Data processing agreement

The terms under which Tiercube processes personal data on behalf of its business customers.

Last updated: DRAFT

1. Parties and scope

This data processing agreement (“DPA”) is between the customer that accepts the Tiercube terms of service (“Customer”) and Morfose USA Inc., 3920 Tollhouse Drive, Naples, FL 34114, United States (“Tiercube”). It forms part of the terms of service or other agreement under which Tiercube provides its service (the “Agreement”) and applies whenever Tiercube processes Customer Personal Data. It is intended to meet Article 28(3) of the EU GDPR and the UK GDPR, and the equivalent requirements of other Data Protection Laws. (under legal review)

2. Definitions

• Data Protection Laws: all laws on personal data that apply to the processing, including the EU GDPR (Regulation 2016/679), the UK GDPR and Data Protection Act 2018, the Swiss FADP, Türkiye’s Law No. 6698 (“KVKK”), and US state privacy laws such as the California Consumer Privacy Act as amended by the CPRA (“CCPA”).
• Customer Personal Data: personal data within the Customer Data (as defined in the terms of service) that Tiercube processes on the Customer’s behalf.
• Subprocessor: a third party that Tiercube engages to process Customer Personal Data.
• “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR; under KVKK they correspond to veri sorumlusu, veri işleyen, ilgili kişi and veri ihlali.

3. Roles

For Customer Personal Data, the Customer is the controller and Tiercube is the processor. Where the Customer is itself a processor for another controller, Tiercube is its subprocessor, and the Customer confirms it is authorised to give the instructions in this DPA. Tiercube is a separate controller for account, security and billing data about the Customer’s users, as described in the privacy policy; this DPA does not cover that data.

The Customer is responsible for the lawfulness of the Customer Personal Data it puts into the Service, including notices to and any consents from its customers, employees and carriers.

4. Instructions

Tiercube processes Customer Personal Data only on the Customer’s documented instructions. The Agreement, this DPA and the Customer’s use and configuration of the Service are the Customer’s complete instructions. Tiercube will tell the Customer if it believes an instruction infringes Data Protection Laws, and is not required to follow it. If the law requires Tiercube to process data otherwise, it will tell the Customer first unless the law prohibits that.

Tiercube will not sell Customer Personal Data, use it for advertising, or use it to train artificial intelligence models.

5. Confidentiality of personnel

Tiercube ensures that personnel authorised to process Customer Personal Data are bound by confidentiality obligations and access it only as needed to provide, secure and support the Service. Tiercube’s internal admin tools show account-level information (company, plan, usage, members and roles) and do not display the contents of plans, catalogs, addresses or customer names.

6. Security

Tiercube implements and maintains the technical and organisational measures in Annex II, taking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing (GDPR Article 32). Tiercube may update these measures provided the overall level of protection does not decrease.

7. Subprocessors

• The Customer gives a general authorisation for Tiercube to use the subprocessors listed on the subprocessors page (Annex III).
• Tiercube will give at least 30 days’ notice before a new subprocessor processes Customer Personal Data, by updating that page and notifying account owners by email. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the remaining period.
• Tiercube imposes data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for their performance.

8. Data subject requests and assistance

Tiercube will promptly forward to the Customer any request from a data subject about Customer Personal Data and will not answer it except to redirect the requester, unless the Customer authorises it. Taking into account the nature of the processing, Tiercube will help the Customer respond, including through features of the Service (owners and admins can view and correct catalog items, company settings and warehouse addresses, deactivate catalog items and delete warehouse addresses, and export the company’s data as a JSON file, with the catalog also as a CSV file; each user can delete their own account). Tiercube will also give reasonable help with data protection impact assessments and prior consultations with supervisory authorities, to the extent they concern the Service.

9. Personal data breaches

Tiercube will notify the Customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the categories and approximate number of data subjects and records concerned, likely consequences and the measures taken or proposed. Tiercube will update the Customer as more information becomes available and take reasonable steps to contain the breach. Notice is not an admission of fault.

10. Return and deletion

During the subscription, the Customer can delete warehouse addresses and deactivate catalog items through the Service. Saved plans cannot be deleted one by one today; they are deleted with the workspace. (under legal review) At the end of the Agreement, or when an owner requests deletion of the company workspace: (under legal review)

• owners and admins can export the company’s data as a JSON file (members, warehouse addresses, catalog, saved plans with their versions, pallet usage, the record of warning emails sent and the audit log without IP digests), with the catalog also as a CSV file, before the request and during the waiting period;
• an owner requests deletion by typing the company’s name; pending invitations are cancelled at once; the workspace becomes read-only for a 30-day waiting period, during which changes are refused and an owner can cancel at any time until the deletion job starts; after that, a daily job deletes Customer Personal Data from the live database in batches, which can take more than one day for a large workspace;
• if a user who is the only member of a company deletes their account, that company is deleted without a waiting period and its data is removed by the next run of the daily job;
• the database provider’s point-in-time recovery history expires within a further 30 days;
• Tiercube keeps, as security and billing evidence, a closed record of the company (internal ID, a short hash of its former name, country, language and time-zone settings, and dates), the audit log with IP digests and before/after values removed, per-month pallet totals without order numbers, records of quota adjustments made by Tiercube staff, the record of warning emails sent (type, date, delivery status and number of recipients, without email addresses), and counts of database rows used per plan save. These remain subject to this DPA for as long as they are kept, which is seven years.

