Data processing agreement

A template under Article 28 GDPR for customers who send personal data (such as names to screen) to Factline. Fill in the parts in [brackets] and send it to hello@factline.dev for signature. Technical details are on the trust page.

1. Parties

Controller: [customer legal name, address, registration number] ("Customer"). Processor: Factline, [legal name and address of the operator] ("Factline").

2. Subject and duration

Factline processes personal data only to provide the checks the Customer requests through the Factline API, MCP server or website (the "Service"), for as long as the Customer uses the Service.

3. Data and data subjects

Categories of data: names, birth years, email addresses, phone numbers, VAT and company numbers, and Dutch addresses or licence plates sent in requests. Data subjects: the Customer's customers, suppliers, payees and their representatives.

4. Instructions

Factline processes the data only on the Customer's documented instructions, which are the API requests themselves, and does not use the data for any other purpose.

5. Retention

Names and other personal data sent for screening are not stored after the request is answered. Data the Customer asks Factline to monitor (/v1/watch) is kept until the Customer deletes the watch or ends the Service. Usage records contain no query content.

6. Confidentiality and security

Persons with access to the data are bound to confidentiality. Factline uses encryption in transit (TLS), stores API keys only as hashes, limits access to production systems to the operator, and rate-limits public endpoints.

7. Sub-processors

The Customer authorises the sub-processors listed on factline.dev/trust (Cloudflare for hosting, Coinbase and Dodo Payments for payments). Factline will announce a new sub-processor on that page at least 14 days in advance; the Customer may object and end the Service.

8. International transfers

Where a sub-processor processes data outside the EEA, the transfer relies on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

9. Assistance and breaches

Factline helps the Customer answer data subject requests and informs the Customer without undue delay, and within 48 hours, after becoming aware of a personal data breach affecting the Customer's data.

10. End of the Service

When the Service ends, Factline deletes the Customer's monitoring data and API keys within 30 days, unless law requires otherwise.

11. Audit

Factline makes available the information needed to show compliance with this agreement and allows reasonable audits on 30 days' notice, at the Customer's cost.

Template, not legal advice. Signed: [Customer] ____________ date ______ · [Factline] ____________ date ______