Data Processing Agreement

1. Roles of the Parties

You are the Controller of the personal data you upload to or generate within the Service. Fopsis is the Processor and processes that data only on your documented instructions, which are given through your use of the Service and this DPA.

Fopsis is a Controller in its own right for account and billing data (the name, email and company of the person who signs up, and payment records). That processing is described in our Privacy Policy and is outside the scope of this DPA.

2. Subject Matter, Duration, Nature & Purpose

Subject matter. Provision of demand forecasting and inventory planning software.

Duration. For as long as your subscription is active, plus the retention period in section 8.

Nature and purpose. Storing, organising, analysing and displaying your commercial records so the Service can produce forecasts, replenishment suggestions and reports.

3. Categories of Data Subject & Personal Data

Data subjects. Your personnel who hold Fopsis accounts, and any individuals identifiable from records you import from a connected platform (for example a named contact at a supplier).

Personal data processed.

• Account users: name, email address, company name, hashed password, role and permissions, login timestamps and IP address recorded for brute-force protection.
• Supplier records: where you enter them, contact name, email address, telephone number and address.
• Imported commercial records: order lines, quantities, prices and inventory levels from platforms you connect. These are ordinarily business records rather than personal data.

Special category data. The Service is not designed for and must not be used to process special category data as defined in Article 9 of the GDPR, nor data relating to criminal convictions.

4. Processor Obligations

Fopsis will: (a) process personal data only on your documented instructions, unless required otherwise by law, in which case we will inform you unless the law forbids it; (b) ensure that personnel authorised to process personal data are bound by confidentiality; (c) implement the technical and organisational measures set out in section 6; (d) assist you, so far as reasonably possible, with data subject requests and with your obligations under Articles 32 to 36 of the GDPR; and (e) make available the information reasonably necessary to demonstrate compliance with this DPA.

If we consider an instruction from you to infringe data protection law, we will tell you without undue delay.

5. Sub-processors

You give general authorisation for Fopsis to appoint sub-processors. We remain fully liable to you for their performance. Our current sub-processors are:

• Hostinger International Ltd — application, database and backup hosting, and sending our transactional email (United States).
• Stripe, Inc. — payment processing. Stripe is a separate Controller for cardholder data; Fopsis never receives or stores card numbers.

We will give at least 30 days' notice before adding or replacing a sub-processor. If you reasonably object on data protection grounds, you may terminate the affected part of the Service without penalty for the remainder of the paid term.

6. Security Measures

Fopsis maintains the following measures, which reflect what is actually implemented rather than what is aspirational:

• Encryption in transit. HTTPS is enforced site-wide with HTTP Strict Transport Security; plain HTTP requests are redirected.
• Authentication. Passwords are stored using a salted adaptive hash (never in plain text or a reversible form). Session identifiers are rotated on login. Session cookies are set HttpOnly, Secure and SameSite.
• Brute-force protection. Repeated failed sign-in attempts from the same address are throttled.
• Tenant isolation. Every database query is constrained to the requesting organisation, so one customer cannot read another customer's records.
• Injection defence. Database access uses parameterised statements exclusively; output is escaped before rendering.
• Request forgery defence. State-changing requests require a per-session token.
• Content Security Policy restricting script and connection origins.
• Backups. Daily database backups, checked for completeness when they are taken, kept for 14 days, plus weekly copies kept for 8 weeks. They are stored on our hosting provider’s infrastructure outside the website’s public folder and are readable only by our hosting account.
• Credentials of connected services (store and accounting connections) are stored encrypted.
• No secondary use. Personal data is never used to train a model for anyone else, never sent to a third-party AI service, and never used for advertising.
• Monitoring. Automated health checks every 15 minutes with email alerting on failure.
• Least privilege. Administrative credentials are held only by personnel who require them.

We may update these measures provided the level of protection is not reduced.

7. International Transfers

Customer data is hosted in the United States by our hosting provider. Where personal data of data subjects in the UK or EEA is processed outside the UK or EEA, the transfer is made under an adequacy decision or the applicable Standard Contractual Clauses, together with any supplementary measures required. For personal information communicated outside Québec, we carry out the privacy assessment Québec law requires.

8. Return & Deletion

The workspace owner may export your data at any time from the account, including after a plan has ended. If you close your account, it can be restored for 30 days, after which your Organization’s data is erased from live systems. If your plan ends without the account being closed, the data is kept for 12 months (with warnings 30 and 7 days before) and then erased.

Backup copies containing your data leave the backups on the ordinary rotation, at most 8 weeks after deletion from live systems. During that window backups are not used for any purpose other than disaster recovery.

9. Personal Data Breach

Fopsis will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting your data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected so far as known, the likely consequences, and the measures taken or proposed.

10. Audits

On reasonable written notice, and no more than once in any 12-month period unless required by a supervisory authority, Fopsis will respond to a reasonable security questionnaire and provide available documentation evidencing compliance with this DPA. On-site audits may be conducted where required by law, at your cost, subject to reasonable confidentiality and scheduling arrangements.

11. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, except where such limitation is not permitted by applicable data protection law.

12. Contact

Data protection enquiries and requests under this DPA should be sent to support@forecastproai.com marked “Data Protection”. To countersign an executed copy of this DPA, contact us at the same address.