Draft 0.2 · issued 19 August 2026 · not active

Data processing addendum

Pre-launch draft: this page is an informational draft, not an operative data processing agreement. It becomes binding only when an authorised customer and Blue Ridge Federal LLC accept an order or other written or electronic agreement that expressly incorporates this exact version. Customer-file processing remains disabled until the production provider register, retention schedule, transfer safeguards and security controls are confirmed.

This Data Processing Addendum describes how Blue Ridge Federal LLC, trading as PackDossier, intends to process personal data on behalf of a business customer. The operator address is 2504 Ditmars BLVD, New York City, New York 11105, United States. Service questions may be sent to support@blue-ridge-federal.com.

1. Parties, roles and priority

The customer is the controller of personal data it places in a PackDossier workspace. If the customer processes that data for another controller, the customer is a processor and PackDossier is its subprocessor. Blue Ridge Federal LLC is the processor or subprocessor only for that customer-controlled data. It remains a separate controller for its own account administration, billing, security, support and business-contact records, as explained in the Privacy notice.

This Addendum supplements the accepted order and the Terms of service. For customer-controlled personal data, this Addendum controls over inconsistent general terms. It does not change either party's controller obligations or any right that cannot lawfully be limited.

2. Processing details

Subject matter: operating a private packaging- evidence workspace and producing customer-directed evidence records, review materials, controlled links and exports.
Duration: the applicable order term, followed by a 30-day export and account-closure window, then the return and deletion process in section 10, unless law requires longer storage.
Nature and purpose: receiving, securing, converting, organising, indexing, displaying, reviewing, exporting and deleting customer-provided material on documented instructions. Automated extraction is not part of this draft launch unless it is separately activated and disclosed.
Data subjects: customer users, employees, contractors, supplier representatives, signatories, customer requesters and other business contacts whose information appears in submitted material.
Personal data: names, business contact details, roles, signatures, account identifiers, correspondence, document contents, filenames, source locations, review decisions, access records and security metadata.

The service is not designed for special-category data, criminal- offence data, children's data or unrelated personal data. The customer must minimise or redact such data before submission and must not instruct PackDossier to process data the agreed service is not authorised to handle.

3. Documented instructions

PackDossier will process customer-controlled personal data only on documented instructions contained in the order, this Addendum and authorised workspace actions, including instructions concerning transfers. PackDossier will inform the customer if it believes an instruction infringes applicable data-protection law. If law requires other processing, PackDossier will notify the customer before processing unless that law prohibits notice.

4. Confidentiality and access

People authorised to handle customer-controlled personal data will be limited to those who need access to provide, secure or support the service and will be bound by confidentiality obligations. PackDossier will not sell Customer Materials or use them for its own advertising. No general-purpose model-training right is granted by this Addendum.

5. Security measures

Once activated, PackDossier will maintain measures appropriate to the documented risks, including authenticated account ownership, scoped server-side access checks, private object storage, signed controlled links, transport encryption, file and upload limits, integrity checks, activity records, deletion queues and restricted operator access. The selected independent-backup schedule is a maximum of 30 days, but independent backups and recovery controls apply only after the production backup service is activated and tested.

The final technical and organisational measures will be attached to or incorporated into the operative DPA. This draft does not claim a completed security audit, a particular certification or an uninterrupted service level.

6. Subprocessors

An operative DPA may provide general written authorisation for the providers identified in the then-current service-provider and subprocessor register. PackDossier will not send production Customer Materials to a candidate provider merely because that provider appears in the pre-launch register. Each production provider must first be contracted for the intended role and subject to data-protection duties that are no less protective than the applicable obligations in this Addendum.

The operative version will state the notice period and process for material subprocessor changes and customer objections. If a reasonable objection cannot be resolved, the available remedy will be stated in the accepted order or operative DPA.

7. International transfers and data location

The selected Cloudflare configuration uses automatic, provider- managed placement for application database and object storage and is not restricted to an EU jurisdiction. PackDossier therefore does not promise EU-only data residency. Cloudflare edge delivery and other authorised providers may process data internationally. Where a transfer safeguard is legally required, the parties will use the applicable European Commission Standard Contractual Clauses, an adequacy mechanism or another valid safeguard, together with supplementary measures where required. The operative agreement and provider register must identify the applicable provider entity, role, location information and transfer mechanism before production customer-file processing begins.

8. Assistance and data-subject requests

Taking account of the nature of processing and information available to it, PackDossier will reasonably assist the customer with requests for access, correction, erasure, restriction, portability and objection, and with the customer's obligations concerning security, breach assessment, impact assessments and regulator consultation. PackDossier will not respond to a request about customer-controlled data as controller unless authorised or legally required to do so.

9. Personal-data incidents

PackDossier will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer- controlled data and will provide information reasonably available for the customer's assessment and legally required notices. No statement in this draft predetermines whether a particular event is legally notifiable.

10. Return and deletion

Incomplete uploads are queued for deletion within 24 hours of initiation.
Free-preview source files, rendered or raster previews and derived preview records are retained for no more than 30 days from upload unless deleted sooner or moved into an active service workspace.
During an active service, Customer Materials and derived evidence remain under the customer's workspace control and are retained only while needed to provide that service, subject to authorised deletion instructions and documented legal holds.
After termination, PackDossier makes available supported exports for 30 days. At the end of that window it starts the application-level purge of remaining Customer Materials and derived evidence.
Independent encrypted backup archives, once activated, expire within 30 days and are used only for recovery. Controlled evidence links and supplier-request channels retain their own expiry or revocation settings.

At the end of the service, PackDossier will, at the customer's choice, return available Customer Materials in supported export formats and delete or anonymise remaining customer-controlled data, unless applicable law requires storage. Billing, tax, contract, security, dispute and suppression records follow their applicable statutory or operational criteria rather than the Customer Materials schedule. The periods above are the selected production schedule; they do not become an operative promise until the purge, recovery and customer-acceptance controls are activated, tested and incorporated into an accepted DPA.

11. Information and audits

PackDossier will make available information reasonably necessary to demonstrate compliance with the operative Article 28 obligations and will permit legally required audits under procedures that protect other customers, security information and confidential systems. The operative agreement will define reasonable notice, scope, confidentiality and cost allocation without preventing a competent supervisory authority from exercising its powers.

12. No certification or legal determination

This Addendum governs data processing only. It is not a security, privacy, PPWR or product-compliance certification. PackDossier does not automatically certify packaging, perform a conformity assessment or make a legal determination for the customer. All dossier facts and declarations remain subject to authorised human review and the responsible economic operator's obligations.

13. Activation and contact

This draft cannot be accepted as a production DPA. The final version will identify its effective date, the accepted order, the activation status of the selected retention schedule, technical and organisational measures, authorised providers, transfer safeguards and the parties' execution method. Until then, the legal activation gate must keep commercial customer-file processing unavailable.

Questions about this draft may be sent to support@blue-ridge-federal.com.