Legal / Data Processing Agreement

Data Processing Agreement

Green Story Platform & API Services

This Data Processing Agreement (“DPA”) is between Green Story Europe B.V., Lange Viestraat 2b, 3511 BK Utrecht, the Netherlands (“Green Story”), and the customer entity that has entered into the agreement(s) governing use of the Green Story platform and API services (the “Agreement”) with Green Story (“Customer”). This DPA is incorporated by reference into the Agreement and applies, without the need for signature, wherever Green Story processes Personal Data on Customer’s behalf.

1. Definitions

“GDPR” means Regulation (EU) 2016/679. “Personal Data” means personal data that Green Story processes on Customer’s behalf in providing the services, as described in Annex I. “Controller”, “Processor”, “Data Subject”, “Processing”, “Personal Data Breach” and “Supervisory Authority” have the meanings in the GDPR. “Subprocessor” means a third party engaged by Green Story to process Personal Data. “SCCs” means the EU standard contractual clauses (Decision (EU) 2021/914). Other capitalised terms have the meanings in the Agreement.

2. Roles and Instructions

Customer is the Controller; Green Story is the Processor. The processing is described in Annex I. Green Story will process Personal Data only on Customer’s documented instructions (being the Agreement, this DPA, and Customer’s use and configuration of the services), unless required by law — in which case Green Story will inform Customer beforehand where legally permitted. Green Story will inform Customer if it believes an instruction infringes data protection law.

3. Confidentiality

Green Story ensures that all persons authorised to process Personal Data — including personnel of its affiliate SimpliZero Sustainable Solutions Private Limited (India) — are bound by confidentiality obligations and process Personal Data only as needed to provide the services.

4. Security

Green Story implements appropriate technical and organisational measures in line with Article 32 GDPR, including at least the measures in Annex II. Green Story maintains an ISO/IEC 27001 certified information security management system. Green Story may update Annex II provided the overall level of protection is not materially reduced.

5. Subprocessors

Customer authorises the Subprocessors in Annex III. Green Story maintains a current list of Subprocessors at its online Subprocessor Page (https://greenstory.io/legal/subprocessors). Green Story will provide notice of any intended appointment or replacement of a Subprocessor by updating the Subprocessor Page and, where Customer has subscribed to updates via that page, by email notification, in each case at least 30 days before the new Subprocessor processes Personal Data. Green Story will bind each Subprocessor to obligations materially equivalent to this DPA and remains liable for their performance. If Customer reasonably objects on data protection grounds within the notice period and no solution is found within 30 days, Customer may terminate the affected services with a pro-rata refund of unused prepaid fees for those services.

6. Data Subject Requests

Green Story will reasonably assist Customer in responding to Data Subject requests (access, rectification, erasure, restriction, portability, objection). If a request comes directly to Green Story, it will forward it to Customer and not respond substantively unless instructed or legally required.

7. Assistance

Taking into account the nature of the processing and the information available to it, Green Story will reasonably assist Customer with data protection impact assessments, consultations with Supervisory Authorities, and Customer’s obligations under Articles 32–36 GDPR, and will promptly notify Customer of any Supervisory Authority inquiry relating to the processing, where legally permitted.

8. Personal Data Breach

Green Story will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting the Personal Data. The notice will describe, to the extent known, the nature of the breach, categories and approximate numbers of Data Subjects and records affected, likely consequences, and measures taken or proposed. Green Story will provide updates as information becomes available. Notification is not an admission of fault.

9. International Transfers

The production platform and Customer content are hosted in EU data centres (Hetzner, Germany/Finland); certain ancillary services (e.g. user authentication) are provided from US regions as set out in Annex III. Green Story will not transfer Personal Data outside the EEA without appropriate safeguards under Chapter V GDPR: an adequacy decision, the SCCs, or another valid mechanism. Remote access by SimpliZero personnel in India is governed by an intra-group agreement incorporating the SCCs. US Subprocessors are covered by the EU–US Data Privacy Framework where certified, otherwise the SCCs.

