Public draft for legal review. Negotiated signed terms and mandatory law take precedence; this page is not a certification or legal opinion.
Processing instructions, client-key reports and service metadata.
Roles and scope
For personal data submitted under a business agreement, the client determines purpose and lawful basis; Trade Eyes processes service data according to documented instructions, subject to the executed agreement. Account, billing and abuse-prevention purposes may involve separate controller responsibilities.
Local and encrypted reports
Local workbench files are processed in the browser. Optional private report storage receives AES-GCM ciphertext; the company holds the decryption key. Membership, timestamps and billing metadata remain readable for service operation. Legacy broker AI requests and other existing workspaces are separate plaintext processing paths; this DPA does not represent them as zero-knowledge.
Data categories and instructions
Limit uploads to necessary, authorized data. Do not include special-category personal data without an agreed lawful scope. Contract schedules must specify purposes, subjects, categories, duration, regions and approved subprocessors before an executed DPA is relied on.
Safeguards and incidents
Access is organization-scoped and verified server-side. Report suspected incidents to hello@tradeeyes.app. Notifications, assistance with rights requests and breach obligations follow applicable law and the signed agreement; no unapproved fixed notification deadline is asserted here.
Transfers and deletion
Hosting and payment providers may process data in their operating locations. Appropriate transfer mechanisms, subprocessor schedules and retention instructions require contractual review. Key destruction may make ciphertext unreadable but is not a claim of immediate deletion of all backups.
Required processing schedule
Before signing, complete the legal parties, covered service, purposes, operations, data-subject categories, personal-data categories, duration, documented instructions and contact points. Include any restrictions on sensitive data and describe each actual processing path. An unfinished public schedule is not an executed DPA.
Instructions and confidentiality
The customer must have authority and a lawful basis for submitted personal data. Processing is limited to the contracted service and documented lawful instructions, subject to legal obligations. The executed DPA should specify how instruction changes, confidentiality duties and authorized personnel are handled.
Subprocessors and international transfers
Agree a verified schedule of actual providers, functions, processing locations and applicable transfer safeguards before execution. Also agree subprocessor notice, objection and replacement procedures. This draft does not verify residency, provide a complete subprocessor register or claim adequacy for every jurisdiction.
Rights requests and incidents
The executed agreement should define secure request channels, responsibilities, identity verification, assistance with rights requests, impact assessments and incidents. Contact partnership@tradeeyes.tech for B2B coordination without sending raw personal data or credentials. Any notification deadlines must comply with applicable law and be stated in the executed terms; no specific response-time promise is supplied here.
Evidence and assurance
Document implemented technical and organizational measures for the scoped service and agree proportionate evidence or review procedures. Organization-scoped authorization and optional company-held encryption keys are described in the Security Policy. This is not an independent security audit, certification or proof that all processing is zero-knowledge.
Return, deletion and retention instructions
Agree per-store export, return and deletion instructions, legal-retention exceptions and backup handling at contract end. Company-held key destruction can render private ciphertext unreadable but does not erase readable operational metadata or prove immediate backup deletion. Authorized users must export needed records and preserve keys before access ends.
Contact
Questions and contract requests: partnership@tradeeyes.tech.