Data Processing Agreement

Version: 12 October 2026

between

the customer identified in the Main Agreement, as Controller

and

Essential Code GmbH, Glücksallee 8/Top 1, 3012 Wolfsgraben, Austria, company number FN 605928x, registered with the Regional Court of St. Pölten, as Processor

1. Relationship with the Main Agreement

1.1 This Agreement governs the Processor’s processing of personal data on the Controller’s behalf in connection with Glasswise. It supplements the agreement for the use of Glasswise and the applicable terms, together the “Main Agreement”.

1.2 It specifies the obligations under Article 28 of Regulation (EU) 2016/679, the “GDPR”, and the Austrian Data Protection Act, the “DSG”. For conflicts concerning personal data processing, this Agreement prevails over the Main Agreement.

1.3 The Controller is the controller and the Processor is the processor. Where either party processes data for its own purposes, that party acts in its own data protection role for that processing.

2. Subject matter and duration

2.1 The subject matter is software for digital wine labels, QR codes and GS1 Digital Links, together with related hosting, account management, support, operational messaging, document generation, redirection and usage-analysis functions.

2.2 Processing starts when the service is activated and continues until the Main Agreement ends. Obligations that by their nature survive, including confidentiality, return, deletion, evidence and liability, continue afterwards.

3. Nature and purpose of processing

3.1 The Processor may process personal data only as needed to provide, secure, maintain and support Glasswise. Operations include collection, recording, organisation, storage, retrieval, use, transmission, making available, alignment, restriction and deletion.

3.2 Purposes include:

• managing user accounts, organisations, roles and permissions
• creating and delivering digital labels, QR destinations, GS1 Digital Links and data sheets
• operating redirects and technically necessary access logging
• sending transactional and service messages
• error analysis, security, abuse prevention and support
• sharing published e-label data with E-Label Atlas, Essential Code’s own shared e-label database, as part of the service when activated by the Controller

3.3 Processing for the Processor’s own purposes is outside this Agreement and requires a separate legal basis and transparent information.

4. Data subjects and types of data

4.1 Data subjects may include:

• staff, officers, agents and other users of the Controller
• business partners, bottlers, producers, importers, distributors and their contacts
• people accessing digital labels or related links
• people making support requests or named in content supplied by the Controller

4.2 Data may include:

• identity and contact data such as name, business email, telephone, company and role
• account, tenant, role and permission data
• product, wine, vintage, ingredient, nutrition, origin, operator and labelling data where personal
• link, QR, access and usage data such as time, destination, referrer, country, device type, browser and network metadata
• message, support, error and log data
• technical identifiers, external service identifiers, subscription and status data
• files, images and data-sheet content uploaded by the Controller

4.3 Special categories under Article 9 GDPR and criminal-offence data under Article 10 GDPR are not intended. The Controller must not submit such data without prior written agreement.

5. Instructions and Controller obligations

5.1 The Processor processes data only on documented instructions, unless EU or Austrian law requires otherwise. Where permitted, it will inform the Controller before legally required processing.

5.2 The Main Agreement, use of intended features, support requests and written directions are documented instructions. A material expansion of service, effort or risk may require a separate agreement.

5.3 If the Processor considers an instruction unlawful, it will promptly inform the Controller and may suspend it until resolved.

5.4 The Controller is responsible for lawfulness, transparency, minimisation, accuracy, legal bases, consents and responses to data-subject requests. It grants access only to authorised persons and does not use the service for data excluded by clause 4.3.

6. Processor obligations and confidentiality

6.1 The Processor ensures that authorised persons are bound by confidentiality or an appropriate statutory duty. Confidentiality continues after their work ends.

6.2 The Processor implements and maintains all technical and organisational measures required by Article 32 GDPR. Annex 2 describes the implementation currently verified from configuration or code and does not limit that risk-based obligation. Access is limited to what is necessary for operations, security and support.

6.3 Taking account of the processing and information available, the Processor assists with Articles 32 to 36 GDPR and applicable DSG duties.

6.4 Where lawful, authority requests concerning Controller Data will be referred to the Controller. The Processor will notify the Controller before compulsory disclosure where legally permitted.

