Data Processing Addendum

Version 1.0 · Effective 2026-07-06

This Data Processing Addendum (“DPA”) forms part of the Ontracko Terms of Service between Ontracko (“Processor”) and the customer entity (“Controller”) that has agreed to those Terms. This DPA reflects the parties’ agreement on the processing of personal data by Ontracko on behalf of the Controller.

1. Subject matter & duration

Ontracko processes personal data on behalf of the Controller for the sole purpose of providing the Ontracko service (vendor SLA monitoring, credit claim generation, vendor intelligence). Processing continues for the duration of the customer’s subscription and terminates on account deletion, subject to the retention terms below.

2. Categories of data

• Account data: name, email, organization membership, authentication identifiers.
• Vendor connection data: vendor identifier, service list, monthly spend (customer-provided), region configuration, encrypted OAuth/IAM credentials where applicable.
• Operational data: publicly-visible incident records from vendor status feeds, computed uptime scores, generated claim documents, negotiation briefs.
• No special-category personal data is required for the service.

3. Sub-processors

Ontracko engages the sub-processors listed at /subprocessors. The Controller is notified of material changes with at least 30 days’ notice and may object in writing.

4. Security measures

• Transport encryption (TLS 1.2+) for all traffic.
• At-rest encryption for vendor credentials (AES-256-GCM via a rotating server key).
• Role-based access control (ADMIN / MANAGER / VIEWER) enforced at the API layer.
• Audit logging of privileged actions (invitations, role changes, impersonation, claim transitions, owner console actions).
• Backups: managed by the database provider (Neon) with point-in-time recovery.

5. Data subject rights

Ontracko assists the Controller in fulfilling access, correction, and deletion requests via the in-product controls (member management, account deletion) and, where additional support is required, via privacy@ontracko.app.

6. Retention & deletion

On termination or upon written request, Ontracko deletes customer personal data within 30 days, subject to legal retention obligations. Audit logs are retained for 12 months unless a longer retention is required by law.

7. International transfers

Where personal data is transferred out of the EEA, Ontracko relies on the EU Standard Contractual Clauses (2021/914) with our sub-processors.

8. Contact

Data-protection queries: privacy@ontracko.app.

This DPA template is provided for procurement review; a signed counterpart is available on request for annual and enterprise plans.