Data Processing Agreement

For the personal data processed through the Druma TMS service on behalf of the Customer, the Customer is the data controller and Druma is the data processor as those terms are defined in Article 4 of the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

For data Druma collects in its own right (Customer account data, billing records, marketing prospects), Druma is an independent controller; that processing is governed by Druma's Privacy Notice, not by this DPA.

Druma processes personal data on the Customer's behalf solely for the purpose of providing the Service, which includes deriving Form Layout Data as described in section 4.1. This DPA takes effect on the Customer's subscription start date and remains in force for the duration of the subscription, plus the post-termination data export and purge periods set out in section 11.

Data subjects:

• The Customer's employees, contractors, and drivers.
• The Customer's clients and their contact persons.
• The Customer's subcontracted carriers and their staff.
• Other identifiable individuals whose data the Customer enters into the Service (consignees, dock contacts, etc.).

Categories of personal data:

• Identification data (names, employee IDs, role).
• Contact data (email, phone, language).
• Location data, in two distinct forms:
  • Live vehicle position from telematics — a single row per vehicle, overwritten on each update; a separate short-lived trail of recent positions (for the follow-a-truck view of the live map) is kept for 48 hours and then purged.
  • Driver-app position pings, and the coordinates recorded when a driver changes an order status (arrived, loaded, delivered) — retained 90 days, then deleted.
• Driver qualification and document data (licence, CPC, ADR and medical expiry dates, and the uploaded documents themselves) as recorded by the Customer.
• Derived data — the components and result of the driver performance score, which is profiling within the meaning of Article 4(4) GDPR but produces no legal or similarly significant effect and involves no automated decision-making under Article 22.
• Tachograph and driving-time data (remaining driving hours, working-state records sourced from telematics providers where connected; processed under EU Reg. 561/2006 and Reg. 165/2014 compliance obligations).
• Operational data (orders, status taps, waiting times, delays).
• Document content (CMR, POD, eCMR signatures, identity documents where required by compliance flows).
• Communication content (messages between planner and driver, AI assistant transcripts).

Druma does not knowingly process special-category data (Article 9 GDPR). The Customer must not upload health, biometric, religious, or other special-category data to the Service except where strictly required by an incident or insurance flow, in which case the Customer accepts the additional Article 9 obligations.

Druma processes Customer Data only on the Customer's documented instructions, including with respect to international transfers, unless required by EU or member-state law to do otherwise (in which case Druma will notify the Customer unless the law prohibits notification).

The Customer's documented instructions include: (a) these Terms and the DPA, (b) configuration choices made within the Service, and (c) any additional written instructions from the Customer that Druma confirms in writing.

Druma will inform the Customer if it considers that an instruction infringes GDPR or another data-protection law.

4.1 Form Layout Data.

(a) "Form Layout Data" means data that describes where the printed captions and boxes sit on a printed form type, such as a CMR consignment note, and nothing else. It consists only of: (i) coordinates and dimensions of captions and boxes, expressed relative to the frame of the printed form; (ii) identifiers of printed captions, taken from a closed list of printed-form caption phrases that Druma maintains (the "Caption List"); and (iii) counts and statistical measures, such as a median or a spread, computed over several documents.

(b) The Customer instructs Druma to analyse the Customer's documents inside the Service to derive Form Layout Data, and to use Form Layout Data to improve how the Service reads the same form types for all customers. This analysis is processing of Customer Data on the Customer's behalf and is subject to this DPA. The instruction applies for the duration of the subscription. It does not depend on a configuration choice, and the Service has no per-customer switch for it.

(c) Form Layout Data contains none of the following, and Druma does not derive it in a way that would make it contain them: text typed, written, stamped or printed into a filled-in document; a name, address, licence plate, reference, number, date or amount; a signature, a stamp or an image, or any part of one; an identifier of the Customer or of a user, client, carrier, driver, order or document of the Customer; an excerpt of a document. A word that is not on the Caption List is discarded when Form Layout Data is created and is never stored in it.

