Data Processing Addendum

Customer is the Controller; Tracks IT is the Processor for personal data processed on Customer's behalf within the Service.

• Subject matter: provision of the Service.
• Duration: term of the subscription + 30-day export window.
• Data subjects: Customer's authorized users.
• Categories: identifiers, professional/role data, content uploaded by users (photos, voice notes, inspection metadata).

Current sub-processors:

• Supabase (database, auth, storage) — EU region.
• Lovable AI Gateway → Google Gemini — AI inference, zero-retention.
• Cloudflare — edge delivery, DDoS protection.

We will give 30 days' notice before adding a new sub-processor.

Encryption in transit and at rest, RBAC, row-level security, audit logs, MFA, least-privilege access for staff, annual penetration testing.

EU Standard Contractual Clauses (2021/914) apply where applicable. UK IDTA addendum available on request.

We will assist Customer in fulfilling DSARs within 5 business days of request via privacy@enginetracksit.com.

We will notify Customer of any personal data breach without undue delay, and in any event within 72 hours of confirmation.

On termination, Customer may export data for 30 days; thereafter we will delete it within 60 days, subject to backup expiry cycles.