10. Deletion and Return

On termination of the Agreement, Green Story will, at Customer’s choice made within 30 days, return the Personal Data and/or delete it; absent a choice, Green Story will delete it. Deletion from live systems (or irreversible anonymisation) occurs within 90 days. Backup copies are purged through normal backup rotation within 12 months and remain protected by the Annex II measures until purged. Green Story may retain: (a) records containing Personal Data that it is required to keep by applicable law (for example invoicing and fiscal records, up to 7 years under Dutch law), which remain protected and are deleted when the legal retention period ends; and (b) anonymised data that no longer identifies any individual.

11. Audit

Green Story will make available information reasonably necessary to demonstrate compliance with this DPA, including its ISO/IEC 27001 certificate and security summaries on request. Audits are conducted remotely (documentation, questionnaires) where reasonably possible. Where that is insufficient, Customer (or an independent auditor bound by confidentiality, not a competitor) may audit once per 12 months on 30 days’ written notice, during business hours, at Customer’s cost, without unreasonable disruption. Additional audits are permitted after a Personal Data Breach or where required by a Supervisory Authority.

12. General

Liability under this DPA is subject to the limitations in the Agreement. This DPA applies for as long as Green Story processes Personal Data for Customer. If this DPA conflicts with the Agreement regarding Personal Data, this DPA prevails. Amendments require written agreement, except updates to Annex II (per Section 4) and Annex III (per Section 5). This DPA is governed by the laws of the Netherlands; the courts of Utrecht have exclusive jurisdiction, without prejudice to Data Subjects’ or Supervisory Authorities’ mandatory rights.

The version of this DPA in effect on the effective date of the Agreement (or applicable Statement of Work) applies to that engagement. On Customer’s request, the parties will also execute this DPA in signed form.

Privacy contact: [email protected]

Annex I — Description of Processing

Subject matter and duration: processing of Personal Data to provide the Green Story sustainability platform and API services (LCA / product footprinting, supply chain traceability, Digital Product Passports, corporate carbon footprinting, and related ESG services), for the term of the Agreement plus the deletion period in Section 10.

Nature and purpose: hosting, storage, transmission, display, analysis, support, and related technical operations needed to provide, secure, maintain and improve the services; and transmitting communications (including engagement and marketing communications) to recipients designated by Customer, on Customer’s instructions.

Data Subjects: Customer’s personnel and authorised users; contact persons at Customer’s suppliers and supply chain partners; Customer’s clients’ personnel where submitted; Customer’s end customers (consumers) receiving per-order communications at Customer’s direction (e.g. carbon offset confirmations); individuals named in uploaded documents (e.g. purchase orders, transaction certificates).

Personal Data: name, business email, phone, job title, employer, business address; login identifiers, authentication metadata, IP address, activity logs; support communications; consumer name, email address, and order reference data needed for per-order communications; communication content and delivery/engagement metadata; business contact details in supply chain documents.

No special categories of data (Article 9 GDPR) are intended to be processed; the services are not designed for them and Customer agrees not to submit them.

Customer is responsible for ensuring it has a lawful basis and any required consents (including under applicable e-marketing rules) for communications it instructs Green Story to send, including per-order communications to its end customers.

Annex II — Technical and Organisational Measures

1. ISO/IEC 27001 certified information security management system; documented security policies and risk assessments.
2. Hosting in ISO 27001 certified EU data centres (Hetzner, Germany/Finland); physical security by the data centre operator.
3. Web application firewall and DDoS mitigation (Cloudflare); segmented environments; administrative access only via private VPN.
4. Encryption in transit (TLS 1.2+) and at rest (volume-level encryption for databases; envelope encryption for stored credentials and secrets, AES-256-GCM with managed keys).
5. Role-based, least-privilege access control; unique accounts; multi-factor authentication; scoped, hashed API keys with rotation.
6. Centralised logging, monitoring, and alerting; audit trails.
7. High-availability database replication; load-balanced application tier; documented backups with defined rotation and restore testing.
8. Secure development: code review, controlled CI/CD deployment, dependency and vulnerability management.
9. Personnel confidentiality undertakings; security awareness; prompt access revocation (including affiliate personnel in India).
10. Documented incident response process, including breach assessment and the notification duties in Section 8.

Annex III — Authorised Subprocessors

The current list of authorised Subprocessors is maintained at the Subprocessor Page, which forms Annex III of this DPA. Green Story updates the list per Section 5 (Subprocessor Page notice, with optional email subscription; 30 days; right to object).