(d) Form Layout Data describes a printed form and not a person or a shipment. It is held without any identifier of the Customer, without any link to a document, and aggregated over several documents. Druma will not try to link Form Layout Data to a Customer, a document or an individual, and will not combine it with other data for that purpose. Druma treats Form Layout Data as anonymous data within the meaning of recital 26 GDPR. If Form Layout Data is found to relate to an identifiable individual, Druma will treat the affected Form Layout Data as Customer Data under this DPA from that moment and will tell the Customer without undue delay.

(e) The documents, the text read from them, the values extracted from them and any labels or corrections attached to them ("Reader Examples") stay within the Customer's company account. Druma does not use Reader Examples to read another customer's documents, does not disclose them to another customer, and shares nothing derived from them with another customer except Form Layout Data. Druma keeps Reader Examples for at most 12 months after the document was checked, and for 30 days where nobody labelled or corrected the read. Druma deletes them at once when the Customer deletes the underlying document or order, and when the Customer's company is deleted.

(f) Form Layout Data already derived is not Customer Data and cannot be attributed to the Customer. It is therefore not deleted or returned when Customer Data is deleted or returned under section 11. Druma may keep it after the subscription ends.

(g) As between the parties, Druma owns Form Layout Data and may use it for any lawful purpose of operating and improving the Service. This section 4.1 gives Druma no right in Customer Data other than the processing described in (b).

The Customer gives Druma general written authorisation to engage the sub-processors set out in Annex III to this DPA. Annex III is the complete and authoritative list — it is generated from the same source as the table in our Privacy Notice, so the two documents cannot state different things. There is no separate, shorter list anywhere.

Many of the entries in Annex III are marked "only if you connect it". Those recipients receive no data at all unless the Customer enables that specific integration — the telematics, reefer, e-invoicing, marketplace and messaging connectors are all in this group. A Customer that connects none of them shares data only with the core platform, email, routing, map-tile and AI recipients.

Druma will give the Customer at least 30 days' email notice of any new sub-processor before that sub-processor begins processing Customer Data. If the Customer reasonably objects to a new sub-processor on data-protection grounds, the Customer may terminate the affected portion of the Service on written notice.

Druma remains responsible for each sub-processor's compliance with this DPA and imposes data-protection obligations on each sub-processor that are no less protective than those in this DPA.

• Encryption — TLS 1.2+ in transit; encryption at rest (AES-256) by default through our infrastructure providers.
• Access control — row-level security on the tables that hold customer data; tenant isolation by company; least-privilege role-based access for staff.
• Authentication — JWT, HMAC, or service-role tokens on every server endpoint; optional two-factor authentication available to all users.
• Secret management — credentials stored in a managed vault, never in source control.
• Audit logging — automatic mutation log on sensitive tables, retained 12 months.
• Backup and recovery — daily automated backups by our database provider, retained 7 days. Documented recovery objectives: a recovery point objective of 24 hours and a recovery time objective of 8 working hours, set out with their assumptions and known gaps in our business continuity and disaster recovery plan, which we make available on request. These are operating targets, not a service-level guarantee.
• Vulnerability management — dependency upgrades, automated checks on every pull request (type check, tests, build, security lints, Semgrep static analysis and a dependency audit; changes are reviewed by the engineer who wrote them, with no independent second reviewer), error monitoring and alerting via Sentry, and a published vulnerability disclosure policy (security.txt, reports to security@druma.io) with stated acknowledgement and remediation timeframes.
• Personnel and confidentiality (Art. 28(3)(b)) — Druma ensures that every person authorised to process Customer Data, whether an employee, contractor or freelancer, has committed themselves to confidentiality or is under an appropriate statutory obligation of confidentiality. That commitment is contractual, binds each person individually, covers all Customer Data they may access, and survives the end of their engagement with Druma. Access is granted on a least-privilege, need-to-know basis and is revoked when the engagement ends or the need lapses. Every such person is also bound to process Customer Data only on Druma's documented instructions, which in turn follow the Customer's instructions under section 4.
• Sub-processor diligence — review of each sub-processor's security posture before onboarding, with reliance on their published certifications (SOC 2, ISO 27001, etc.) where available.

