# Data processing agreement

> The data processing agreement for BatteryPass: subject matter, subprocessors and technical measures.

The data processing agreement for BatteryPass: subject matter, subprocessors and technical measures.

Updated: 25 October 2026

Draft: this text is a template. The operator fills in the marked parts before the page is published.

## Subject matter and duration

_\[\[Subject matter, nature and purpose of the processing, duration]]_

## Data and data subjects

In BatteryPass we mainly process product data for customers. Personal data are the members' accounts (name, email address, role), what suppliers and service partners provide with their requests, and the log of who changed what and when.

_\[\[Complete list of data categories and data subjects]]_

## Subprocessors

_\[\[Hosting, file storage, email delivery with their seat and place of processing]]_

The AI assistant is off until the operator activates it and an owner allows it for the organisation. When it is on, conversations and the data read for them go to Anthropic.

_\[\[Details on Anthropic as a subprocessor, if the assistant is offered]]_

## Technical and organisational measures

- The passport's access tiers are enforced on the server; protected information is never in public responses.
- Roles separate editing, reviewing and administration; values are approved by a second person.
- Every change is recorded in the organisation's log.
- Passwords are stored with Argon2id, sessions live on the server, cookies only over HTTPS.
- Database and files are backed up; the restore has been rehearsed.
- The organisation's full export is available at any time.

_\[\[Further measures, result of the operator's review]]_