1. Purpose

This Data Processing Agreement ("DPA") forms part of the agreement between ForgeStop Technology Corp. ("ForgeStop", "Processor") and the counterparty identified in the applicable Master Subscription Agreement or Statement of Work ("Client", "Controller") for the provision of ForgeStop's NFC/RFID product authentication platform services.

This DPA sets out the terms under which ForgeStop processes Personal Data on behalf of the Client, and establishes the rights and obligations of each party with respect to data protection in compliance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR), India's Digital Personal Data Protection Act (DPDPA), Mexico's Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP), and the California Consumer Privacy Act (CCPA).

2. Definitions

"Applicable Data Protection Law" means any law, regulation, or binding guidance relating to the processing of Personal Data applicable to the parties.

"Controller" means the Client, who determines the purposes and means of processing Personal Data under this DPA.

"Data Subject" means an identified or identifiable natural person whose Personal Data is processed under this DPA.

"ForgeStop Operational Data" means all raw data generated by or through ForgeStop's platform infrastructure in the course of providing authentication services, including individual tag scan events, authentication pass/fail results, scan timestamps, non-identifying device signatures, and approximate geolocation signals. ForgeStop is an independent Data Controller of this data.

"Client Brand and Product Data" means data specific to the Client's brand, products, packaging configurations, SKU identifiers, product metadata, and materials provided by the Client for authentication service configuration. The Client retains ownership.

"Client Personal Data" means any Personal Data of the Client's employees, representatives, or end consumers shared with ForgeStop or collected through the Client's use of the ForgeStop platform. ForgeStop processes this data solely as Processor.

"Personal Data" means any information relating to an identified or identifiable natural person, as defined under Applicable Data Protection Law.

"Processor" means ForgeStop Technology Corp., which processes Client Personal Data on behalf of the Controller.

"Sub-processor" means any third party engaged by ForgeStop to process Client Personal Data on behalf of the Controller.

"Security Incident" means any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Client Personal Data.

3. Roles and Responsibilities

3.1 ForgeStop acts in a dual capacity under this DPA:

• (a) As an independent Data Controller with respect to ForgeStop Operational Data, determining the purposes and means of processing such data in connection with the operation, maintenance, and improvement of its authentication platform.
• (b) As a Data Processor with respect to Client Personal Data, processing such data solely at the Client's documented instructions and for the purposes specified in the applicable SOW.

3.2 Each party shall be individually responsible for complying with its obligations under Applicable Data Protection Law in its respective capacity as Controller or Processor.

3.3 The Client, as Controller, is responsible for ensuring that it has a lawful basis for providing Personal Data to ForgeStop, including obtaining any necessary consents from Data Subjects.

3.4 Third parties used in ForgeStop's business administration. In addition to the Sub-processors engaged to deliver the services, ForgeStop uses third-party software to administer its own business: accounting, contract execution, customer relationship management, email and document storage, project records, and the recording and transcription of its own meetings. Personal data of Client personnel may appear in those systems incidentally, for example a name on an invoice, an email address in a project record, or a voice on a recorded call.

In respect of that data ForgeStop acts as a Controller, not as a Processor on the Client's behalf, and each such third party is ForgeStop's own processor under a separate written contract. Those third parties are disclosed in Annex 2, Table B in the interests of transparency. They are not Sub-processors as defined in Section 2, and the notice, objection and audit provisions in Sections 6 and 11, which govern Sub-processors, do not apply to them.

ForgeStop remains responsible under Applicable Data Protection Law for that processing in its capacity as Controller, including lawful basis, transparency to the individuals concerned, responding to their rights requests, and the lawfulness of any international transfer.

4. Scope of Processing

4.1 ForgeStop shall process Client Personal Data only to the extent necessary to provide the authentication platform services described in the applicable MSA and SOW, and in accordance with the Client's documented instructions.

4.2 The categories of Personal Data, categories of Data Subjects, nature and purpose of processing, and duration of processing are set out in Annex 1 to this DPA.

4.3 ForgeStop shall not process Client Personal Data for any purpose other than providing the services, unless required by applicable law.

