PacklogX

PacklogX Data Processing Agreement

Version 1.0.0 · Effective 20 September 2026

This Data Processing Agreement (“DPA”) forms part of the agreement between the Customer and PacklogX under the PacklogX Terms and Conditions. It applies where PacklogX processes personal data on behalf of the Customer in providing the Service. The Customer is the controller and PacklogX is the processor, unless applicable data protection law provides otherwise.

1. Scope and processing details

  • Subject matter: hosting and processing of packaging compliance data.
  • Duration: for the term of the Customer’s use of the Service and any agreed retention or deletion period.
  • Nature and purpose: storing, organising, securing, retrieving and otherwise processing data to provide, support and maintain the PacklogX Service.
  • Types of personal data: names, business contact details, account and role data, portal invitation and authentication data, audit information, and personal data included in packaging, supplier, customer, document or compliance records.
  • Categories of data subjects: the Customer’s employees and users, customer and supplier representatives, Customer Portal users, Supplier Portal users and other business contacts whose data the Customer enters into the Service.

2. Customer instructions and obligations

PacklogX will process personal data only on the Customer’s documented instructions, including the instructions inherent in the Customer’s use and configuration of the Service, unless Union or Member State law requires otherwise. In that case, PacklogX will inform the Customer before processing unless the law prohibits that information on important grounds of public interest.

The Customer is responsible for the lawfulness, accuracy and necessity of personal data submitted to the Service, for providing required notices, and for assigning appropriate user and portal access.

3. Confidentiality and security

PacklogX ensures that persons authorised to process personal data are bound by confidentiality obligations and access it only as necessary to provide the Service.

Taking into account the state of the art, implementation costs, the nature, scope, context and purposes of processing and the risks to individuals, PacklogX maintains appropriate technical and organisational measures. Current measures include HTTPS/TLS in transit, authenticated access, role-based permissions, organisation-level database access controls and audit logging of relevant actions.

4. Subprocessors

The Customer gives PacklogX general authorisation to use subprocessors necessary to provide the Service. The current provider information is stated in the Privacy Policy and an up-to-date overview is available from info@packlogx.eu.

PacklogX will impose data protection obligations on subprocessors that provide materially equivalent protection for the relevant processing. PacklogX remains responsible to the Customer for a subprocessor’s performance of its data protection obligations as required by applicable law.

PacklogX will provide reasonable advance notice of an intended material addition or replacement of a subprocessor where required, allowing the Customer to raise reasonable data-protection objections.

5. Data subject requests and compliance assistance

Taking into account the nature of the processing, PacklogX will reasonably assist the Customer through appropriate technical and organisational measures with responding to requests from data subjects. PacklogX will also provide reasonable assistance with the Customer’s obligations concerning security, personal data breaches, data protection impact assessments and prior consultation, taking into account the nature of processing and information available to PacklogX.

6. Personal data breaches

PacklogX will notify the Customer without undue delay after becoming aware of a personal data breach affecting personal data processed on the Customer’s behalf and will provide information reasonably available to support the Customer’s assessment and notification obligations.

7. International transfers

PacklogX will ensure that any transfer of personal data outside the European Economic Area complies with Chapter V GDPR, including through an adequacy decision, applicable Standard Contractual Clauses or another lawful transfer mechanism.

8. Return and deletion

At the end of the processing services, PacklogX will, at the Customer’s choice and subject to the Service’s available export functionality, return or delete personal data processed on the Customer’s behalf and delete existing copies, unless Union or Member State law requires storage. The post-termination access and export period described in the Terms and Privacy Policy applies before deletion.

9. Information and audits

PacklogX will make available information reasonably necessary to demonstrate compliance with Article 28 GDPR and will allow and contribute to reasonable audits or inspections by the Customer or an independent auditor mandated by the Customer. Audits must be arranged on reasonable notice, minimise disruption, preserve other customers’ confidentiality and security, and may be satisfied through current independent reports or documentation where appropriate.

10. Priority and governing terms

If this DPA conflicts with the Terms regarding the processing of personal data on the Customer’s behalf, this DPA prevails to the extent of that conflict. Terms not defined here have the meaning given in the Terms. The governing law and jurisdiction provisions of the Terms apply to this DPA.

By accepting the PacklogX Terms and Conditions or entering into a subscription that incorporates them, the Customer enters into this DPA where PacklogX processes personal data on the Customer’s behalf.

PacklogX business details

The registered visiting address is protected from public disclosure and is not published here.