1. Parties and Context

This Data Processing Agreement ("DPA") is entered into between Global Link Ventures LLC, a Wyoming limited liability company operating under the trade name Oracron, with registered address in the State of Wyoming, United States ("Processor"), and the legal entity identified in the signature block below ("Controller").

This DPA supplements the Oracron Terms of Service and governs the processing of personal data by the Processor on behalf of the Controller in connection with the Oracron platform — an AI-powered freight invoice audit and logistics management service.

2. Subject Matter and Nature of Processing

The Processor provides the following services involving personal data:

• Extraction of structured data from carrier invoice PDFs and CSV files using AI (Anthropic Claude API)
• Mapping and validation of freight charges against contracted rates
• Dispute letter generation addressed to freight carriers
• Storage and retrieval of invoice data, shipment records, and audit outputs
• Provision of analytics, reporting, and audit trails to the Controller

Personal data processed may include: names of senders/consignees, addresses (commercial and potentially residential), contact persons, driver or courier identifiers appearing on invoices, and user account credentials of the Controller's employees who access the platform.

3. Duration

This DPA is effective from the Controller's account creation date and remains in force for the duration of the service agreement. Upon termination, the Processor retains Customer Data for an export window of up to 90 days, after which it is permanently deleted from production systems; backup copies are purged within a further 30 days, unless longer retention is required by law.

4. Instructions and Purpose Limitation

The Processor processes personal data solely on the documented instructions of the Controller, for the purpose of providing the Oracron platform services. The Processor shall not process personal data for any other purpose, including but not limited to: training AI models, resale to third parties, advertising, or profiling unrelated to freight audit.

5. Confidentiality

The Processor ensures that persons authorised to process personal data are bound by confidentiality obligations. Access to personal data is restricted on a need-to-know basis, enforced by Row-Level Security (RLS) policies at the database level. Oracron employees and contractors are subject to confidentiality agreements.

6. Security Measures (Article 32 GDPR)

7. Sub-processors

The Controller grants general authorisation to use the sub-processors listed below. The Processor will notify the Controller at least 30 days before adding or replacing a sub-processor, as specified in the Terms of Service §7.7.

8. International Transfers

Invoice data and personal data are stored in the customer's selected region — the EU (eu-central-1, Frankfurt, Germany) or the US — chosen at onboarding. AI inference via Anthropic (Claude API) and OpenAI (Embeddings API) involves transfer to the United States; these transfers are governed by Standard Contractual Clauses (SCCs — EU Commission Decision 2021/914) and each provider's commercial DPA, supplemented by EU–US Data Privacy Framework certification where the provider is certified. Anthropic's and OpenAI's SOC 2 Type II certifications are available on request.

Transactional email via Resend and CDN services via Cloudflare involve US transfers governed by SCCs. No personal data is stored on CDN edge nodes.

9. Data Subject Rights

The Processor will assist the Controller in responding to data subject requests within the timeframes required by GDPR. Specifically:

• Access and export: The Controller can export all invoice data, shipment records, and AI audit logs via the platform interface or by contacting privacy@oracron.app. The Processor will fulfil export requests within 5 business days.
• Erasure: The Controller may request deletion of all personal data. The Processor will complete deletion within 30 days and confirm in writing. Backups are purged within a further 30 days.
• Correction and restriction: Supported via the platform interface or by written request to privacy@oracron.app.
• Portability: Data export in CSV format is available from the platform. JSON export available on request.

10. Breach Notification

In the event of a personal data breach (as defined in GDPR Article 4(12)), the Processor will notify the Controller without undue delay and no later than 72 hours after becoming aware of the breach, at the email address registered on the Controller's account. The notification will include, to the extent known: the nature of the breach, categories and approximate number of data subjects concerned, likely consequences, and measures taken or proposed.

The Processor maintains an incident response procedure. Security incidents should be reported to security@oracron.app.

11. Audit Rights

The Controller has the right to audit the Processor's compliance with this DPA upon 30 days' written notice. The Processor may satisfy audit requests by providing: (a) current third-party security certifications or audit reports (SOC 2, ISO 27001 when available); (b) answers to a reasonable security questionnaire; or (c) for Enterprise customers, on-site or virtual audit by the Controller's designated representative.

The Controller's AI audit log (Settings → Privacy) provides a per-call record of all AI processing performed on their behalf, exportable as CSV at any time without notice.

12. Deletion and Return of Data

Upon termination of the service agreement, the Processor will: (a) retain Customer Data for an export window of up to 90 days following termination, after which it is permanently deleted from production systems; (b) purge all backup copies within a further 30 days; (c) provide written confirmation of deletion upon request. The Controller may request a full data export at any time before or during the 90-day export window at no additional cost.

13. Governing Law and Jurisdiction

This DPA is governed by the laws of the State of Wyoming, United States; provided that, where the GDPR applies, its mandatory provisions and the data-protection law of the Controller's EU/EEA member state of establishment prevail to the extent of any conflict. Disputes shall be resolved in accordance with the jurisdiction clause in the Oracron Terms of Service. This DPA shall in all cases be interpreted consistently with the GDPR.

14. Order of Precedence

In the event of a conflict between this DPA and the Terms of Service, this DPA takes precedence with respect to data processing matters. The Standard Contractual Clauses, where applicable, take precedence over this DPA.

Annex I — Description of Processing Activities

Annex II — Technical and Organisational Measures

See Section 6 of this DPA. The complete security posture is published at oracron.app/security.html. The AI data governance policy is published at oracron.app/data-governance.html.

DPA v1.0 — Oracron — global link ventures LLC — privacy@oracron.app — oracron.app/dpa.html