5. Data Security Measures

5.1 ForgeStop shall implement and maintain appropriate technical and organisational measures to protect Client Personal Data, including:

• (a) Encryption: TLS 1.2+ in transit; AES-256 at rest backed by AWS KMS (FIPS 140-2 Level 3). API keys encrypted with AES-256-GCM (authenticated encryption) before database storage.
• (b) Access Control: Microsoft Entra ID provides single sign-on for ForgeStop personnel access to federated business systems. AWS IAM Identity Center with role-based groups and tiered permission sets governs infrastructure access. AWS Cognito for client authentication. Production databases in private VPC subnets only. Tenant isolation enforced on every API request: via JWT claims for interactive callers, and key-scoped tenancy for machine credentials.
• (c) Secrets Management: AWS Secrets Manager (machine/code) and 1Password Business (human access). CI/CD uses GitHub Actions OIDC (keyless, no static credentials). API keys rotated per ForgeStop's API Key & Secrets Lifecycle Policy.
• (d) Infrastructure and Document Isolation: Separate VPC per environment (production, staging, sandbox). Logical data segregation per client in the multi-tenant architecture via tenant ID scoping on all database queries.
  
  Separately, and in ForgeStop's capacity as Controller under Section 3.4: Client documents and correspondence held outside the platform are stored in dedicated per-client document spaces with access restricted on a need-to-know basis. A ForgeStop team member's access to one Client's space does not confer access to another's.
• (e) Audit Logging: AWS CloudTrail for infrastructure access; structured application-level audit logging for all data access events with actor, role, IP, and field-level change history.
• (f) Personnel: All ForgeStop personnel with access to Client Personal Data bound by confidentiality obligations.
• (g) AI-Assisted Processing. ForgeStop uses AI tools in defined internal workflows, principally the transcription of recorded meetings and the generation of meeting notes and internal work items from those transcripts. This is ForgeStop's own record-keeping, undertaken in its capacity as Controller under Section 3.4, and not processing carried out on the Client's behalf. Where such workflows involve personal data of Client personnel, ForgeStop applies the following safeguards:
  • Processing is initiated by an authorised ForgeStop team member on a per-item basis. It is not automated, scheduled, or applied in bulk without human initiation.
  • AI tools are used under organisational accounts subject to the vendor's commercial terms. Personal accounts are prohibited.
  • Personal data classified as Restricted under ForgeStop's Information Classification & Handling Policy, including credentials, API keys, and encryption keys, is never processed by any AI tool.
  • AI-generated output is reviewed by a person before it is relied upon, acted on, or communicated to a Client.
  • The AI vendors engaged in these workflows are disclosed in Annex 2, Table B.
  ForgeStop does not use Client Personal Data to train any AI model, and engages these vendors under terms that prohibit them from doing so.

5.2 ForgeStop shall regularly test, assess, and evaluate the effectiveness of its security measures.

6. Sub-processing

6.1 The Client provides general authorisation for ForgeStop to engage Sub-processors, subject to this Section 6.

6.2 Current Sub-processors are listed in Annex 2, Table A. ForgeStop provides 15 days advance written notice before engaging new Sub-processors.

6.3 Client may object within 15 days on reasonable data protection grounds. If unresolved, Client may terminate the affected SOW.

6.4 ForgeStop imposes data protection obligations no less protective than this DPA on each Sub-processor, whether through a negotiated agreement or by acceptance of the Sub-processor's standard data processing terms. ForgeStop remains fully liable for Sub-processor acts and omissions.

6.5 Sections 6.1 to 6.4 apply to Sub-processors only. The third parties disclosed in Annex 2, Table B are engaged by ForgeStop in its capacity as Controller under Section 3.4 and are not Sub-processors.

7. Security Incident Notification

7.1 ForgeStop shall notify the Client without undue delay (and within 72 hours of becoming aware) of any Security Incident affecting Client Personal Data.

7.2 Notification shall include: nature of incident, categories and approximate number affected, likely consequences, measures taken/proposed, and ForgeStop contact point.

7.3 ForgeStop shall cooperate with Client's investigation, supervisory authority notification, and remediation.

8. International Data Transfers

8.1 ForgeStop's platform is hosted on Amazon Web Services (AWS), US-based regions (primary: us-east-1; disaster recovery replication: us-west-2). Data may be processed outside the Client's home jurisdiction.

8.2 Certain Sub-processors listed in Annex 2, Table A process data exclusively in the United States and do not offer regional data residency options. Where such a Sub-processor processes Client Personal Data originating in the European Economic Area, transfers are made under Standard Contractual Clauses or another recognised transfer mechanism.

