Data Processing Agreement: FreightParse Cloud Reading

Version 1.1, 9 October 2026

Parties

1. The Customer:
   • Legal name: ________________________________________
   • Legal form: ________________________________________
   • Registered in ____________________ under number ____________________
   • Address: ________________________________________
   • Represented by (name and function): ________________________________________
2. Danil Sysenko, sole proprietorship (eenmanszaak) trading as FreightParse (and as Sysenko), registered with the Netherlands Chamber of Commerce (KvK) under number 42184908, Mathenesserweg 122B01, Rotterdam, the Netherlands, danil@freightparse.com (FreightParse, we or us).

Background

A. FreightParse offers a cloud reading service (the Cloud Service). The Customer uploads, through the FreightParse web page, or sends by e-mail, supplier invoices, packing lists and transport documents. FreightParse returns the goods lines as an import file for the Customer's declaration software, with a list of the mandatory data it did not find and the values to check first. A person working for the Customer checks every value before filing.

B. These documents contain personal data, although only incidentally. For those data the Customer is the controller and FreightParse is its processor, within the meaning of the GDPR. Article 28(3) GDPR, and for a Customer subject to it article 28(3) UK GDPR, requires a contract between them, and this Agreement is that contract.

C. This Agreement consists of Part A (the statement on the processing), Part B (the clauses), Annex 1 (description of the processing and data flow), Annex 2 (sub-processors) and Annex 3 (technical and organisational measures). The Annexes form part of this Agreement.

Part A. Statement on the processing

A.1 General. FreightParse is a one-person business. Danil Sysenko carries out all processing and is the contact for data protection: danil@freightparse.com. FreightParse has not appointed a data protection officer, because the GDPR does not require one for this processing.

A.2 The service and its intended use. The Cloud Service is an aid for customs desks. It proposes values read from documents. It does not lodge declarations, does not decide classification, origin or value, and takes no decision about any person. Each document is read twice by the model, the second time as a check, and the values on which the two readings disagree are listed first for the Customer to check. If the service is unavailable, the Customer can key the data by hand or, if it has a licence, use the FreightParse local program, which runs on the Customer's own PC and sends nothing to us.

A.3 Personal data and data subjects. These are described in Annex 1. The service is not meant for special categories of personal data (clause B.4.2). We expect fewer than 100,000 data subjects per Customer per year: trade and transport documents name only a few persons each, mainly contact persons of the trading parties and carriers, and the same persons recur.

A.4 Sub-processors. These are listed in Annex 2.

A.5 Where the processing takes place.

• Our server: a virtual server rented from Contabo GmbH in Lauterbourg, France (EU).
• Google's Gemini model on Vertex AI: Google's EU multi-region, which, Google states, "strictly covers data residency within EU member states". If Google keeps a request that its automatic abuse checks flag, it keeps it in the same multi-region (clause B.11.3). Google's terms do not exclude other processing outside the EEA (clause B.8).
• E-mail route: the mailbox danil@freightparse.com on Google Workspace, in Google's data centres, which may be outside the EEA.
• Danil Sysenko's computer in the Netherlands, for documents received by e-mail and their results.

A.6 Security. The measures are listed in Annex 3. FreightParse has no certification and no formal information security management system. It applies the measures in Annex 3 and reviews them at least once every 12 months. For Google, its Cloud Data Processing Addendum describes the security certifications and reports it maintains, among them ISO 27001.

A.7 Retention and deletion.

• A document uploaded through the web page, and its result: we keep no copy after the response.
• A document received by e-mail, the copies on our computer and its result: we delete them within 30 days after we return the result, or earlier at the Customer's request.
• Google: if its automatic abuse checks flag a request, it may keep that request for up to 90 days, in the EU, to monitor abuse. Vertex AI's data cache is switched off for our project (clause B.11.3).
• Our logs: the service log holds one line per document, with the date and time, the status, the file size, the number of pages, the processing time and the access key used; never the content or the file name. These lines are kept in the server's system journal, which removes the oldest entries once it reaches its size limit; on 8 October 2026 it went back about 30 days. The web server's logs are kept for 14 days (Annex 3, point 1).

