Data Processing Agreement (DPA)
Version: 1.5 Effective date: 18 August 2026
This Data Processing Agreement ("DPA") forms part of the Terms of Service between the customer accepting it ("Customer", "you") and Silkway Tech LLC, a Wyoming limited liability company with a mailing address at 5830 E 2nd St, Ste 7000 #30294, Casper, WY 82609, USA ("Company", "we", "us"). It applies where the Company processes personal data on your behalf as a processor (or service provider) under the GDPR, UK GDPR, CCPA/CPRA, or similar data-protection laws ("Data Protection Laws").
1. Roles — read this first
Railbase is self-hosted software. The ordinary users, records, documents, files, and Product/Component business data in your Vault run on your own infrastructure and do not reach the Company in ordinary operation. Limited control-plane data does reach us for Account/team administration, registered-company verification, billing/tax, export-control assessment, Product and Component entitlement, owned-Product installation, deployment pairing, version/update and heartbeat functions; we process that data as an independent controller under the Privacy Policy, not as your processor under this DPA. If optional enhanced KYB/KYC is enabled, company, ownership, UBO/director/representative and identity evidence submitted through Sumsub's hosted workflow is also compliance/control-plane processing described in the Privacy Policy and is not Submitted Material under this DPA.
The Company acts in two distinct roles for the data it does receive:
- Independent controller — for Account, Product commerce, billing, tax, licensing, Product/Component distribution, activation/heartbeat, KYC, sanctions-screening and export-control assessment, agreement-acceptance, and website analytics data, the Company determines its own purposes (operating Product commerce and distribution, billing, and legal compliance) and processes that data as an independent controller under the Privacy Policy. This DPA does not cover that processing.
- Processor — where you choose to send the Company materials from your deployment or business that contain personal data — support bundles, logs, database exports, screenshots, documents, or custom-development specifications and related files ("Submitted Materials") — the Company processes that personal data only on your behalf, to provide support, debugging, security review, or contracted development services. This DPA governs that processing.
2. Customer instructions
The Company will process personal data in Submitted Materials only on your documented instructions — which consist of this DPA, the Terms of Service, and your support or development requests — unless required to do otherwise by law, in which case the Company will inform you unless the law prohibits it. You are responsible for ensuring that your instructions are lawful, that you have the right to share the Submitted Materials, and that they do not include personal data that is unnecessary for the request. Do not send special-category, regulated, or highly sensitive data unless strictly necessary and lawful.
3. Confidentiality
The Company ensures that persons authorized to process Submitted Materials are bound by contractual or statutory confidentiality obligations, and limits access to those who need it to handle your request.
4. Security
The Company implements appropriate technical and organizational measures for Submitted Materials, including HTTPS/TLS, access controls and restricted operator access, hashed credentials, CSRF protections and security headers, audit logging, key-based server access, encrypted backups, and AES-256-GCM envelope encryption for control-plane secrets and signing seeds at rest, with the master key held separately from encrypted database values. Details are summarized in Annex II.
5. Sub-processors
You give general authorization for the Company to use the sub-processors listed in Annex III (currently: hosting infrastructure and transactional email). The Company will impose data-protection obligations on sub-processors materially equivalent to this DPA and remains liable for their performance. The Company will give notice (for example, by updating Annex III on this page with a new effective date) before adding or replacing a sub-processor; if you reasonably object on data-protection grounds and no resolution is found, you may terminate the affected service as your exclusive remedy.
For clarity: Stripe processes payment data; Sumsub, when enhanced KYB/KYC is enabled, processes company and representative verification data; and IPinfo, when optional network export verification is enabled, processes the request IP to return location/privacy indicators. Those controller-purpose services operate under their applicable terms, outside the scope of Submitted Materials. They are therefore identified in the Privacy Policy rather than listed as sub-processors for the narrow Submitted-Materials service governed by this DPA.
6. International transfers
The Company is located in the United States, and Submitted Materials are processed in the U.S. and/or the EEA (see Annex III). Where Data Protection Laws require a transfer mechanism for EEA/UK personal data, the parties incorporate by reference the EU Standard Contractual Clauses (Module Two: controller-to-processor) and, for UK data, the UK International Data Transfer Addendum, with you as data exporter and the Company as data importer; Annexes I–III of this DPA serve as the corresponding SCC annexes. In case of conflict, the SCCs prevail over this DPA.
