1. Scope and roles
This Data Processing Agreement ("DPA") forms part of the Terms of Service between Vuong Tich (LineProTrack) ("Processor", "we") and the Customer ("Controller", "you"). It applies where we process personal data on your behalf in providing the service.
You are the controller of that personal data and are responsible for the lawfulness of the data you put into the service and of the instructions you give us. We are the processor and act only on your documented instructions.
Terms such as "personal data", "processing", "data subject", "controller" and "processor" have the meaning given in the GDPR (Regulation (EU) 2016/679), and equivalent meanings under other applicable data protection law.
2. Processing instructions
We process personal data only (a) as set out in Annex I, (b) as necessary to provide, secure and support the service, and (c) on your further documented instructions. Using the service constitutes an instruction to process personal data accordingly.
If we believe an instruction infringes applicable data protection law, we will inform you without undue delay. If we are required by law to process personal data other than on your instructions, we will inform you beforehand unless the law forbids it.
We do not use your personal data for our own purposes. Specifically, we do not use it to train machine learning models, to build profiles, or for marketing.
Records we keep to protect the service. Separately from processing on your behalf, we act as an independent controller for a small set of records used to protect the service: one-way hashes used to allow one free trial per business (they cannot be turned back into any data, are used only to prevent trial abuse and are deleted no later than 3 years after the trial ends), daily usage counters and protection signals (90 days), records of acceptance of our Terms and Privacy Policy, a signature in backup files and a hidden identifier of your organisation in exported reports. These records do not contain the content of your production data; they are described in our Privacy Policy.
3. Confidentiality
We ensure that persons authorised to process personal data are bound by confidentiality obligations, receive access strictly on a need-to-know basis, and have that access removed when it is no longer required.
4. Security measures
We implement appropriate technical and organisational measures under Article 32 GDPR, described in Annex II and in more detail on our Security page. We may update these measures over time provided the level of protection is not reduced.
5. Sub-processors
You give general authorisation for us to engage sub-processors. The current list is in Annex III. Each sub-processor is bound by data protection obligations no less protective than those in this DPA, and we remain fully liable for their performance.
We will give you at least 30 days notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, we will work with you to find a solution; if none is found, you may terminate the affected part of the service without penalty for the unused prepaid period.
Tenant production data is sent to an AI provider only when a user turns on “Data analysis” mode and consents in that sign-in session; even then only a summary of the calculated results of the screen being viewed (for the Planning Advisor: the results of the Coordination board the user is asking about; to understand a what-if request, the list of item codes, PO numbers, the working-day calendar and the factory’s adjustment limits are also sent, without production quantities; in this mode item codes and PO numbers in the question are not redacted) is sent, never the whole dataset, and its content is not stored on the LineProTrack server unless the user chooses to save it. When the mode is off (the default), only the text typed by the user after sensitive details have been redacted, together with relevant public handbook excerpts, is sent for an answer.
6. Assistance to the Customer
We will assist you, taking into account the nature of the processing:
- in responding to requests from data subjects exercising their rights — the service also lets you access, correct, export and delete data directly;
- in carrying out data protection impact assessments and prior consultations with supervisory authorities;
- in meeting your own security and breach notification obligations.
If a data subject contacts us directly about data we process on your behalf, we will refer them to you and will not respond substantively ourselves unless you instruct us to.
7. Personal data breach
We will notify you without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting your data. The notification will describe the nature of the breach, the categories and approximate number of records concerned, the likely consequences, and the measures taken or proposed. We will provide further information as the investigation progresses.
8. Return and deletion
On termination of the service, and at your choice, we will return your personal data in a commonly used format or delete it from our live systems within 30 days — unless applicable law requires us to keep it longer, in which case we will tell you what we must keep and for how long.
Backup copies are handled separately, and we describe them precisely rather than in general terms. Backups are stored as encrypted archives in which all customers' data is bundled together, so an individual customer's data cannot be extracted from an archive that already exists. Instead, archives expire on a rolling schedule: every archive containing your data is destroyed no later than 90 days after your deletion request. Until destroyed, those archives stay encrypted and are used for nothing but disaster recovery.
Defect photos that users upload to quality inspection records are processed on these same terms. A photo deleted by a user is erased from our live systems 30 days later, and all photos of an organisation are erased from our live systems when the organisation is deleted. Local backup copies of a photo are removed 30 days after the original is erased; encrypted off-site copies expire on the schedule above.
9. Audits
We will make available the information reasonably necessary to demonstrate compliance with this DPA, and will allow and contribute to audits conducted by you or an auditor you appoint, at your cost, no more than once per year (or after a personal data breach), subject to reasonable notice, confidentiality obligations, and minimum disruption to our operations. Where available, providing an independent audit report satisfies this obligation.
