Data Processing Agreement

1. Parties and incorporation

This Data Processing Agreement (the "DPA") forms part of the Terms of Service between Lalalu Marketing SL, Travessera de Gràcia 73, 4-2, 08006 Barcelona, Spain (the "Processor", "AgeRail", "we") and the customer organisation that accepts the Terms (the "Controller", "Customer", "you").

This DPA is incorporated by reference into the Terms of Service at /terms. Acceptance of the Terms binds the Customer to this DPA. No separate signature or click-through is required for this DPA to take effect.

2. Roles

For personal data of end users that the Customer submits to the Service (or causes end users to submit) so that AgeRail can perform age verification on the Customer's instructions, the Customer is the controller and AgeRail is the processor under GDPR Article 28.

AgeRail acts as an independent controller for (a) tenant-user account and billing data needed to operate the commercial relationship, and (b) the operator-only calibration scalars described in section 6, which AgeRail processes for its own model-accuracy purposes under GDPR Art. 6(1)(f). Those controller activities are described in the Privacy Policy at /privacy and are outside the processor mandate of this DPA except where this DPA expressly discloses the calibration carve-out so the biometric-amnesia commitment is not overstated.

3. Subject matter, nature, and purpose

The Processor provides a hosted age-verification service: the Customer redirects an end user to the Processor-hosted flow; the Processor estimates age from a selfie, performs a liveness check, and returns a signed pass or fail result to the Customer. Processing is limited to delivering that Service and related support under the Customer's documented instructions (including configuration of target age, redirect URLs, and webhooks).

4. Duration

This DPA applies for as long as the Processor processes personal data on behalf of the Controller under the Terms, and thereafter for any wind-down period needed to return or delete Customer personal data under section 13.

5. Categories of data subjects and personal data

Data subjects under this DPA are primarily end users who complete a verification session.

Categories of personal data processed as processor include: verification flow metadata (session identifiers, status, the configured age threshold, redirect and webhook endpoints, timestamps) and transient biometric inputs (the face image and features derived from it) processed only as described in section 6. The verification response returned to the Customer is limited to a signed pass-or-fail result — it contains no age estimate and no liveness score.

The Processor does not require the Customer to send end-user names, emails, or other direct identifiers to complete a verification.

6. Biometric amnesia, structurally enforced privacy, and calibration carve-out

Biometric amnesia: the face image and features derived from it are processed transiently during a verification. They are never written to persistent storage and are discarded when the verification request completes.

Structurally enforced privacy: the Processor's persistent records for verification sessions, transactions, and related tenant operational data define no place to store a face image, a reusable biometric template, or other identifier-linkable biometric data. Changes that would add one are rejected.

Narrow operator-only calibration carve-out (disclosed so the commitments above are not read as "no data is retained"): when calibration monitoring is enabled, the Processor may retain per-verification pseudonymous numerical outputs relating to age estimation, liveness, decision confidence, and the configured age threshold for up to 30 days in an operator-only store within the European Union, for model calibration and drift detection under GDPR Art. 6(1)(f). Tenants cannot read that store. Raw images, embeddings, face hashes, and direct identifiers are excluded from the carve-out. After the 30-day retention period the records are deleted, and residual copies may remain in provider-managed recovery systems for up to approximately 14 further days. That residual window is disclosed rather than described as an immediate hard purge.

7. EU residency for verification processing

The Processor configures the biometric and verification workloads it controls, and the storage of the data they produce, to run within the European Union. Vendor support, security, and telemetry activities incidental to those services are governed by the applicable vendor terms referenced in section 8. Delivery of verification results to the Controller's own configured redirect or webhook endpoints is Controller-directed; the location of those endpoints is the Controller's choice and responsibility. The EU-only residency claim in this DPA is scoped to processing on AgeRail-controlled workloads.

Payment data and transactional email data are processed by the controller-side service providers disclosed in section 8 and on /subprocessors, under the transfer mechanisms summarised in section 9.

8. Sub-processors

The Controller authorises the Processor to engage Google Cloud as the only Article 28 sub-processor the Processor directly engages for Controller Personal Data under this DPA. Google Cloud provides the cloud infrastructure hosting the Processor's verification and core service workloads within the European Union. Google Cloud engages its own sub-processors, which it identifies in its published sub-processor register; that register is linked at /subprocessors. The Processor imposes data-protection obligations equivalent to this DPA on Google Cloud and remains fully liable to the Controller for Google Cloud's performance (Art. 28(4)).

Stripe (payments) and Postmark (transactional email) process payment data and email data as controller-side service providers of AgeRail for AgeRail's own commercial and operational purposes; they are not Article 28 sub-processors for Controller Personal Data under this DPA. Their data categories and transfer mechanisms are disclosed at /subprocessors for transparency. The full vendor list (Google Cloud, Stripe, and Postmark) is published there with role, data category, region, transfer mechanism, and classification for each.

