Data Processing Agreement

1. Definitions

2. Scope and Purpose

This DPA applies to the processing of personal data by Cargoman on behalf of the Customer in connection with the provision of the Cargoman private Composer registry service.

• Account data (name, email address, organisation name)
• Package metadata (package names, version numbers, author information)
• Usage logs (API requests, download records, timestamps)
• Technical data (IP addresses, user agent strings, authentication tokens)

3. Processor Obligations

Cargoman shall:

• Process personal data only on the Customer's documented instructions, unless required to do so by applicable law, in which case Cargoman shall inform the Customer of that legal requirement before processing (unless prohibited by law)
• Ensure that all personnel authorised to process personal data are bound by appropriate confidentiality obligations
• Implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk of processing
• Assist the Customer in responding to Data Subject requests within 15 business days of receiving notice of such a request
• On termination of the service, delete or return all personal data to the Customer, at the Customer's choice, and delete existing copies unless applicable law requires retention
• Make available to the Customer all information necessary to demonstrate compliance with the obligations set out in this DPA, and allow for and contribute to audits and inspections conducted by the Customer or an auditor mandated by the Customer, with reasonable notice and no more than once per year

4. Sub-Processing

The current list of sub-processors is available at cargoman.io/legal/subprocessors.

Cargoman shall provide the Customer with at least 30 days' written notice before engaging any new sub-processor. The Customer may object to the engagement of a new sub-processor in writing within 14 days of receiving such notice.

If the Customer objects and no reasonable resolution can be reached, the Customer may terminate the affected services without penalty by providing written notice within 30 days of the original notification.

Cargoman remains fully liable for the acts and omissions of its sub-processors as if they were the acts and omissions of Cargoman itself.

5. Security Measures

• Encryption in transit (TLS 1.3)
• Encryption at rest (AES-256)
• Password hashing (Argon2)
• Access token hashing (SHA-256)
• Role-based access controls (RBAC)
• Network segmentation
• Regular vulnerability assessments

• Staff confidentiality agreements
• Security awareness training
• Access limited to need-to-know basis
• Incident response procedures

6. Data Breach Notification

In the event of a personal data breach, Cargoman shall notify the Customer without undue delay and no later than 72 hours after becoming aware of the breach. The notification shall include:

• The nature of the personal data breach
• The categories and approximate number of Data Subjects affected
• The approximate number of personal data records concerned
• The likely consequences of the breach
• The measures taken or proposed to address the breach and mitigate its effects

Cargoman shall cooperate with the Customer in fulfilling the Customer's obligations under Articles 33 and 34 of the GDPR, including notification to supervisory authorities and communication to Data Subjects where required.

7. International Transfers

Where personal data is transferred outside the European Economic Area or the United Kingdom, Cargoman ensures appropriate safeguards are in place:

• EU-US transfers: EU-US Data Privacy Framework certification where applicable
• Standard Contractual Clauses (EU SCCs) as approved by the European Commission for all other transfers
• UK International Data Transfer Agreement (IDTA) where required for transfers from the United Kingdom

8. Data Subject Rights

Cargoman shall assist the Customer in responding to requests from Data Subjects exercising their rights under applicable data protection law, including rights of access, rectification, erasure, restriction, portability, and objection.

If Cargoman receives a request directly from a Data Subject, Cargoman shall promptly notify the Customer and shall not respond to the request without the Customer's prior written instructions, unless required by applicable law.

Cargoman shall respond to the Customer's instructions regarding Data Subject requests within 15 business days.

9. Return and Deletion

Upon termination of the service agreement, the Customer may request a full export of their personal data in JSON format within 30 days of termination.

After the 30-day export period, Cargoman shall delete all Customer personal data, except where retention is required by applicable law (for example, payment records retained for tax compliance purposes).

Deletion shall include:

• Database records
• Stored packages
• Logs
• Backups (within 90 days of the deletion request)

10. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service.

Nothing in this DPA limits either party's liability for breaches of applicable data protection law to the extent such liability cannot be limited under that law.

11. Governing Law

This DPA is governed by the laws of England and Wales.

For Data Subjects located in the European Union, the EU General Data Protection Regulation (EU GDPR) applies as mandatory law regardless of the governing law of this DPA.

For Data Subjects located in the United Kingdom, the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 apply.

12. Amendments

This DPA may be updated from time to time to reflect changes in data protection law, regulatory guidance, or our processing activities.

Cargoman shall provide at least 30 days' written notice of any material changes to this DPA. Continued use of the service after such changes take effect constitutes acceptance of the updated DPA.

Contact

For questions about this Data Processing Agreement, please contact us:

Byte8 Ltd
Companies House: 16334175
London, United Kingdom
Email: [email protected]