Data Processing Agreement

This Data Processing Agreement (“DPA”) supplements the Ozzint Classify Terms of Service and sets out the obligations of Ozzint Ltd (“Processor”) when processing personal data on behalf of customers (“Controller”) in connection with the Ozzint Classify platform and any associated services. It is entered into automatically when you accept the Terms of Service.

This DPA is intended to satisfy the requirements of Article 28 of UK GDPR and the Data Protection Act 2018. Enterprise customers requiring a countersigned version of this DPA should contact legal@ozzint.com.

1. Definitions

In this DPA:

• “Controller” means the customer organisation that determines the purposes and means of processing personal data submitted to the Service.
• “Processor” means Ozzint Ltd, which processes personal data on the Controller’s behalf.
• “Sub-Processor” means any third party engaged by Ozzint Ltd to carry out processing activities on behalf of the Controller.
• “Personal Data” has the meaning given in UK GDPR Article 4(1).
• “Processing” has the meaning given in UK GDPR Article 4(2).
• “Data Subject” means any identified or identifiable natural person whose personal data is processed under this DPA.
• “UK GDPR” means UK General Data Protection Regulation as retained in UK law by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019.

2. Subject Matter, Nature, and Purpose of Processing

Ozzint processes personal data for the purpose of providing the customs compliance pipeline described in the Terms of Service: invoice extraction, HS tariff classification, sanctions screening, duty calculation, and export file generation. Processing is carried out on automated infrastructure using AI model inference, structured database storage, and email delivery systems.

The duration of processing corresponds to the term of the Controller’s subscription to the Service, subject to the retention obligations described in section 9 below.

3. Categories of Personal Data and Data Subjects

The following categories of personal data may be processed under this DPA:

• Account and contact data: names, email addresses, job titles, and contact details of the Controller’s users and administrators.
• Trade document content: personal data contained within commercial invoices, packing lists, and other uploaded documents, which may include names and contact details of suppliers, buyers, freight contacts, and other commercial parties.
• Compliance outputs: extracted line items, classification decisions, sanctions screening results, and audit records which may reference named individuals or organisations.

Data subjects may include the Controller’s employees, contractors, trading partners, and the natural persons named in uploaded trade documents.

4. Processor Obligations (Article 28(3) UK GDPR)

Ozzint Ltd, as Processor, commits to the following obligations in accordance with Article 28(3) UK GDPR:

(a) Processing only on documented instructions

Ozzint will process personal data only on the documented instructions of the Controller, as set out in the Terms of Service and as reflected in the Controller’s service configuration, uploaded documents, and support requests. If Ozzint is required by UK law to process personal data beyond those instructions, it will inform the Controller before doing so unless prohibited by law from doing so.

(b) Confidentiality of authorised personnel

Ozzint will ensure that persons authorised to process personal data under this DPA are subject to appropriate confidentiality obligations, whether contractual or arising from professional duties, and are informed of the confidential nature of the data.

(c) Security measures

Ozzint will implement and maintain appropriate technical and organisational security measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage, as required by Article 32 UK GDPR. Current measures include:

• Encryption of personal data in transit (TLS 1.2 or higher) and at rest.
• Row-level security on the database, with organisation-scoped access controls enforced at the application layer.
• Immutable audit logging of all pipeline processing events.
• Access controls limiting production data access to authorised personnel only.
• Infrastructure hosted on enterprise-grade cloud platforms with SOC 2-certified controls.
• Regular review of security measures in line with industry standards.

(d) Sub-processing

The Controller provides general written authorisation for Ozzint to engage sub-processors, subject to the conditions in section 5 of this DPA. Ozzint will impose equivalent data protection obligations on each sub-processor by contract, as required by Article 28(4) UK GDPR, and remains fully liable to the Controller for the sub-processor’s performance.

(e) Assistance with data subject rights

Taking into account the nature of the processing, Ozzint will assist the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from Data Subjects exercising their rights under UK GDPR (Articles 15 to 22), to the extent Ozzint is able to do so. Requests from Data Subjects should be forwarded to privacy@ozzint.com.

(f) Assistance with Article 32 to 36 obligations

Ozzint will assist the Controller in ensuring compliance with its obligations under Articles 32 to 36 UK GDPR, including: security measures (Article 32); notification of a personal data breach to the supervisory authority (Article 33); communication of a personal data breach to Data Subjects (Article 34); data protection impact assessments (Article 35); and prior consultation with the supervisory authority (Article 36). Ozzint will notify the Controller without undue delay, and in any event within 72 hours, upon becoming aware of a personal data breach affecting data processed under this DPA.

(g) Deletion or return of personal data

Upon termination of the Service, Ozzint will, at the Controller’s election, delete or return all personal data processed under this DPA, and delete existing copies, unless applicable law (including HMRC customs record-keeping requirements) requires continued storage. Where continued storage is mandated by law, Ozzint will inform the Controller of that requirement and restrict processing to the extent required. An export of the Controller’s compliance records will be made available for 30 days following termination of the Service on written request.

(h) Audit rights and information provision

Ozzint will make available to the Controller all information reasonably necessary to demonstrate compliance with the obligations in this DPA, and will allow for and contribute to audits and inspections conducted by the Controller or an auditor mandated by the Controller, subject to reasonable advance notice (minimum 30 days), agreement on scope and confidentiality, and reimbursement of Ozzint’s reasonable costs. Ozzint may satisfy audit obligations by providing relevant third-party certification or audit reports (such as SOC 2 reports from sub-processors) where appropriate.

5. Sub-Processors

The Controller provides general authorisation for Ozzint to engage the following sub-processors, each of which has been assessed and bound by appropriate data processing terms:

• Anthropic, PBC (United States) — AI inference for invoice extraction and classification
• Supabase, Inc. (United States) — PostgreSQL database, authentication, and file storage
• Vercel, Inc. (United States) — Platform hosting and serverless function execution
• Postmark / Wildbit, LLC (United States) — Transactional email delivery

Ozzint will provide the Controller with reasonable advance notice (not less than 14 days) of any intended addition or replacement of sub-processors. The Controller may object to a proposed change by notifying Ozzint in writing within 14 days. If the parties cannot resolve the objection, the Controller may terminate the affected Services on written notice without penalty.

6. International Data Transfers

All sub-processors named in section 5 are based in the United States. Transfers of personal data from the United Kingdom to these sub-processors are made using the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses as the transfer mechanism, in accordance with Article 46 UK GDPR. Transfer risk assessments have been completed for each sub-processor.

7. Governing Law

This DPA is governed by the laws of England and Wales. Any dispute arising from this DPA is subject to the exclusive jurisdiction of the courts of England and Wales.

8. Signed DPA

Enterprise customers requiring a countersigned DPA for their own compliance records, or customers whose procurement process requires bilateral execution, should contact legal@ozzint.com. A countersigned version of this DPA is available on request at no additional charge.