. An inspection takes place only if that information is not enough to demonstrate compliance.

12. Deletion and Return of Data

Upon closure or termination of the Controller's account, or upon the Controller's written request, the Processor shall, at the Controller's choice, delete or return all Personal Data to the Controller and delete existing copies, unless applicable law requires retention. Deletion from the live Service shall be completed within 30 days of the request or termination date. Backup copies expire automatically within 7 days after that.

13. Change of Processor

The Controller authorizes the Processor to transfer this DPA, and the Personal Data processed under it, to a successor under the Assignment section of the Terms of Service, provided that: (a) the successor assumes every obligation of the Processor under this DPA; (b) the processing location and Sub-processors do not change because of the transfer, except as notified under Section 6; and (c) the Controller receives at least 30 days' notice before the transfer takes effect.

If the Controller objects to the transfer, it may close its account by telling the Processor through the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy before the transfer takes effect. Section 12 then applies to the return and deletion of Personal Data. Fees already paid for the current billing period are not refunded, and no further fees are charged after the account closes. A minimum term under a separate written agreement, such as a Managed plan agreement, still applies unless the Processor agrees otherwise in writing.

14. Liability

The liability of each party under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

15. Governing Law

This DPA is governed by the laws of the State of Minnesota, except that the data protection obligations are governed by the UK GDPR and EU GDPR as applicable to the Controller's jurisdiction, and the Standard Contractual Clauses in Annex B are governed as set out in that Annex. Any disputes arising under this DPA shall be resolved in accordance with the dispute resolution provisions of the Terms of Service.

16. EU and UK Representatives

Where the Processor is required to appoint a representative under Article 27 of the EU GDPR or Article 27 of the UK GDPR, it will do so, notify affected Controllers, and publish the representative's details in the Privacy Policy.

17. Contact

Questions about this DPA? Use the "Help" button or the email address at the top of https://the.label.kitchen/legal-and-privacy.

Annex A: Sub-processors

The following Sub-processors are authorized to process Personal Data on behalf of the Controller as of the effective date of this DPA:

Scaleway (Scaleway SAS, EU): cloud infrastructure hosting, database, container, object storage, and transactional email services (including sign-in and support emails). Processing location: European Union.

Creem (Armitage Labs OÜ, registry code 16977866, Tallinn, Estonia, EU): merchant of record for payment processing and subscription billing. Processes billing-related data only, and does so as an independent controller under its own privacy notice.

Proton (Proton AG, Switzerland): business email hosting. Processes email content exchanged with the Processor. All data encrypted at rest and in transit. Processing location: Switzerland.

This list is updated when Sub-processors are added or changed. The Controller will be notified by email at least 14 days in advance of any changes.

Annex B: Standard Contractual Clauses

For transfers of Personal Data from the European Economic Area to a third country without an adequacy decision, the parties incorporate the Standard Contractual Clauses approved by the European Commission under Commission Implementing Decision (EU) 2021/914, Module 2 (Controller to Processor). The completed SCC annexes are as follows:

Options selected. Clause 9(a): Option 2, general written authorization, with notice at least 14 days in advance (as in Section 6 of this DPA). Clause 17: the Clauses are governed by the law of the Netherlands. Clause 18: disputes are resolved by the courts of the Netherlands.

Annex I.A: Parties. Data exporter: the Controller (the entity using the Service), with the name, address, and contact person given in its account; role: controller; activities: designing and generating labels and logistics documents. Data importer: The Label Kitchen LLC, c/o registered agent, 202 N Cedar Ave, STE 1, Owatonna, MN 55060, United States, contact: as listed at the top of https://the.label.kitchen/legal-and-privacy; role: processor; activities: providing the Service. Accepting the Terms of Service constitutes each party's signature and date for this Annex.

Annex I.B: Description of transfer. Categories of data subjects: the Controller's customers, suppliers, recipients, employees, or other individuals whose data the Controller includes in the Service. Categories of personal data: names, postal addresses, email addresses, telephone numbers, company names, and any other data the Controller includes in templates, address tables, or API requests. Purpose of processing: storage, retrieval, rendering, and generation of labels and documents as described in §2 of this DPA. Frequency: continuous for as long as the Controller has an account. Retention period: as long as the Controller has an account, plus up to 30 days for export or recovery.

Annex I.C: Competent supervisory authority. The competent supervisory authority is the supervisory authority of the Member State in which the Controller (the data exporter) is established.

Annex II: Technical and Organizational Measures. As described in §5 of this DPA: encryption of data in transit (TLS/HTTPS); access controls restricting database and system access to authorized personnel; per-request access checks limiting each customer to its own workspaces and data; rate limiting; internal security review of changes to the Service; logical separation of customer data by workspace; secure deletion upon account termination.

Annex III: Sub-processors. As set out in Annex A of this DPA.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs (issued under Section 119A of the Data Protection Act 2018) applies and is incorporated by reference.