7. Assistance
Taking into account the nature of the processing, the Company will provide reasonable assistance with: responding to data-subject requests that reach the Company but concern your data (the Company will redirect the data subject to you where appropriate); your security, breach-notification, DPIA, and consultation obligations, insofar as they relate to Submitted Materials and the information is available to the Company.
8. Personal data breach
The Company will notify you without undue delay after becoming aware of a personal data breach affecting Submitted Materials, and will provide information reasonably available to it about the nature of the breach, the categories and approximate volume of data concerned, likely consequences, and measures taken or proposed.
9. Deletion and return
Submitted Materials are kept only as long as needed to handle the request they were sent for and normally no more than 24 months after case closure. On your written request, or at the latest upon termination of the affected services, the Company will delete or return the personal data in Submitted Materials unless law, security, a payment dispute, legal claim, or documented hold requires further storage. Encrypted backups are not edited record by record: the material disappears as the backup rotates, normally within 30 daily local snapshots and 90 days off site. A restored backup is reconciled against current deletion, closure, and revocation state before service access resumes.
10. Audit
The Company will make available information reasonably necessary to demonstrate compliance with this DPA — such as this DPA, Annex II, and written answers to reasonable security questionnaires (at most once per year, absent a supervisory-authority requirement or a breach). Where Data Protection Laws grant you a mandatory on-site audit right, it will be exercised on reasonable notice, at your cost, during business hours, without access to other customers' data.
11. CCPA/CPRA
To the extent Submitted Materials contain personal information subject to the CCPA/CPRA, the Company acts as your service provider: it will not sell or share that personal information, will not retain, use, or disclose it outside the direct business relationship or for purposes other than performing the services, and certifies it understands these restrictions.
12. Liability, term, and general
This DPA takes effect when you accept the Terms of Service (or first send Submitted Materials, if earlier) and lasts as long as the Company processes Submitted Materials on your behalf. Liability under this DPA is subject to the limitations of liability in the Terms of Service. This DPA is governed by the same law and venue as the Terms of Service, except where Data Protection Laws or the SCCs require otherwise. In case of conflict regarding processing of Submitted Materials, this DPA prevails over the Terms of Service.
Annex I — Description of processing
- Subject matter and duration — handling of Customer-submitted support, debugging, security-review, or custom-development materials for the request and normally up to 24 months after case closure, subject to Section 9.
- Nature and purpose — receipt, storage, inspection, and analysis of Submitted Materials to diagnose issues, provide support, review security, or deliver contracted development work.
- Categories of data subjects — the Customer's personnel, end users, tenants' personnel, and other individuals whose data appears in the Submitted Materials.
- Categories of personal data — determined by the Customer; typically identifiers (names, emails, usernames), business records, log and technical data (IP addresses, session identifiers), and file contents. Special-category data is not requested and should not be submitted unless strictly necessary and lawful.
- Frequency — occasional, initiated by the Customer.
Annex II — Technical and organizational measures
Encryption in transit (TLS; HTTPS-only service); access control with restricted, need-to-know operator access; key-based administrative server access; Argon2id password hashing; AES-256-GCM envelope encryption of stored secrets and signing seeds with a separately controlled master key; CSRF protection, security headers, inactivity expiry, and rate limiting; audit logging; signed release artifacts and licence keys; tested backup/restore procedures; bounded retention with deletion on request or service end subject to legal retention.
Annex III — Sub-processors
| Sub-processor | Role | Location |
|---|---|---|
| Hosting infrastructure provider (Contabo GmbH) | Hosting of railbase.app and its database, including stored Submitted Materials | Germany / EEA |
| Transactional email relay (SMTP provider then in use) | Delivery of support and service emails (message content and addresses) | U.S. / EEA |
Contact
Silkway Tech LLC — 5830 E 2nd St, Ste 7000 #30294, Casper, WY 82609, USA · support@railbase.app