Data Processing Agreement

1. Parties

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Sarra Eleni (“Processor”, “we”, “us”) and the customer (“Controller”, “you”) using i-production.gr.

Controller: The production business or organisation that creates an i-production account and enters business data into the platform.

Processor: Sarra Eleni, registered in Greece (VAT: 159672047), operating i-production.gr.

2. Purpose and scope

We process personal data only to provide, secure and improve the i-production service (inventory, recipes, production, HACCP, labelling, billing and related features). We do not process your business data for any other purpose, including advertising, profiling or commercial analysis.

3. Types of personal data

We process the following categories on your behalf:

• Account data: names, email addresses, company names, hashed passwords
• Business data you enter: supplier contacts, customer contacts, team member names, production records, documents
• Billing data: subscription plan, billing country, VAT number (payment card data is handled by Lemon Squeezy)
• Usage data: login timestamps, pages visited, IP addresses

4. Subprocessors

We use the following subprocessors to deliver the service. All are bound by data processing agreements or equivalent contractual safeguards:

We will inform you of any material change to subprocessors at least 30 days in advance by email and by updating this page.

5. Security measures

We implement the following technical and organisational measures:

• TLS 1.3 encryption in transit
• AES-256 encryption at rest
• Row-level security isolating each tenant at the database level
• Role-based access control within tenant accounts
• Passwords hashed with bcrypt
• Automated backups with point-in-time recovery
• Restricted access to production systems for authorised personnel only

6. Your obligations

As Controller, you are responsible for ensuring you have a lawful basis to process the personal data you enter into i-production, including employee data, supplier contacts and customer contacts. You must also ensure data subjects are informed as required by Articles 13 and 14 GDPR.

7. Data subject rights

We assist you in responding to data subject requests through the in-app export and account deletion tools. For requests we cannot fulfil directly through the app, contact us at admin@logisticianhub.com and we will respond within 30 days.

8. Return and deletion of data

On account closure, we delete all business data within 30 days, except billing records retained for 7 years to comply with Greek tax law. You can export your data at any time from Settings → Privacy.

9. Contact

For DPA-related questions, email admin@logisticianhub.com.