7. Data-subject rights and impact assessments

7.1 Through appropriate measures, the Processor assists with requests for access, rectification, erasure, restriction, portability and objection.

7.2 A request received directly and concerning Controller Data will be forwarded without undue delay. The Processor will not answer on the Controller’s behalf without documented instructions.

7.3 On reasonable request, the Processor provides available information for impact assessments and prior consultations. Exceptional additional work may be charged by prior agreement unless caused by the Processor’s breach.

8. Personal data breaches

8.1 The Processor will notify the Controller of a breach affecting Controller Data without undue delay and no later than 48 hours after becoming aware of it. An incomplete investigation does not postpone the initial notice.

8.2 As available, the notice describes the incident, affected data and people, likely consequences, measures taken or proposed, and a contact point. Missing information follows without undue delay.

8.3 The Processor will take reasonable containment, remediation and investigation measures and document the incident. Notice is not an admission of breach or liability.

9. Sub-processors

9.1 The Controller gives general authorisation for the sub-processors in Annex 1.

9.2 The Processor gives at least 30 days’ notice before adding or replacing a sub-processor. The Controller may object on reasonable data-protection grounds within 14 days of receipt.

9.3 The parties will seek a reasonable solution. If none is possible, the Processor may withhold the affected feature or the Controller may terminate the affected service component for cause. Other Main Agreement rights remain unaffected.

9.4 The Processor binds each sub-processor by contract or another legal act permitted under EU or Member State law to the same applicable data-protection obligations, including appropriate technical and organisational measures under Article 32 GDPR. The Processor remains fully responsible to the Controller under Article 28(4) GDPR for the sub-processor’s performance.

10. Processing outside the EEA

10.1 A transfer to a third country or international organisation requires documented instructions and compliance with GDPR Chapter V. Where EU or Austrian law requires processing, clause 5.1 applies and the applicable transfer requirements remain unaffected.

10.2 Without an adequacy decision, the Processor will use a permitted instrument, particularly European Commission Standard Contractual Clauses, and suitable supplementary measures where needed.

10.3 Before a transfer, the parties determine the correct Standard Contractual Clauses module and contracting parties from their actual roles. The Processor enters the clauses directly as data exporter where required for a processor-to-processor transfer. It acts in the Controller’s name only where the correct module requires this and the Controller has separately documented its authorisation. On request, the Processor will provide information about the instrument, subject to confidentiality and security constraints.

11. Return and deletion

11.1 At the end of the services, the Processor will, at the Controller’s choice, return Controller Data in an available common format or delete it. After return, it will delete all remaining copies, including copies held by sub-processors, unless EU or Austrian law requires retention.

11.2 Return or export remains available during the transition period and throughout the applicable retrieval period. Deletion takes place only after the applicable retrieval safeguards have been satisfied, subject to mandatory retention duties and the Controller’s lawful documented instructions.

11.3 Data retained by law and backup copies remaining temporarily until the end of their confirmed cycle are restricted, protected against reuse and processed only for the applicable retention or restoration purpose.

12. Evidence and audits

12.1 The Processor makes available information reasonably needed to demonstrate Article 28 GDPR compliance.

12.2 The Processor allows and contributes to necessary audits and inspections by the Controller or an independent auditor bound by confidentiality. One audit per calendar year is expected in normal operations; additional audits are permitted following reasonable suspicion, a material incident, a regulatory requirement or other necessity to demonstrate compliance. Documentary review and available reports are used first where practicable.

12.3 Audits normally require two weeks’ notice, occur during business hours and must avoid unreasonable disruption or harm to security, other customers and confidential information. The Controller bears the costs unless a material Processor breach is established. These arrangements must not prevent or unreasonably delay effective statutory audit rights or urgent regulatory inspections.

12.4 The Processor will inform the Controller if it believes an audit or instruction infringes data-protection law.

13. Liability and order of precedence

13.1 Liability is governed by Article 82 GDPR and, where legally permitted, the Main Agreement’s liability provisions. Mandatory claims of data subjects and regulatory powers remain unaffected.