The Processor will notify the Controller by email at least 30 days before adding or replacing a sub-processor that processes personal data under this DPA, using the contact email associated with the Customer's account. The Controller may object on reasonable data-protection grounds within that notice period. If the parties cannot resolve an objection, the Controller may terminate the affected Service as its sole remedy for the objection.

9. International transfers

Verification processing on AgeRail-controlled infrastructure is configured to occur within the European Union, so it involves no transfer of Controller Personal Data outside the EEA by the Processor. Delivery of verification results to the Controller's own configured redirect or webhook endpoints is Controller-directed; the location of those endpoints is the Controller's choice and responsibility.

Stripe processes payment data globally, including in the United States, under Stripe's Data Processing Agreement and transfer mechanisms (EU-US Data Privacy Framework certification and Standard Contractual Clauses where applicable).

Postmark processes transactional email data under Postmark's Data Processing Agreement and transfer mechanisms (EU-US Data Privacy Framework certification and Standard Contractual Clauses where applicable).

Details of role, data category, region, transfer mechanism, and classification for each vendor are published at /subprocessors.

10. Security

The Processor implements appropriate technical and organisational measures for the risk, including access controls on the principle of least privilege; encryption in transit; enforced location controls that stop verification services running outside their approved region; controls that prevent face images and derived biometric features from being written to persistent storage, enforced both in the structure of the Processor's records and by automated checks that block changes which would weaken them; and restricted operator-only access to any calibration record store.

The Processor ensures that any person it authorises to process Controller Personal Data commits to confidentiality (contractually or under statutory obligation) before being given access (Art. 28(3)(b)).

11. Assistance, rights requests, and audits

Taking into account the nature of processing, the Processor will assist the Controller with reasonable requests related to data-subject rights and with information reasonably needed for the Controller's data-protection impact assessments, where such assistance relates to personal data processed under this DPA.

The Processor will allow for and contribute to audits by the Controller (or an independent auditor mandated by the Controller) of the Processor's compliance with this DPA, limited to once per calendar year unless a personal-data breach or competent authority requires an additional audit. Audits are by written request with reasonable notice, during normal business hours, without disrupting Service operations, and subject to confidentiality. The Processor may satisfy an audit request by providing recent independent security reports, certifications, or written answers to a reasonable questionnaire where those materials address the request.

12. Personal-data breach notification

The Processor will notify the Controller without undue delay and, where feasible, within 72 hours after becoming aware of a personal-data breach affecting personal data processed under this DPA, providing information reasonably available at the time to help the Controller meet its own notification obligations. Further information will follow as it becomes available.

13. Return or deletion on termination

On termination or expiry of the Service, the Processor will, at the Controller's choice, return or delete the Controller Personal Data it processes under this DPA and delete existing copies from active systems, unless Union or Member State law requires the Processor to retain them (Art. 28(3)(g)). After that deletion, residual copies may remain in provider-managed database backups and, in production, point-in-time-recovery logs retained up to 7 days, for a bounded further period before they expire; during that residual window they remain subject to this DPA's confidentiality and security terms and are not used for any other purpose. The Controller makes that choice by written request to privacy@agerail.com within 30 days of termination; if the Controller makes no choice within that period, the Processor will delete. A return is provided as an export of the Customer's session and billing records.

The following applies to that process. (a) Processing under this DPA stops and the Customer's account is deactivated. (b) Session and transaction records hold pseudonymous flow and commercial metadata; where Spanish or EU accounting and tax law requires the Processor to retain them, they are retained for that period only, and the Processor deletes or anonymises the remainder from active systems (with the residual provider-managed backup window described above). (c) Copies the Processor must retain under applicable law remain subject to this DPA's confidentiality and security terms until deletion, and are not processed for any other purpose. (d) The operator-only calibration records described in section 6 are AgeRail-controller data outside this processor mandate; they expire automatically on their own 30-day schedule independently of termination, with the residual provider-managed recovery window disclosed in section 6, so no manual deletion step is required for that store.

14. Customer instructions

The Processor processes personal data under this DPA only on documented instructions from the Controller, including instructions given through the Service configuration and API, unless EU or Member State law requires otherwise. If an instruction appears to infringe GDPR or other applicable data-protection law, the Processor will inform the Controller.

15. Liability and order of precedence

Liability under this DPA follows the Terms of Service. If there is a conflict between this DPA and the Terms on a data-protection subject matter, this DPA controls for that subject matter.

16. Contact

Data-protection contact for this DPA: privacy@agerail.com.