8.2A Separately, and in ForgeStop's capacity as Controller under Section 3.4, certain third parties disclosed in Annex 2, Table B process data exclusively in the United States. This includes the meeting recording and transcription services ForgeStop uses (Krisp and Granola), which store meeting recordings and transcripts on US-based servers only and offer no regional data residency option, and whose support and processing chains extend to affiliates and providers outside the United States. Where such processing involves personal data of Client personnel originating in the European Economic Area, ForgeStop makes those transfers as Controller under Standard Contractual Clauses or another recognised transfer mechanism, and maintains its own transfer impact assessment for them.

8.3 ForgeStop shall ensure appropriate safeguards for cross-border transfers: Standard Contractual Clauses (SCCs) where GDPR applies, contractual provisions meeting applicable law, or other recognised transfer mechanisms.

8.4 ForgeStop shall confirm specific processing regions upon request.

9. Data Subject Rights

9.1 ForgeStop shall assist the Client in responding to Data Subject rights requests (access, rectification, erasure, restriction, portability, objection).

9.2 ForgeStop shall forward direct Data Subject requests to the Client and shall not respond directly unless instructed or required by law.

9.3 Section 9.2 applies to Client Personal Data processed by ForgeStop as Processor. Where an individual exercises rights in respect of personal data ForgeStop holds as Controller under Section 3.4, ForgeStop responds directly and maintains a route for doing so, as described in its own privacy notice.

10. Data Retention and Deletion

10.1 ForgeStop retains Client Personal Data only as long as necessary for the services or as required by law.

10.2 Upon termination: Client has a 60-day export window. ForgeStop shall return or securely delete Client Personal Data within 90 days following the export window, except where retention is required by law.

10.3 ForgeStop Operational Data is retained for up to 2 years and managed per ForgeStop's Privacy Policy (ForgeStop is independent Controller). Client Brand and Product Data is retained for up to 1 year post-termination for reactivation, audit, or legal purposes, then purged or anonymised.

10.4 Individual user data deletion requests are honoured within 30 days.

10.5 Written confirmation of deletion provided upon request.

10.6 Automated backup retention: RDS PostgreSQL backups purged after 14 days (production); MongoDB Atlas snapshots purged after 35 days. S3 noncurrent versions purged after 90 days via lifecycle rules.

10.7 Meeting recordings and transcripts generated under Section 5.1(g) are ForgeStop's own records, held in its capacity as Controller under Section 3.4. They are retained in accordance with ForgeStop's Information Classification & Handling Policy and its published retention schedule, and are deleted on request.

11. Audit Rights

11.1 ForgeStop shall make available information necessary to demonstrate DPA compliance and contribute to audits, subject to 60 days advance notice and confidentiality obligations.

11.2 ForgeStop may satisfy audits via documentation (certifications, reports, pen test results, written Q&A). On-site or remote access may be provided at ForgeStop's reasonable discretion with written consent.

11.3 Client bears own audit costs. Limited to once per calendar year unless required by supervisory authority or following confirmed Security Incident.

12. Term and Termination

12.1 This DPA remains in effect for the duration of ForgeStop's processing of Client Personal Data.

12.2 Sections 5, 7, 10, and 11 survive termination.

13. Governing Law

13.1 Governed by the governing law of the applicable MSA.

13.2 Where GDPR applies, DPA provisions interpreted in accordance with GDPR regardless of MSA governing law.

Annex 1: Processing Details

Annex 2: Third Parties

Annex 2 is presented as two tables because ForgeStop occupies two different roles. Table A lists Sub-processors as defined in Section 2: third parties processing Client Personal Data on the Client's behalf. Sections 6 (notice and objection) and 11 (audit) apply to them. Table B lists third parties ForgeStop uses to administer its own business, disclosed for transparency under Section 3.4; ForgeStop is Controller of that data and Sections 6 and 11 do not apply.

Table A: Sub-processors (service delivery)

Platform-level providers exempt from per-engagement client notification: AWS, MongoDB Atlas, New Relic, Mapbox, IPStack/PositionStack and Google reCAPTCHA are standard platform-level services disclosed in this list at contract signing and are exempt from the 15-day per-engagement notification requirement under Section 6.2. Regional Implementation Partners and any future vendor with direct Client Personal Data access require notification.

Table B: Third parties used in ForgeStop's business administration

Disclosed for transparency under Section 3.4. ForgeStop is Controller of this data. These are not Sub-processors; Sections 6 and 11 do not apply to them.

ForgeStop maintains the current Sub-processor List at forgestop.com/subprocessors. Clients may subscribe to notifications of Sub-processor changes by contacting help@forgestop.com.

Change Log

← Back to Legal · Sub-processor List · Version 1.3 · Last updated: October 2026