A.8 Data subjects' rights. We keep no copy of uploaded documents, and we delete e-mailed documents within 30 days, so we usually hold nothing to give to a data subject. We pass every request we receive to the Customer (clause B.10.1).

A.9 Personal data breaches. We notify the Customer without undue delay, and where possible within 48 hours (clause B.9).

Part B. Clauses

B.1 Definitions

Terms defined in the GDPR, such as personal data, processing, controller, processor, personal data breach, data subject and supervisory authority, have the meaning given there. In addition:

• GDPR: Regulation (EU) 2016/679.
• UK GDPR: the GDPR as it forms part of the law of the United Kingdom, read with the Data Protection Act 2018. For a Customer subject to the UK GDPR, the UK GDPR applies to the processing of its personal data that is subject to it. References in this Agreement to the GDPR and its articles then include the UK GDPR and its corresponding articles, and references to a supervisory authority include the UK Information Commissioner.
• EEA: the European Economic Area.
• Licence Terms: the FreightParse Licence Terms, version 2 (October 2026).
• Cloud Reading Addendum: the Cloud Reading Addendum to the Licence Terms, signed with this Agreement.
• Service Agreement: the Licence Terms as amended by the Cloud Reading Addendum, together with any Offer (as the Licence Terms define it) under which the Customer uses the Cloud Service.
• Customer Documents: the documents the Customer submits to be read by the Cloud Service, by upload or by e-mail.
• Customer Personal Data: the personal data in Customer Documents and in the results of reading them.
• In writing includes e-mail.

B.2 Scope and precedence

B.2.1 This Agreement applies to all processing of Customer Personal Data by FreightParse for the Cloud Service.

B.2.2 Some documents reach us under the Licence Terms, for example a document the Customer sends to investigate wrong output of the local program. Those documents stay under Annex 1 of the Licence Terms. We do not send them to Google, unless the Customer asks in writing for that document to be read by the Cloud Service. From then on this Agreement applies to it.

B.2.3 On the processing of personal data for the Cloud Service, this Agreement prevails over the Service Agreement and over the Licence Terms, including Annex 1 of the Licence Terms. In particular, for the Cloud Service, A1.5 (third bullet), A1.6, A1.9 and A1.11 of that Annex are replaced by clauses B.7, B.8 and B.11 and by Annex 2 of this Agreement.

B.2.4 If the Customer processes the documents as a processor for its own client, FreightParse is the Customer's sub-processor. The Customer then confirms that its client has authorised the use of FreightParse and of the sub-processors in Annex 2 (article 28(2) and (4) GDPR), and that the Customer's instructions to us match its client's instructions.

B.3 Instructions

B.3.1 We process Customer Personal Data only on the Customer's documented instructions, including with regard to transfers to a country outside the EEA. Two things count as such instructions:

• submitting a Customer Document to be read: an upload through the web page, after the Customer has agreed to the notice the page shows before each upload, or an e-mail by which the Customer sends a document for reading;
• this Agreement itself, which instructs us to use the sub-processors in Annex 2 in the way described there.

If the Customer's e-mail says that a document must not be read by the Cloud Service, we do not send it to Google, and clause B.2.2 applies to it.

B.3.2 If the law requires us to process Customer Personal Data in another way, we tell the Customer before we do so, unless the law forbids that.

B.3.3 We tell the Customer immediately if, in our opinion, an instruction infringes the GDPR or other data protection law.

B.3.4 We do not use Customer Personal Data for our own purposes. We do not use Customer Documents or results to train or improve any model, and we do not keep them to improve our software. We use Google's Gemini model through Vertex AI, a paid Google Cloud service, under whose terms Google does not use the data to train its models. Nor does Google train its models on a request that its automatic abuse checks flag and keep (clause B.11.3). If the Customer asks us in writing to find the cause of a wrong result, we use the document concerned for that purpose only, under clause B.2.2.

