Data Processing Agreement — Business Edition

1. Subject matter and duration

1.1 The Provider processes personal data on behalf of the Customer solely to supply the Trusted Codes Business Edition: a verification service that issues and verifies word-based access codes between identified people, together with the organisation administration, notification and support functions described in the product documentation.

1.2 The duration of the processing corresponds to the duration of the Customer’s subscription, extended by the deletion periods in Section 10.

2. Nature and purpose of the processing

2.1 The Provider processes personal data only to:

• create and administer user accounts and organisation membership;
• generate, distribute and verify access codes and related cryptographic material;
• deliver notifications by electronic mail and push message;
• provide the administration console, reporting and support;
• protect the service against fraud and abuse;
• meet its own legal obligations.

2.2 The Provider does not sell personal data and does not use it to train machine-learning models. The Provider processes the following data as an independent controller and not on behalf of the Customer: data needed to secure the service against fraud and abuse (including risk scoring at sign-in), billing data, data needed to meet legal obligations, and statistics about the use of the service. Where an end user stores their own API key for the assistant, the provider of that key receives assistant content under the end user’s instruction; that provider is not a sub-processor of the Provider.

3. Types of personal data

3.1 The following categories may be processed:

3.2 Code secrets. Where the end user’s application supports it, code secrets are encrypted on the end user’s device for specific recipient devices (X25519, AES-GCM), and the Provider cannot decrypt that copy. Code secrets are also processed by the Provider in the following cases, where they are encrypted at rest with AES-256-GCM under a key the Provider controls, kept in a key-management service in the European Union separate from the database, and can be decrypted by the Provider’s servers: (a) connection and organisation codes generated by the service; (b) code generation for machine clients and the desktop application; (c) invitation delivery until the recipient’s device has received the secret; (d) accounts using server key backup; (e) demonstration accounts.

4. Categories of data subjects

• the Customer’s members, employees and administrators;
• the Customer’s verified contacts, being external persons whom the Customer verifies;
• persons invited by the Customer who have not yet accepted;
• persons who verify a code issued by the Customer.

5. Instructions of the controller

5.1 The Provider processes personal data only on documented instructions from the Customer. This agreement, the Terms of Service, and the Customer’s use of the product functions constitute those instructions.

5.2 The Provider informs the Customer without delay if, in its opinion, an instruction infringes data protection law. The Provider may suspend the execution of that instruction until the matter is resolved.

5.3 Where the Provider is required by Union or Member State law to process personal data beyond the Customer’s instructions, the Provider informs the Customer of that legal requirement before processing, unless that law forbids the notice on important grounds of public interest.

5.4 When the Customer’s users connect with users of servers operated by other operators (federation), the Provider transmits the data needed for that connection to those servers on the Customer’s instruction. The other operators are not sub-processors of the Provider.

6. Confidentiality

6.1 The Provider ensures that every person authorised to process the personal data is bound by an obligation of confidentiality, whether by contract or by statute, and that the obligation survives the end of their engagement.

6.2 Access is limited to those persons who need it to supply the service or to meet a legal obligation.

7. Security of processing (Article 32 GDPR)

7.1 The Provider applies the technical and organisational measures described in Annex 1. The Customer has reviewed those measures and considers them appropriate to the risk.

7.2 The Provider may change the measures, provided the level of protection is not reduced.

8. Sub-processors

8.1 The Customer gives general authorisation for the engagement of sub-processors. The current list is Annex 2, which is also published on its own page so that it can be dated and superseded independently of this agreement.

8.2 The Provider informs the Customer at least 30 days before a new sub-processor begins processing, or before an existing one is replaced. Notice is given by electronic mail to the Customer’s administrative contact and by an update to the published list.

8.3 The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected subscription, with a refund of the unused prepaid period.

8.4 The Provider imposes on every sub-processor, by contract, data protection obligations no less protective than those in this agreement, and remains fully liable to the Customer for the performance of that sub-processor.

9. Assistance to the controller

9.1 Data subject rights. Taking into account the nature of the processing, the Provider assists the Customer by appropriate technical and organisational measures in fulfilling requests under Chapter III GDPR. The product provides export and deletion functions that allow the Customer to answer most requests without contacting the Provider. Each end user can also export their own personal data in the product.

9.2 The Provider forwards to the Customer, without undue delay, any request it receives directly from a data subject relating to the Customer’s data, and does not respond to it itself unless legally required or instructed.

9.3 Personal data breach. The Provider notifies the Customer without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting the Customer’s data. The notice describes the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed.

9.4 The Provider assists the Customer with data protection impact assessments and prior consultations under Articles 35 and 36 GDPR, so far as the information is available to the Provider and not available to the Customer.

10. Deletion and return

10.1 The Customer’s administrators may export the organisation’s data with the product’s export function throughout the subscription and for 30 days after termination. Each export file remains available for download for 7 days after it is created. Where the export function is not available to the Customer after termination, the Provider provides the export on request within the same 30 days.

10.2 After that period, the Provider deletes the personal data within a further 60 days, including from backups in accordance with the backup rotation schedule, unless Union or Member State law requires continued storage.

10.3 Billing records are retained for the statutory retention period under German commercial and tax law.

11. Audit

11.1 The Provider makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR.

11.2 The Provider satisfies audit obligations in the first instance by providing documentation, including this agreement, Annex 1, the sub-processor list, and any third-party certification or report it holds.

11.3 Where that documentation is not sufficient, the Customer may carry out an audit, or mandate an independent auditor who is not a competitor of the Provider, subject to: reasonable prior notice of at least 30 days, no more than once per calendar year except after a personal data breach, conduct during normal business hours, no disruption to the service, and a written confidentiality undertaking. The Customer bears its own costs.

12. International transfers

12.1 Some sub-processors are established outside the European Economic Area, as marked in Annex 2.

12.2 For each such transfer the Provider relies on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), together with the supplementary measures described in Annex 1. Where the recipient is covered by an adequacy decision, the Provider may rely on that decision instead.

12.3 The Provider selects a European deployment region where the sub-processor offers one.

13. Liability and final provisions

13.1 Liability follows the Terms of Service. Article 82 GDPR remains unaffected.

13.2 Where the Terms of Service and this agreement conflict on the processing of personal data, this agreement prevails.

13.3 The Provider may amend this agreement where required by law or by a change to the service. Material amendments are notified at least 30 days in advance. If the Customer objects, they may terminate the affected subscription with a refund of the unused prepaid period.

13.4 German law applies. The place of jurisdiction is Munich, so far as the law permits a choice.

13.5 If any provision is invalid, the remainder stays in force.

Annex 1 — Technical and organisational measures

Annex 2 — Sub-processors

This list is also published on its own page at trusted.codes/legal/subprocessors, where it carries its own date and is superseded independently of this agreement.

Current as of 2026-10-01

Acceptance record

The Provider records, for each acceptance: the accepting user, the organisation, the document identifier and version, the date and time, the address of origin, and the client identification.

The Customer may retrieve the exact version they accepted at any time, at the versioned address shown at the top of this page. The version identifier does not depend on the language read: all six translations of this text are version 2026-10-04.

Where the parties instead conclude a negotiated or signed agreement, the record stores a reference to that document and marks the source as offline.

A negotiated or signed agreement

A customer whose own legal team needs a negotiated or counter-signed document may request one at privacy@trusted.codes. Accepting this standing agreement is not a waiver of that request, and the request does not have to be settled before a subscription is purchased: this standing agreement governs in the meantime, and a negotiated document replaces it from the date both parties sign.