Data Processing Agreement

PIM-TNG provides a hosted product information management service, including product data, media, users, permissions, imports, exports, audit records and AI-assisted functionality.

Subject matter

Operating the PIM-TNG service on behalf of the customer.

Duration

For as long as the customer uses the service, plus any agreed retention period after termination.

Purpose

To store, manage, process, back up and export the information the customer puts into PIM-TNG.

Typical personal data includes:

• user names and email addresses
• roles and permissions
• login and session information
• API credentials and activity
• audit records
• support information relating to the tenant

The product catalog itself is normally product information. If the customer chooses to store information about identifiable people in it, that information is also covered by this DPA.

Data subjects may include the customer's employees, contractors and any other people whose information the customer chooses to store.

The customer decides what data is stored in PIM-TNG.

PIM-TNG OOD processes personal data only on the customer's documented instructions.

Those instructions include use of the service, this DPA, the customer's configuration and written requests made to us.

If we believe an instruction infringes applicable data protection law, we will inform the customer.

People authorized by PIM-TNG OOD to access customer data are subject to confidentiality obligations.

We maintain technical and organizational measures designed to protect customer data.

These include:

• encryption in transit and at rest
• customer-specific access controls
• private administrative access to infrastructure
• role-based permissions
• audit logging
• backups and recovery controls
• controls around secrets and credentials

Each customer has its own database, database role and application container.

Starter and Basic environments may share the underlying PostgreSQL server and object-storage infrastructure. Access is separated through customer-specific credentials and permissions.

Backup arrangements depend on the selected deployment. Additional requirements such as point-in-time recovery, longer retention or additional backup schedules can be configured where agreed with the customer.

The current technical and organizational measures are described in more detail on our Trust & Security page.

We may update these measures as the service evolves, provided the overall level of protection is not materially reduced.

Customers choose where their PIM-TNG environment is hosted.

Our standard European regions include:

• EU CentralGermany
• EU EastSofia, Bulgaria

Customers that require hosting in a particular country can agree a deployment with a suitable provider in that country.

Hosting, backup and recovery locations are documented for the customer's deployment.

We will not move the customer's hosted environment to another region without agreement with the customer.

PIM-TNG OOD may use subprocessors where necessary to provide the service.

Before a subprocessor is used to process customer personal data, PIM-TNG OOD will ensure that appropriate data-protection obligations are in place.

The customer gives PIM-TNG OOD general authorization to use subprocessors for the provision of the service.

We will maintain a current list of subprocessors and inform affected customers before adding or replacing a subprocessor, giving them an opportunity to object on reasonable data-protection grounds.

Customer data is hosted in the region selected for the deployment.

Where personal data is transferred outside the European Economic Area, PIM-TNG OOD will use an appropriate transfer mechanism where required by GDPR.

AI processing depends on the configuration selected by the customer. Where available, customers can choose regional processing, BYOK or locally hosted models.

The PIM-TNG agent does not receive privileged access to customer data.

It acts under the permissions of the signed-in user and is subject to the same access controls and product rules.

When a cloud model is used, the provider and processing location depend on the configuration selected by the customer.

Taking into account the nature of the processing, PIM-TNG OOD will reasonably assist the customer with:

• requests from data subjects
• security obligations
• personal-data breach obligations
• Data Protection Impact Assessments
• consultations with supervisory authorities where required

Tenant users exercising rights relating to data controlled by the customer should contact the customer.

We will assist the customer where our involvement is needed.

If we become aware of a personal-data breach affecting a customer's PIM-TNG environment, we will notify the customer without undue delay.

We will provide the information reasonably available to us, including the nature of the incident, its likely consequences and the measures taken or proposed in response.

Customers can export their data during the term of the service using PIM-TNG's normal export tools and can retrieve their original media.

No proprietary archive format is required to leave PIM-TNG.

When the service ends, the customer may request return or deletion of its personal data.

Unless earlier deletion is requested, tenant data is normally retained for up to one month after closure to allow recovery from an accidental cancellation and is then deleted.

Applicable copies and backups are also deleted in accordance with the agreed deletion and backup arrangements, unless applicable law requires us to retain them.

PIM-TNG OOD will make available the information reasonably necessary to demonstrate compliance with this DPA.

The customer, or an auditor acting on its behalf, may also audit our compliance with these obligations.

Audits will be coordinated with reasonable notice and in a way that protects the security and confidentiality of other customers.

Questions about this DPA or the processing of personal data can be sent to:

• Data protection[email protected]