Data Processing Agreement
Version 1.0 · Last updated: 29 September 2026
This Data Processing Agreement ("DPA") forms part of the Logispot Terms of Service (the "Terms") and applies whenever Logispot processes personal data on behalf of a customer. It is accepted by the customer when it creates an account or accepts the Terms. A countersigned copy is available on request at hello@logispot.io.
1. PARTIES AND ROLES
Processor: Ilya-Demidov-BG, a sole trader registered in Bulgaria, registered address Nezhnost 10, Varna, Bulgaria, operating the Logispot service at logispot.io and app.logispot.io ("Logispot", "we").
Controller: the legal entity that registered for the Logispot service and accepted the Terms ("Customer", "you").
For personal data the Customer uploads, forwards or connects to the service ("Customer Personal Data"), the Customer is the controller and Logispot is the processor under Regulation (EU) 2016/679 ("GDPR"). For account, billing and website data, Logispot acts as an independent controller as described in our Privacy Policy (logispot.io/privacy).
2. SUBJECT MATTER, DURATION, NATURE AND PURPOSE
Subject matter: provision of the Logispot AI assistant for freight forwarders: recognising and structuring quote requests (RFQs), parsing tariffs, calculating freight costs, storing quotes and statuses, and processing forwarded emails.
Duration: for the term of the Customer's subscription, plus the deletion period in Section 10.
Nature of processing: collection via email forwarding and uploads, storage, structuring, analysis by AI models, retrieval, display and deletion.
Purpose: solely to provide the service to the Customer in accordance with the Terms and the Customer's documented instructions.
3. CATEGORIES OF DATA AND DATA SUBJECTS
Data subjects: Customer's employees and users; Customer's clients, shippers, consignees, carriers, agents and other business contacts appearing in emails, requests and documents.
Personal data: names, job titles, company names, business email addresses, phone numbers, postal and business addresses, email content and signatures, and any other personal data contained in documents the Customer submits.
Special categories: none intended. The Customer shall not submit special categories of data (Art. 9 GDPR) to the service.
4. PROCESSOR OBLIGATIONS
Logispot shall:
(a) process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required otherwise by EU or Member State law, in which case Logispot will inform the Customer before processing unless the law prohibits it. The Terms, this DPA and the Customer's use of the service settings constitute the Customer's instructions;
(b) promptly inform the Customer if, in its opinion, an instruction infringes the GDPR or other data protection law;
(c) ensure that persons authorised to process Customer Personal Data are bound by confidentiality;
(d) implement the technical and organisational measures in Section 7;
(e) not use Customer Personal Data to train AI models, and not sell or share it for any purpose other than providing the service;
(f) assist the Customer, taking into account the nature of processing, in responding to data subject requests (Arts. 12–23 GDPR) and in meeting its obligations under Arts. 32–36 GDPR (security, breach notification, data protection impact assessments and prior consultation);
(g) make available all information necessary to demonstrate compliance with Art. 28 GDPR and allow for audits as described in Section 9.
5. SUB-PROCESSORS
The Customer grants a general authorisation for Logispot to engage sub-processors. The current list is set out below. Logispot will give at least 30 days' notice of any new or replaced sub-processor by email to the account owner and by updating this page. The Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the Customer may terminate the affected service and receive a pro-rata refund of prepaid fees.
Logispot imposes on each sub-processor data protection obligations no less protective than this DPA and remains liable to the Customer for its sub-processors' performance.
Current sub-processors:
Amazon Web Services EMEA SARL (AWS)
Purpose: cloud hosting, database and file storage (private cloud, encryption at rest and in transit)
Location: Frankfurt, Germany (EU)
Transfer safeguard: within the EU
OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.)
Purpose: AI processing of request text and documents via API to provide recognition, parsing and calculation features. API data is not used by OpenAI for model training.
Location: United States
Transfer safeguard: EU Standard Contractual Clauses and/or EU–US Data Privacy Framework
Google (Google Ireland Ltd / Google LLC)
Purpose: Gmail / Google Workspace mailbox connection — reading replies to the Customer's own requests, only where the Customer connects a mailbox hosted by this provider
Location: EU and United States
Transfer safeguard: EU–US Data Privacy Framework and EU Standard Contractual Clauses
Microsoft (Microsoft Ireland Operations Ltd)
Purpose: Outlook / Microsoft 365 mailbox connection — reading replies to the Customer's own requests, only where the Customer connects a mailbox hosted by this provider
Location: EU and United States
Transfer safeguard: EU Data Boundary where applicable; EU–US Data Privacy Framework and EU Standard Contractual Clauses
6. INTERNATIONAL TRANSFERS
Customer Personal Data is stored in the European Union (AWS Frankfurt). Where Customer Personal Data is transferred to or accessed from a country outside the EU/EEA that does not benefit from an adequacy decision, including remote support access by Logispot personnel located in Serbia, Logispot ensures an appropriate safeguard under Chapter V GDPR, in particular the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), or reliance on the EU–US Data Privacy Framework where the recipient is certified.
7. SECURITY MEASURES
Hosting: AWS private cloud in the Frankfurt region; network isolation from the public internet except for required endpoints.
Encryption: TLS for all data in transit (including to AI providers); encryption at rest on storage and databases.
Access control: role-based access, least privilege, individual accounts, strong authentication for administrative access; access to Customer data only where needed for support or operation.
Tenant separation: logical separation of each Customer's data.
Email intake: unique, unpredictable forwarding addresses per account.
Backups and resilience: regular backups with restricted access; ability to restore availability in a timely manner.
Monitoring: logging of access and system events; regular review of security measures.
Personnel: confidentiality obligations for all staff and contractors with access.
8. PERSONAL DATA BREACHES
Logispot shall notify the Customer without undue delay, and in any event within 48 hours after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Logispot will take reasonable steps to contain and remediate the breach.
9. AUDITS
Logispot will provide, on written request, information reasonably necessary to demonstrate compliance with this DPA, including completing reasonable security questionnaires. Where this is not sufficient, the Customer may conduct an audit (itself or via an independent auditor bound by confidentiality) no more than once per year, with at least 30 days' prior notice, during business hours and at the Customer's cost, unless a data protection authority requires otherwise or a personal data breach has occurred.
10. RETURN AND DELETION
On termination of the service, or on the Customer's earlier request, Logispot will delete Customer Personal Data within 30 days, unless retention is required by EU or Member State law. Before deletion, the Customer may export its data using the service's export functions or by request to hello@logispot.io. Backups are overwritten in the ordinary backup cycle, not exceeding 90 days.
11. CUSTOMER OBLIGATIONS
The Customer is responsible for having a lawful basis for the processing, for providing any required notices to data subjects, and for the lawfulness of its instructions and of the data it submits to the service.
12. LIABILITY, PRECEDENCE AND GOVERNING LAW
Each party's liability under this DPA is subject to the limitations in the Terms, except where such limitation is not permitted by law. In case of conflict between this DPA and the Terms regarding the processing of Customer Personal Data, this DPA prevails. Where Standard Contractual Clauses apply, they prevail over this DPA. This DPA is governed by the laws of Bulgaria.
13. CONTACT
Data protection questions, data subject requests and sub-processor objections: hello@logispot.io