10. International transfers
Where we transfer personal data protected by the GDPR outside the EEA, the transfer is made under the European Commission's Standard Contractual Clauses, which are incorporated into this DPA by reference, with Annexes I, II and III below serving as the corresponding annexes to those clauses. Where other national transfer rules apply, we will implement an equivalent lawful transfer mechanism.
11. Liability and precedence
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. If there is a conflict, this DPA prevails over the Terms of Service in relation to the processing of personal data, and the Standard Contractual Clauses prevail over both.
Annex I — Details of processing
| Subject matter | Provision of the LineProTrack production scheduling service |
| Duration | The term of the subscription, plus the deletion period in clause 8 |
| Nature and purpose | Hosting, storage, computation of production schedules and delay forecasts, display to authorised users, generation of reports and exports (each exported file carries a hidden identifier of the organisation), signing and checking of backup files |
| Types of personal data | Business contact details of authorised users (name, work email, phone, role, employer); user identifiers and sign-in logs; any personal data the Controller includes in production records, such as names of planners, operators or supplier contacts |
| Categories of data subjects | The Controller's employees and contractors; employees of the Controller's suppliers and customers who are granted Viewer access |
| Special categories | None. The service is not designed for special category data and the Controller must not upload it |
| Frequency | Continuous, for the duration of the subscription |
Annex II — Technical and organisational measures
- Access control. Role-based authorisation enforced server-side on every request; four roles with least-privilege defaults; unique accounts per user.
- Authentication. Short-lived access tokens; refresh tokens in
httpOnlycookies; passwords hashed with scrypt and unique salts; constant-time comparison; rate limiting on sign-in. - Tenant isolation. The tenant identifier is derived exclusively from the server-signed token, never from client input; computation caches are request-scoped.
- Transmission security. HTTPS/TLS for the hosted service; HSTS enabled.
- Application hardening. Strict Content Security Policy with hash-pinned scripts; no inline event handlers; no third-party scripts or CDNs; input validation against path traversal and prototype pollution.
- Data minimisation in responses. API responses are filtered so that internal computation parameters are never returned.
- Availability. Automated daily backup of the hosted service, retained for 30 days, with an integrity check recorded for every copy and a written, tested restore procedure. Backups are encrypted and sealed with a key that is never kept on the host; the limitations are stated openly on our Security page.
- Organisational. Access limited to personnel who need it; confidentiality obligations for all personnel; changes reviewed before deployment.
- Protection of the service. The application is delivered only to signed-in users; daily usage limits and detection of automated use apply to calculation, preview and export functions; backup files are signed so that a modified file cannot be restored.
- Current limitations are stated openly on our Security page, including the absence of an independent penetration test and of a user-level audit log at the date of this document.
Annex III — Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Alibaba Cloud | Infrastructure hosting and storage | Singapore |
| Google (Gmail) | Transactional email delivery | Global — Google does not commit to a single region |
| Google (Drive) | Encrypted off-site backup storage | Global — Google does not commit to a single region |
| Google (Gemini API) | Purpose: answer questions about the LineProTrack handbook; analyse figures when a user turns on “Data analysis” mode. Data: the user’s typed text after redaction, up to the 3 most recent question-and-answer pairs of the open conversation (redacted and shortened) to understand follow-up questions — LineProTrack does not store this part, relevant public handbook excerpts and — only when the user turns on analysis mode and consents (consent recorded per account, versioned and withdrawable at any time) and the Customer’s administrator has not turned this feature off for the organisation — a summary of the calculated results of the screen being viewed (for the Planning Advisor: the results of the Coordination board the user is asking about; to understand a what-if request, the list of item codes, PO numbers, the working-day calendar and the factory’s adjustment limits are also sent, without production quantities; in this mode item codes and PO numbers in the question are not redacted); never the whole tenant dataset. Retention: up to 55 days for Google’s abuse monitoring. | Global — transient processing or caching may occur in countries where Google or its agents operate |
| Slack | Operational alerts to our staff; may contain administrator email addresses and IP addresses | United States |
| UptimeRobot | External availability monitoring; receives the public service URL and response metadata only, never customer data | United States |
LineProTrack's own assistant log is separate from Google's retention: it stores only the redacted question, answer and feedback for 90 days to improve the handbook, and is not used to train an AI model. LineProTrack also stores each user’s “Data analysis” consent record (account, consent text version, time of consent and withdrawal), without the content of any question; the Customer’s administrator turns this feature on or off for the whole organisation on the User management screen.
Questions about this document? Write to lineprotrack@gmail.com.