SHIPMANX – Data Processing Agreement

1. Parties and Roles

This Data Processing Agreement ("DPA") forms part of the agreement between the Customer ("Controller") and GLOB M ("Processor") for the SHIPMANX service. The Controller determines the purposes and means of the processing; the Processor processes Personal Data only on the Controller's documented instructions.

[Counsel: insert legal entity names, registered addresses and the incorporation-by-reference clause.]

2. Subject Matter, Duration, Nature and Purpose

• Subject matter: provision of the SHIPMANX logistics platform.
• Duration: the term of the subscription plus any agreed retention period.
• Nature and purpose: hosting, storage, processing and transmission of shipment, document and account data to operate the service.

[Counsel: insert the retention schedule and the deletion-on-termination terms.]

3. Categories of Data Subjects and Personal Data

Data subjects may include the Controller's employees, customers and suppliers. Categories of Personal Data include:

• account data: name, email address, company name, phone number;
• operational data: shipment and logistics records, documents and notes that may name individuals;
• technical data: IP address, browser type and usage analytics.

[Counsel: insert any special-category data terms, if applicable.]

4. Processor Obligations

• Process Personal Data only on documented instructions from the Controller.
• Ensure persons authorised to process the data are bound by confidentiality.
• Implement appropriate technical and organisational security measures (see Section 6).
• Assist the Controller in responding to data-subject requests, including the self-service export and erasure tools provided in the SHIPMANX account area.
• Delete or return Personal Data at the end of the provision of services, subject to legal retention requirements.

[Counsel: insert breach-notification timelines and the point of contact.]

5. Sub-processors

The Controller authorises the engagement of the sub-processors listed below. The Processor remains liable for a sub-processor's performance and will give notice before adding or replacing one.

• Payment processing: Paddle
• Hosting infrastructure: [Counsel: insert provider]
• Analytics and email delivery: [Counsel: insert providers]

[Counsel: insert the sub-processor change-notice window and objection process.]

6. Security Measures

• encrypted connections (HTTPS);
• restricted database access and role-based permissions;
• multi-factor authentication for account access;
• audit and activity logging of security-relevant actions.

[Counsel: insert any certifications or audit rights.]

7. International Data Transfers

Where Personal Data is transferred outside the Controller's jurisdiction, the parties rely on an appropriate transfer mechanism.

[Counsel: insert the standard contractual clauses or adequacy reference.]

8. Audits and Inspections

The Processor will make available the information necessary to demonstrate compliance and allow for audits, subject to reasonable notice and confidentiality.

[Counsel: insert audit frequency and cost allocation.]

9. Liability and Term

[Counsel: insert the liability cap, governing law and the signatures block.]