B.4 What the Customer submits and decides

B.4.1 The Customer is responsible for having a lawful basis to submit Customer Documents. It also decides whether cloud reading, including the transfers described in clause B.8, is suitable for a document. A document that must not leave the Customer's office is not submitted to the Cloud Service.

B.4.2 The Customer submits only what is needed to read the goods lines. It does not submit identity documents, citizen service numbers (BSN) or special categories of personal data, unless we have agreed to that in writing in advance. This is the same rule as clause 10.4 of the Licence Terms.

B.4.3 The Customer keeps its own copies of its documents and results. We keep no copy beyond the periods in clause B.11.

B.5 Confidentiality

Only Danil Sysenko processes Customer Personal Data. Anyone we later authorise to process it is first bound by a duty of confidentiality. We disclose Customer Personal Data to no one except the sub-processors in Annex 2, or where the law requires it, in which case clause B.3.2 applies.

B.6 Security

B.6.1 We take the technical and organisational measures described in Annex 3. They are appropriate under article 32 GDPR for this processing.

B.6.2 We review the measures at least once every 12 months, and whenever the processing changes. We may change them, provided that the level of protection does not go down. When we do, we update Annex 3 and tell the Customer of any material change.

B.7 Sub-processors

B.7.1 The Customer gives us general written authorisation to engage sub-processors, and specifically authorises those listed in Annex 2.

B.7.2 We tell the Customer in writing at least 30 days before we add or replace a sub-processor, so that the Customer can object. If the Customer objects on reasonable grounds, it may stop using the Cloud Service and end the Service Agreement for the Cloud Service with effect from the change. It may also ask us to delete what we hold for it. We then refund any fee paid in advance for the Cloud Service for the period after the change. Google and Contabo tell us of changes in their own sub-processors under their own terms. We pass each such notice on to the Customer as soon as we receive it, so for those changes the Customer may have less than 30 days. The Customer's right to object and to stop applies to those changes too.

B.7.3 We bind each sub-processor by contract to data protection obligations that meet article 28(3) GDPR. For Google and Contabo, these are their standard data processing terms named in Annex 2, which we cannot negotiate. Where those terms differ from this Agreement, for example in that audits of them take place through certifications and reports, the Customer accepts the sub-processor's terms for that sub-processor. Clause B.7.4 still applies.

B.7.4 We remain fully liable to the Customer for the performance of each sub-processor's obligations (article 28(4) GDPR), within the limits of clause B.13.

B.8 Transfers outside the EEA

B.8.1 The Customer instructs us to use Google's Gemini model on Vertex AI and Google Workspace as described in Annex 2. The Customer does so knowing three things. Vertex AI reads the document in Google's EU multi-region, and a request that Google's automatic abuse checks flag may be kept there for up to 90 days. Google's terms do not exclude other processing of the data outside the EEA by Google or its sub-processors. The mailbox on Google Workspace may be held in Google's data centres outside the EEA.

B.8.2 For Google's processing outside the EEA, we rely on the transfer terms in Google's own data processing terms: for Vertex AI and for Google Workspace, the transfer terms of Google's Cloud Data Processing Addendum. Which of those terms apply depends on the Google entity that contracts with us, as Google's terms set out. We make no transfer arrangements for Google beyond those terms. On request, we give the Customer a copy of those terms and name the Google entity that contracts with us.

B.8.3 We make no other transfer outside the EEA, except to return the result to a Customer established outside the EEA, which the Customer instructs by submitting the document. For a Customer in the United Kingdom, that return relies on the European Commission's adequacy decision for the United Kingdom, renewed on 19 December 2025. If no adequacy decision applies, the parties agree the standard contractual clauses adopted by the European Commission (module four, processor to controller) before we return the result. This is the same rule as A1.11 of the Licence Terms.

B.8.4 For a Customer subject to the UK GDPR:

• the UK GDPR applies to the processing of its personal data that is subject to it (clause B.1);
• its transfer of personal data to us in the EEA is covered by the United Kingdom's adequacy regulations for the EEA;
• the return of the result to it is covered by clause B.8.3;
• for Google's processing outside the United Kingdom and the EEA, we rely on the provisions for personal data subject to the UK GDPR in Google's Cloud Data Processing Addendum.