Tiercube will not be required to delete data it must keep by law; that data stays protected under this DPA. Data stored only in a user’s browser (see the cookie policy) is outside Tiercube’s control and is deleted by clearing the browser’s storage.

11. Audits

On request, Tiercube will provide the information reasonably necessary to demonstrate compliance with this DPA, such as written answers to security questionnaires and a description of its measures. If this is not enough to meet the Customer’s obligations, or a supervisory authority requires it, the Customer may carry out an audit, at its own cost, no more than once a year, with at least 30 days’ written notice, during business hours, subject to confidentiality and without access to other customers’ data. Audits of subprocessors are satisfied by their own third-party certifications and reports where available.

12. International transfers

Tiercube is located in the United States. Where Customer Personal Data is transferred from the EU/EEA, the UK or Switzerland to a country without an adequacy decision, the parties agree that:

• the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 apply, Module Two (controller to processor) where the Customer is a controller and Module Three (processor to processor) where the Customer is a processor, and are incorporated by reference: (under legal review);
• for the UK, the International Data Transfer Addendum issued by the Information Commissioner applies to the SCCs (under legal review);
• for Switzerland, references to the GDPR are read as references to the FADP and the competent authority is the FDPIC (under legal review).

If the Data Privacy Framework or another lawful mechanism applies, Tiercube may rely on it instead. (under legal review)

13. US state privacy laws

Where the CCPA or a similar US state law applies, Tiercube acts as a “service provider” or “processor”. Tiercube will not sell or share Customer Personal Data; will not retain, use or disclose it outside the direct business relationship with the Customer or for any purpose other than the business purposes in the Agreement; will not combine it with personal data received from other sources except as the law allows; will comply with applicable obligations and provide the same level of protection the law requires; and will notify the Customer if it can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate unauthorised use.

14. KVKK

Where KVKK applies, Tiercube acts as veri işleyen and the Customer as veri sorumlusu. Tiercube takes the technical and administrative measures required by Article 12 of KVKK, notifies the Customer of any unlawful acquisition of Customer Personal Data so that the Customer can notify the Personal Data Protection Board and data subjects, and transfers Customer Personal Data abroad only in line with Article 9 of KVKK, using the standard contract published by the Personal Data Protection Authority where required (under legal review).

15. Liability and order of precedence

Each party’s liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws do not allow this. If this DPA conflicts with the Agreement, this DPA prevails on data protection matters; if the Standard Contractual Clauses conflict with this DPA, the Clauses prevail. This DPA is governed by the law that governs the Agreement, except where the Clauses require otherwise.

Annex I: details of processing

Annex II: technical and organisational measures

• Tenant isolation: every table holding Customer Data carries a company ID; all database queries go through a single data-access layer that takes the company from the authenticated session, never from request input; the company ID of a stored record cannot be changed (database triggers); automated tests derived from the database schema and the route table verify that each endpoint returns “not found” for another company’s records.
• Authentication: passwordless one-time sign-in links (15 minutes, single use, confirmed by a separate click) or Google sign-in with PKCE, state and nonce checks and verified email only; account linking to an existing email requires confirmation.
• Authorisation: four role levels checked on every request against live membership data; at least one owner per workspace enforced in the database; staff access through a separate platform role that returns the same “not found” response to everyone else.
• Session management: random 256-bit session values stored only as SHA-256 hashes; __Host-, HttpOnly, Secure, SameSite=Lax cookies; 7-day inactivity and 90-day absolute limits; sign-out from all devices; daily deletion of expired sessions and sign-in records.
• Request integrity: origin checks (Sec-Fetch-Site / Origin) on every state-changing request; JSON-only request bodies (bodiless deletes excepted); schema validation of inputs; server-side consistency checks of saved plans.
• Abuse controls: per-address and per-email rate limits on sign-in; quota limits enforced in the database.
• Data minimisation: IP addresses stored only as salted, truncated digests; no IP address or browser details stored with sessions; request bodies not logged; order files read in the user’s browser and not uploaded.
• Accountability: append-only audit log protected against update and deletion by database triggers; staff changes to a customer’s plan, quota and trial are logged, and quota additions and trial changes require a written reason.
• Transport and browser security: HTTPS with HSTS; Content Security Policy; framing denied; no referrer; third-party libraries pinned with subresource integrity.
• Secrets management: credentials stored as platform secrets, not in source code.
• Availability and recovery: managed database with 30-day point-in-time recovery. (under legal review)
• Organisational: (under legal review)

Annex III: subprocessors

The list of subprocessors, their purpose, location and status is published on the subprocessors page and forms Annex III of this DPA.