Data Processing Agreement

1. Scope and roles

This Data Processing Agreement ("DPA") forms part of the Terms of Service between Vuong Tich (LineProTrack) ("Processor", "we") and the Customer ("Controller", "you"). It applies where we process personal data on your behalf in providing the service.

You are the controller of that personal data and are responsible for the lawfulness of the data you put into the service and of the instructions you give us. We are the processor and act only on your documented instructions.

Terms such as "personal data", "processing", "data subject", "controller" and "processor" have the meaning given in the GDPR (Regulation (EU) 2016/679), and equivalent meanings under other applicable data protection law.

2. Processing instructions

We process personal data only (a) as set out in Annex I, (b) as necessary to provide, secure and support the service, and (c) on your further documented instructions. Using the service constitutes an instruction to process personal data accordingly.

If we believe an instruction infringes applicable data protection law, we will inform you without undue delay. If we are required by law to process personal data other than on your instructions, we will inform you beforehand unless the law forbids it.

We do not use your personal data for our own purposes. Specifically, we do not use it to train machine learning models, to build profiles, or for marketing.

Records we keep to protect the service. Separately from processing on your behalf, we act as an independent controller for a small set of records used to protect the service: one-way hashes used to allow one free trial per business (they cannot be turned back into any data, are used only to prevent trial abuse and are deleted no later than 3 years after the trial ends), daily usage counters and protection signals (30 days), records of acceptance of our Terms and Privacy Policy and of the notices we send (kept for 3 years after your organisation is deleted), a signature in backup files and a hidden identifier of your organisation in exported reports. These records do not contain the content of your production data; they are described in our Privacy Policy. Backups are not such records: backup copies of your data are processing on your behalf and are governed by clause 8.

3. Confidentiality

We ensure that persons authorised to process personal data are bound by confidentiality obligations, receive access strictly on a need-to-know basis, and have that access removed when it is no longer required.

4. Security measures

We implement appropriate technical and organisational measures under Article 32 GDPR, described in Annex II and in more detail on our Security page. We may update these measures over time provided the level of protection is not reduced.

5. Sub-processors

You give general authorisation for us to engage sub-processors. The current list is in Annex III. Each sub-processor is bound by data protection obligations no less protective than those in this DPA, and we remain fully liable for their performance.

We will give you at least 30 days notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, we will work with you to find a solution; if none is found, you may terminate the affected part of the service without penalty for the unused prepaid period.

Tenant production data is sent to an AI provider only when a user turns on “Data analysis” mode and consents in that sign-in session; even then only a summary of the calculated results of the screen being viewed (for the Planning Advisor: the results of the Coordination board the user is asking about; to understand a what-if request, the list of item codes, PO numbers, the working-day calendar and the factory’s adjustment limits are also sent, without production quantities; in this mode item codes and PO numbers in the question are not redacted) is sent, never the whole dataset, and its content is not stored on the LineProTrack server unless the user chooses to save it. When the mode is off (the default), only the text typed by the user after sensitive details have been redacted, together with relevant public handbook excerpts, is sent for an answer.

6. Assistance to the Customer

We will assist you, taking into account the nature of the processing:

• in responding to requests from data subjects exercising their rights, in time for you to meet the deadlines of applicable law (in Việt Nam, Article 5 of Decree No. 356/2025/NĐ-CP) — the service also lets you access, correct, export and delete data directly;
• in carrying out data protection impact assessments and prior consultations with supervisory authorities;
• in meeting your own security and breach notification obligations, and in preparing your own impact assessments, including a cross-border transfer impact assessment where the law requires one — we tell you where data is stored and which sub-processors handle it (Annex III).

If a data subject contacts us directly about data we process on your behalf, we will refer them to you and will not respond substantively ourselves unless you instruct us to.

7. Personal data breach

We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data. The notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as the investigation progresses.

8. Return and deletion

When the service ends, your administrators can still view and download the data for 30 days; we then delete it from our live systems automatically, with an email 7 days before and another when deletion is complete. When you make a verified deletion request — by an administrator in the application, or by email from the address of an active administrator registered in the service — we delete your organisation and its data from our live systems 24 hours after confirming the request; the request can be cancelled during those 24 hours. If applicable law requires us to keep any data longer, we will tell you what we must keep and for how long. The evidence records described in clause 2 are kept for 3 years after deletion.