B.9 Personal data breaches

B.9.1 We notify the Customer without undue delay, and where possible within 48 hours, after we become aware of a personal data breach that affects Customer Personal Data. This includes a breach that a sub-processor reports to us.

B.9.2 The notice gives the following, as far as we have it:

• what happened and when;
• the nature of the breach;
• the categories and the approximate number of data subjects and records concerned;
• the likely consequences;
• the measures we have taken or propose;
• what the Customer or the data subjects can do themselves;
• our contact point.

We send what we know first and the rest as soon as we have it, and we keep the Customer informed.

B.9.3 The Customer decides whether to notify the supervisory authority and the data subjects, and we help it to do so. We do not notify them ourselves, unless the law requires us to.

B.9.4 We keep a record of every breach that affects Customer Personal Data, with the facts, the effects and the remedial action taken.

B.10 Assistance

B.10.1 We pass every request from a data subject to the Customer and do not answer it ourselves, unless the Customer instructs us to. We keep no copy of uploaded documents and delete e-mailed ones within 30 days (clause B.11), so we usually hold nothing to give.

B.10.2 Taking into account the nature of the processing and the information available to us, we help the Customer to meet its obligations under articles 32 to 36 GDPR. This includes a data protection impact assessment and any prior consultation with the supervisory authority. We provide the information in Part A and in Annexes 1 to 3, and answer reasonable questions about it, free of charge. Other help we give at a reasonable fee that we agree with the Customer in writing before we start. Help that is needed because we breached this Agreement is free of charge.

B.11 Deletion and return

B.11.1 Uploads. We keep no copy of a Customer Document uploaded through the web page, or of its result, after we send the response. Our software holds them in working memory while the request is handled and does not write them to a file. Our logs hold only the items listed in Part A.7.

B.11.2 E-mail. We delete a Customer Document received by e-mail, all copies of it on our computer, its result, and the e-mails that brought the document and returned the result, within 30 days after we return the result. We delete earlier if the Customer asks. We keep them longer only if the Customer asks us in writing to do so for a stated purpose, or if the law requires us to keep them. When we delete an e-mail, we also remove it from the mailbox's trash. Copies in Google's own systems, such as its backups, are then removed on Google's normal schedule under its terms.

B.11.3 Google. If Google's automatic abuse checks flag a request, Google may keep it for up to 90 days, in the EU, to monitor abuse, and then deletes it under its terms. Google has not granted us an exception from this abuse monitoring. Vertex AI's data cache, which by default holds a project's inputs and outputs in memory for up to 24 hours, is switched off for our project.

B.11.4 At the end. When this Agreement ends, we delete or return all remaining Customer Personal Data, at the Customer's choice, unless the law requires us to keep it. We then confirm the deletion in writing.

B.12 Information and audits

B.12.1 We make available to the Customer all information necessary to demonstrate compliance with article 28 GDPR and with this Agreement.

B.12.2 We allow for and contribute to audits, including inspections, by the Customer or by an auditor it mandates who is bound by confidentiality. An audit is announced at least 14 days in advance. It normally takes place no more than once a year, unless there has been a breach or a supervisory authority requires it. The Customer bears its cost. These are the same rules as A1.10 of the Licence Terms.

B.12.3 We cannot grant audit rights at the premises of Google or Contabo. For them, we pass on the certificates, reports and documentation they make available under their terms. For Google, these are the certifications, reports and security documentation described in its Cloud Data Processing Addendum. For Contabo, these are the documentation and information it makes available to its customers under its data processing terms.

B.13 Liability

B.13.1 Clause 9 of the Licence Terms applies to this Agreement as if it were set out here. Its limits apply to all claims under this Agreement, the Service Agreement and the Licence Terms together. This is the same rule as A1.13 of the Licence Terms.

B.13.2 Clause B.13.1 does not limit the rights of data subjects, or any liability that the GDPR or other mandatory law does not allow to be limited.