13.2 Nothing limits liability that applicable law does not permit to be limited.

14. Law, jurisdiction and final provisions

14.1 Austrian law applies, excluding conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods.

14.2 To the extent legally permitted, the court with subject-matter jurisdiction in St. Pölten, Austria has exclusive jurisdiction.

14.3 Amendments require text form. Invalidity of one provision does not affect the rest. The parties will replace it with a valid provision that most closely achieves its commercial and data-protection purpose.

Annex 1: Approved sub-processors

Provider	Purpose	Data	Location or region and transfer basis
Nhost AB, Tallåsstigen 4, 141 71 Segeltorp, Sweden	Authentication, database, object storage, backend and functions	Account, organisation, role, product, content, file and log data	Production endpoint in eu-central-1, Frankfurt; transfers outside the EEA require prior written consent and use EU Standard Contractual Clauses unless otherwise agreed
Vercel, Inc.	Hosting the administration application and delivering digital labels	Request and log data, technical identifiers and delivered content	Compute region fra1, Frankfurt; possible global support and security processing under appropriate safeguards, particularly Standard Contractual Clauses
Dub Technologies, Inc., 2261 Market Street STE 5906, San Francisco, CA 94114, United States	Short links, redirects, geographical rules and access statistics	Destination URL, link and tenant identifiers, country, device type and request metadata	United States and other countries where Dub or its sub-processors operate; EU Standard Contractual Clauses apply to transfers to countries without an adequacy decision
AC PM LLC, 1 North Dearborn Street, 5th floor, Chicago, IL 60602, United States, Postmark service	Transactional and service email	Recipient email, name, message content, template data and possible attachments	Primary data and servers at the Deft data centre outside Chicago and at Amazon Web Services; EU-US Data Privacy Framework, with EU Standard Contractual Clauses for regulated transfers where required
PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, United States	Product analytics and error diagnosis in the application on the Controller’s instructions; processing for the Processor’s own purposes is not covered by this authorisation	User and tenant identifiers, email, name, page and usage events, and error context	EU endpoint eu.i.posthog.com; EU-hosted data is stored and processed in Germany; EU-US Data Privacy Framework and EU Standard Contractual Clauses
Gleap GmbH, Am Dorfplatz 3, 6858 Schwarzach, Austria	Support, feedback and error diagnosis on the Controller’s instructions; processing for the Processor’s own purposes is not covered by this authorisation	User identifier, name, email, support content, subscription and status metadata	Customer-content hosting in Frankfurt, Germany, or NYC3, New York, United States, according to the selected region; other processing may occur outside the selected region
Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, United States	Turnstile abuse and bot protection during authentication	IP address, browser, device, request and challenge data	Information is primarily stored in the United States and the EEA and may be accessed globally; EU-US Data Privacy Framework, with Standard Contractual Clauses and supplementary measures if that certification becomes invalid
PDFMonkey, 49 rue de Ponthieu, Lot 41, 75008 Paris, France	PDF data-sheet generation	Product, wine, operator, image and document content where personal	Application servers, file storage and document rendering in Paris, France; database in Frankfurt, Germany

Annex 2: Technical and organisational measures

Only measures verifiable in current configuration or code are listed. No certification is represented.

1. Encryption in transit: Publicly configured application, API, storage and webhook endpoints use HTTPS.
2. Authentication: For email and password accounts, Nhost is configured to require email verification and a password of at least nine characters. Short-lived access tokens and separate refresh tokens are configured.
3. Authorisation and tenant separation: Database and API permissions account for roles, account membership and tenant assignment. Privileged backend actions use server-side permissions.
4. Production hardening: Hasura development mode is disabled and its configured CORS origin is the administration application.
5. Abuse prevention: Turnstile and request limits are configured for authentication flows.
6. Integrity of external calls: Incoming payment and service events use signatures or shared secrets where provided by the integration. Inputs are checked against defined schemas.
7. Regional configuration: The production backend endpoint is in eu-central-1; the configured administration and label application compute region is fra1.
8. Confidentiality and least access: Clause 6 applies contractual confidentiality and a necessity standard to people with administrative access.

Measures not listed here are governed by the risk-based duty in clause 6.2 and are not represented as separately verified contractual features.