Backup copies. We describe them precisely rather than in general terms. Every day the system makes an encrypted backup of the whole service. Your organisation's production data and its history, defect photos and saved AI-assistant content are encrypted with a key that belongs to your organisation alone, and that key is not stored in the data backups: keys travel in a separate key bundle that is made every day and kept for no more than 7 days. When your organisation is deleted, its key is destroyed, so within 7 days your data becomes unreadable in every backup, including backups made earlier. Data backups themselves are kept for 30 days on the server and in the off-site store (in a separate region, with a lock that prevents anyone, including us, from deleting them early) and are then deleted automatically. Until a backup expires, it may still contain information that is not encrypted with your organisation's key — for example your organisation's name, user email addresses and anonymised activity-log entries. Backups are sealed with a public key whose private key is kept offline by the operator; they are never opened on the server and are used for nothing but disaster recovery.

Offline copy. To protect against ransomware, the operator also keeps an offline copy of the backups on a drive that is normally disconnected. It is updated whenever the drive is connected; at each update, key bundles older than 7 days and data backups older than 30 days are removed from it. In that copy, a deleted organisation's data therefore becomes unreadable at the first update made more than 7 days after the deletion.

Backups made before this version. Backups made before this version of the DPA took effect use an earlier format that contains the keys. They expire on their own no later than 30 days after this version takes effect, and the earlier off-site copies in Google Drive are deleted within the same period. Until then, the 7-day limit above does not apply to those earlier backups.

Defect photos that users upload to quality inspection records are processed on these same terms. A photo deleted by a user is erased from our live systems 30 days later, and all photos of an organisation are erased from our live systems when the organisation is deleted. Backup copies of an erased photo are gone no later than 30 days after it is erased, and because photos are encrypted with your organisation's key, they become unreadable in backups together with the rest of your data when the organisation is deleted.

9. Audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow and contribute to audits conducted by you or an auditor you appoint, at your cost, no more than once per year (or after a personal data breach), subject to reasonable notice, confidentiality obligations, and minimum disruption to our operations. Where available, providing an independent audit report satisfies this obligation.

10. International transfers

Where we transfer personal data protected by the GDPR outside the EEA, the transfer is made under the European Commission's Standard Contractual Clauses, which are incorporated into this DPA by reference, with Annexes I, II and III below serving as the corresponding annexes to those clauses. Where other national transfer rules apply, we will implement an equivalent lawful transfer mechanism.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If there is a conflict, this DPA prevails over the Terms of Service in relation to the processing of personal data, and the Standard Contractual Clauses prevail over both.

Annex I — Details of processing

Annex II — Technical and organisational measures

• Access control. Role-based authorisation enforced server-side on every request; four roles with least-privilege defaults; unique accounts per user.
• Authentication. Short-lived access tokens; refresh tokens in httpOnly cookies; passwords hashed with scrypt and unique salts; constant-time comparison; rate limiting on sign-in; two-factor sign-in (authenticator app), which an organisation can make mandatory for all its members.
• Tenant isolation. The tenant identifier is derived exclusively from the server-signed token, never from client input; the database itself refuses rows that belong to another organisation; computation caches are request-scoped.
• Transmission security. HTTPS/TLS for the hosted service; HSTS enabled.
• Application hardening. Strict Content Security Policy with hash-pinned scripts; no inline event handlers; no third-party scripts or CDNs; input validation against path traversal and prototype pollution.
• Data minimisation in responses. API responses are filtered so that internal computation parameters are never returned.
• Availability. Automated daily backup of the hosted service, kept for 30 days on the server and in an off-site store in a separate region protected by a deletion lock; organisation keys are kept in a separate key bundle retained for no more than 7 days; an integrity check is recorded for every copy, and the written restore procedure has been tested. The limitations are stated openly on our Security page.
• Encryption at rest. Each organisation's production data and its history, defect photos and saved AI-assistant content are encrypted with a key of its own (AES-256-GCM); organisation keys are themselves encrypted with a separate master key. Backups are sealed with a public key; the matching private key is kept offline by the operator and never on the server.
• Access restrictions and activity log. On Pro and above, access can be limited to the network addresses you list, and your administrators can export your organisation's activity log (sign-ins, role changes, invitations and security settings).
• Organisational. Access limited to personnel who need it; confidentiality obligations for all personnel; changes reviewed before deployment.
• Protection of the service. The application is delivered only to signed-in users; daily usage limits and detection of automated use apply to calculation, preview and export functions; backup files are signed so that a modified file cannot be restored.
• Current limitations are stated openly on our Security page, including the absence of an independent penetration test at the date of this document.

Annex III — Sub-processors

LineProTrack's own assistant log is separate from Google's retention: it stores only the redacted question (encrypted with your organisation's own key) and feedback for 30 days to improve the handbook, and is not used to train an AI model. LineProTrack also stores each user’s “Data analysis” consent record (account, consent text version, time of consent and withdrawal), without the content of any question; the Customer’s administrator turns this feature on or off for the whole organisation on the User management screen.

Questions about this document? Write to lineprotrack@gmail.com.