B.13.3 An administrative fine is borne by the party on which it is imposed.

B.13.4 The Customer indemnifies us against claims by third parties, including authorities, that arise from Customer Documents the Customer had no right to submit, or from an instruction that infringes the law, except to the extent that the claim results from our own breach of this Agreement or of the GDPR.

B.14 Duration and termination

B.14.1 This Agreement starts when both parties have accepted it in writing. It runs for as long as the Service Agreement, and after that for as long as we hold Customer Personal Data.

B.14.2 When the Service Agreement ends, this Agreement ends once clause B.11.4 has been carried out. Clauses B.9, B.11, B.12 and B.13 continue to apply as far as needed.

B.15 Changes

B.15.1 A change to this Agreement is valid only if both parties accept it in writing. We may update Annex 2 under clause B.7 and Annex 3 under clause B.6.2.

B.15.2 If a change in the law, or a decision of a supervisory authority or a court, requires a change to this Agreement, the parties cooperate in good faith to make it.

B.16 Law and disputes

Clause 17 of the Licence Terms applies to this Agreement: Dutch law, a written description of the dispute and 30 days to settle it, and the court in Rotterdam (Rechtbank Rotterdam). This does not affect the rights of data subjects, or the powers of a supervisory authority, under the GDPR or the UK GDPR.

B.17 Language

This Agreement is drawn up in English. If it is translated, the English version prevails.

Annex 1. Description of the processing

Data flow

Upload route
  Customer's PC: the FreightParse web page, opened with the Customer's own access link
    --HTTPS upload-->   FreightParse server (Contabo GmbH, Lauterbourg, France)
                        held in working memory; never written to a file by our software
    --HTTPS, two requests--> Google Vertex AI, EU multi-region (at present gemini-3.8-flash)
                        a reading, and a second reading as a check
                        read in Google's EU multi-region; the data cache is switched off
                        a request flagged by Google's abuse checks: may be kept up to 90 days, in the EU
    <--two answers--    FreightParse server: normalises and compares the two readings;
                        logs date and time, status, size, pages, processing time, access key
    <--HTTPS response-- Customer's PC: goods lines, import file, missing data, values to check first
  After the response, nothing of the document or the result is kept on the FreightParse server.

E-mail route
  Customer's mailbox
    --e-mail-->  docs@freightparse.com (Google Workspace, an address of the mailbox danil@freightparse.com)
    -->          FreightParse server (Contabo GmbH, Lauterbourg, France): the e-mail conveyor fetches the
                 message; its attachments are held in working memory only
                 transport documents (bill of lading, air waybill, CMR, transit document):
                   read on the server, not sent on
                 invoices and packing lists: read as in the upload route, with the Customer's access key
    -->          result files made in working memory; no person at FreightParse checks them first
    --e-mail-->  result back to the Customer, in the same thread
                 a document the service cannot read is held, and Danil Sysenko answers the Customer
  The attachments leave the server's memory as soon as they are read; the result files once the reply
  has gone. The e-mails are deleted from the mailbox within 30 days after the result is returned.

Annex 2. Sub-processors

Status on 9 October 2026.

The Cloud Service uses no other provider. The Customer needs no account with us: access is by an access key (Annex 3, point 3), so no sign-in provider holds data for the Cloud Service.

Annex 3. Technical and organisational measures

Status on 9 October 2026.

1. Data minimisation and storage

• No copy of an uploaded document or of its result is kept after the response.
• Our software holds the document in working memory and never writes it to a file, not even a temporary one: the check of the country of origin passes page images to the text-recognition program in memory. The web server streams the upload to the service without storing it on disk.
• The service runs with the server's whole file system read-only for it. Its temporary directories exist only in memory and are gone when the service stops.
• The server has a swap file on its own disk, to which the operating system may move working memory when memory runs short.
• Service log: one line per document, with the date and time, the status, the file size, the number of pages, the processing time and the access key used; never the content, the file name or the sender's address. It is kept in the server's system journal, which removes the oldest entries once it reaches its size limit (about 30 days on 8 October 2026).
• Web server: its log for the reading service records the time, status, request size and duration, without the sender's address. Its error log can record the address of a computer whose request failed, but nothing from the document. The web server's logs are kept for 14 days.
• E-mail route: documents, copies and results are deleted within 30 days after the result is returned (clause B.11.2).

