Data Processing Agreement
How AdeptLink processes personal data on behalf of business customers as a data processor under GDPR and equivalent data protection laws.
1. Scope and parties
This Data Processing Agreement ("DPA") forms part of the AdeptLink Terms of Service between AdeptLink Solutions Inc. ("AdeptLink", "Processor", "we") and the business entity that has accepted the Terms of Service ("Controller", "you"). It applies where AdeptLink processes personal data on behalf of the Controller in the course of providing the licensed AdeptLink marketplace software and related services.
2. Definitions
"Personal data", "processing", "data subject", "controller", "processor", "supervisory authority" and "personal data breach" have the meanings given in applicable data protection law, including Regulation (EU) 2016/679 (GDPR) where applicable. "Services" means the AdeptLink marketplace software and related services as described in the Terms of Service.
3. Processing instructions
AdeptLink processes personal data only on documented instructions from the Controller, as set out in the Terms of Service, this DPA, and any additional instructions agreed in writing. AdeptLink informs the Controller if, in its opinion, an instruction infringes applicable data protection law. If required to process personal data by applicable law, AdeptLink notifies the Controller unless prohibited by law.
4. Purpose and categories of processing
AdeptLink processes personal data to provide the Services — including account management, quote and order workflows, business verification (KYC/KYB), customer support, fraud prevention, AI-assisted features and service improvement. Categories of personal data may include: contact information (name, email, company, phone), payment-related information where payments are enabled, identity and business documents (for verification), transaction records, and platform usage data.
5. Security measures
AdeptLink implements technical and organisational measures appropriate to the risk, including encryption in transit (HTTPS/TLS), role-based access control, an audit log of administrative actions, and restricted access to production systems and credentials. AdeptLink reviews these measures as the Services change. A current description of the measures is available on request.
6. Sub-processors
AdeptLink engages the sub-processors listed below. AdeptLink: (a) gives 30 days' advance notice of any new or replacement sub-processor; (b) imposes data protection obligations on sub-processors equivalent to those in this DPA; and (c) remains responsible for its sub-processors' performance of those obligations.
| Sub-processor | Purpose | Status |
|---|---|---|
| Replit | Application hosting and managed PostgreSQL database | Active |
| Brevo | Transactional email (account, order and notification emails) | Active |
| Upstash | Redis caching and rate limiting | Active |
| Google (Gemini API) | AI assistant, RFQ and marketing-content features | Active |
| OpenRouter, TokenRouter, OSCARouter | AI model routing for the same AI features (fallback providers) | Active |
| PayPal | Payment processing | Only when enabled for a marketplace deployment |
| Stripe | Payment processing | Only when enabled for a marketplace deployment |
7. Data subject rights
AdeptLink assists the Controller in responding to data subject requests — including rights of access, rectification, erasure, restriction, portability and objection — through appropriate technical and organisational measures, and notifies the Controller without undue delay upon receiving a request relating to the Controller's personal data.
8. International transfers
Personal data may be processed in the countries where AdeptLink and its sub-processors operate their infrastructure. Where personal data is transferred from the EEA or the UK to a country without an adequacy decision, AdeptLink relies on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses. Details of processing locations and transfer mechanisms are available on request at privacy@adeptlink.com.
9. Incident notification
AdeptLink notifies the Controller of a personal data breach without undue delay after becoming aware of it, and in time for the Controller to meet its obligations under GDPR Article 33 where applicable. The notification describes the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.
10. Deletion and return of data
Upon termination of the Terms of Service, AdeptLink, at the Controller's choice, deletes or returns the personal data processed under this DPA within 30 days of the request, unless applicable law requires longer retention. Written confirmation of deletion is provided on request.
11. Audit rights
AdeptLink makes available the information reasonably necessary to demonstrate compliance with this DPA and, on at least 30 days' written notice, cooperates with audits conducted by the Controller or an independent auditor mandated by the Controller, subject to reasonable confidentiality obligations. Audit costs are borne by the Controller.
12. Contact
For DPA enquiries, signed DPA requests and data protection questions, contact privacy@adeptlink.com. For security incident reports, contact security@adeptlink.com.
Data protection FAQ
- Does AdeptLink support GDPR obligations?
- Yes. This DPA sets out the contractual terms under which AdeptLink, as a data processor, handles personal data on behalf of business customers (controllers), including customers subject to the GDPR, the UK GDPR, Singapore's PDPA or Vietnam's personal data protection rules. Each customer remains responsible for its own compliance as controller.
- How do I get a signed copy of the DPA?
- Email privacy@adeptlink.com with the subject line 'DPA Request — [Company Name]'. Include your company legal name, registered address and the name and title of the signatory. The DPA is incorporated by reference into the AdeptLink Terms of Service.
- Who are AdeptLink's sub-processors?
- Replit (hosting and database), Brevo (transactional email), Upstash (caching) and AI model providers — Google (Gemini API), OpenRouter, TokenRouter and OSCARouter — for AI-assisted features. PayPal and Stripe process payments only where payments are enabled for a marketplace deployment. The full list with purposes is in section 6. AdeptLink gives 30 days' notice before adding or replacing a sub-processor.
- How long does AdeptLink retain personal data?
- For as long as needed to provide the Services and meet legal obligations (for example, statutory retention periods for financial records). Upon contract termination, AdeptLink deletes or returns personal data within 30 days of request, unless retention is required by law.
- What security measures does AdeptLink use to protect personal data?
- Encryption in transit (HTTPS/TLS), role-based access control for portal and admin functions, an admin activity log, and restricted access to production systems. A current description of technical and organisational measures is available on request at security@adeptlink.com. Personal data breaches are notified to controllers without undue delay and, where GDPR Article 33 applies, in time for the controller to meet its 72-hour deadline.