2. Encryption

• In transit: HTTPS (TLS) between the Customer and our server, with plain HTTP redirected to HTTPS. HTTPS between our server and Google's API, and between our computer and our server.
• At rest: no Customer Documents are at rest on our server. Our computer: the drive is encrypted (Windows device encryption). Mailbox: Google encrypts Google Workspace data at rest, as described in its security documentation.
• Pseudonymisation: not possible, because the document must be read as it is.

3. Access control

• Only Danil Sysenko has access to the server, to the Google Cloud project through which the documents are read, to the mailbox and to the computer.
• Server: a firewall refuses all incoming connections except SSH (port 22), HTTP (port 80, redirected to HTTPS) and HTTPS (port 443). The server is administered only over SSH, with a key or a password, both held only by Danil Sysenko. The reading service accepts connections only from the server itself, behind the web server.
• The reading service runs as its own system user, created for it alone, without extra privileges, without access to the server's home directories, and with a memory limit of its own.
• Each Customer gets its own access key. The server stores only a hash (SHA-256) of the key, so the key cannot be read back from it. Each key has a daily page limit and an end date, and can be revoked at once, with effect from the next request. In the web page's link the key sits in the part after "#", which browsers do not send to any server, and the page keeps it in memory only. Requests are also limited per sending address (six documents a minute).
• The Cloud Service has no user accounts or passwords, so two-factor sign-in does not apply to it.
• Mailbox: Google Workspace with 2-Step Verification switched on. App passwords are created only for FreightParse's own mail scripts and are revoked when no longer needed.
• Key of the Google Cloud service account that calls Vertex AI: held only by Danil Sysenko. On the server it is stored in a file that only the administrator account and the reading service can read. It never appears in a web page, a link or a log.

4. Settings at the sub-processor

• Vertex AI is used as a paid Google Cloud service, in a Google Cloud project of FreightParse's own, at the endpoint of Google's EU multi-region (location "eu").
• Vertex AI's data cache, which by default holds a project's inputs and outputs in memory for up to 24 hours, is switched off for the project.
• Google's abuse monitoring applies: if its automatic checks flag a request, Google may keep it for up to 90 days, in the EU. Google has not granted FreightParse an exception from it.
• Requests go through Vertex AI's generateContent method. FreightParse does not switch on request and response logging and shares no dataset with Google.
• The document is sent inline in the request. No file upload, context caching, grounding or search tool is used.

5. Separation

• The server also runs other services of the same owner: trading and signal bots, chat bots, a database, an earlier document-reading app and websites. They do not receive Customer Documents.
• The reading service is kept apart from them as described in point 3: its own system user, the file system read-only for it, no access to home directories, and its own memory limit.

6. Availability and recovery

• There is nothing to back up for Customer Documents, because none are stored on the server.
• The service restarts by itself after a failure. If the server fails, the service is set up again from the code repository, on the same or a new server. There is no guaranteed restore time.
• Fallback: the Customer can key the data by hand or, if it has a licence, use the local program.

7. Organisation

• One person, no staff. Anyone added later is bound by confidentiality before getting access.
• Customer Documents and results are read only by the Cloud Service, by our own software on our computer and by Danil Sysenko. No other online service, such as an OCR, translation or AI assistant service, is used to open or read them.
• Breach procedure. On a suspected personal data breach, Danil Sysenko: (1) contains it, for example by revoking access keys, stopping the service or changing passwords; (2) establishes what happened, and which data and which Customers are affected; (3) notifies each affected Customer under clause B.9; (4) records the breach in the breach record (clause B.9.4), with the facts, the effects and the remedial action.
• These measures are reviewed at least once every 12 months, and whenever the processing changes.
• Updates: the server installs security updates automatically; our computer runs current Windows security updates.

Signatures

Signed by the parties on the dates below.