7.1 Data subject rights (Art. 28(3)(e)).

The Service includes built-in tools (Settings → GDPR) that the Customer can use to fulfil access, rectification, erasure, and portability requests without contacting us. For requests that cannot be fulfilled through these tools, Druma will assist the Customer by appropriate technical and organisational measures, insofar as this is possible, taking into account the nature of the processing and the information available to Druma. If a data subject contacts Druma directly about Customer Data, Druma will not respond substantively; it will forward the request to the Customer without undue delay and tell the data subject that it has done so.

7.2 Data protection impact assessments and prior consultation (Art. 28(3)(f), Art. 35 and Art. 36).

Taking into account the nature of the processing and the information available to Druma, Druma will assist the Customer in ensuring compliance with its obligations under Articles 32 to 36 GDPR. In particular, on the Customer's reasonable written request to privacy@druma.io, Druma will:

• Provide the information the Customer needs to carry out a data protection impact assessment under Article 35 — the description of the processing operations Druma performs, the categories of data and data subjects, the data flows and recipients (Annex III), the retention periods, and the technical and organisational measures in Annex II, in a form the Customer can incorporate into its own DPIA.
• Make available Druma's own DPIA covering GPS tracking, tachograph data and driver performance scoring, which the Customer may use as an input to its own assessment. It does not replace the Customer's assessment: the Customer is the controller and must assess its own operational context, works-council position and national employment-law requirements.
• Answer follow-up questions on risks and mitigations within a reasonable period, and flag to the Customer any change in the Service that Druma believes may materially affect an existing DPIA.
• Provide reasonable assistance to the Customer in any prior consultation with a supervisory authority under Article 36, including supplying documentation and responding to the authority's technical questions about Druma's role as processor.

Druma provides this assistance at no additional charge where the request is proportionate to the processing carried out for the Customer. Druma does not determine whether a DPIA is required — that assessment is the Customer's, as controller.

Druma will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe (so far as known): the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it.

The Customer is responsible for any onward notification to data subjects and supervisory authorities under Articles 33 and 34 GDPR.

Security incidents that do not involve personal data. Druma will also notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a security incident that materially affects the availability or integrity of the Service or of Customer Data, even where no personal data breach has occurred. The notice will describe what is known of the cause, the services and data affected, the expected duration or extent, and the steps being taken. This commitment exists because a Customer that is itself an essential or important entity may have its own regulatory notification clock running from the moment it becomes aware, and it cannot start that clock from information it does not have.

Druma makes available to the Customer all information necessary to demonstrate compliance with Article 28 GDPR, and allows for and contributes to audits, including inspections, conducted by the Customer or by an auditor mandated by the Customer. The rest of this section describes how that is done — it does not restrict the right itself.

9.1 Information Druma provides on request. On reasonable written request to privacy@druma.io, Druma will provide:

• A current copy of this DPA, the Privacy Notice, and the sub-processor list (Annex III).
• A description of the technical and organisational measures in force (Annex II) in enough detail to demonstrate compliance with Article 32.
• A completed security questionnaire, using the Customer's own template where one is supplied and is of reasonable length.
• An architecture and data-flow walkthrough, including where Customer Data is stored, which sub-processors receive which categories of data, and the applicable transfer safeguards.
• Available certifications and attestation reports of sub-processors (SOC 2, ISO 27001 and equivalent) where Druma is permitted to share them, and Druma's own records of the sub-processor diligence in Annex II.
• Druma's most recent penetration-test or security-review summary, where one exists.

9.2 Remote audit is the default — because that is where the evidence is. Druma does not own or operate any data centre. The Service runs entirely on managed cloud infrastructure operated by the sub-processors in Annex III, and Druma's staff work from ordinary office and remote workplaces with no Customer Data held on local premises. Audits are therefore conducted remotely by default: questionnaires and evidence packs, screen-shared reviews of live configuration (access control, RLS policies, encryption, logging, retention jobs), architecture walkthroughs, and sub-processor certifications and attestations. A physical inspection of a sub-processor's data centre is governed by that sub-processor's own audit programme; Druma will forward and support such a request and will pass on any report it is entitled to share.

9.3 On-site inspection of Druma's own premises and systems. The Customer, or an independent auditor mandated by the Customer who is not a competitor of Druma, may inspect Druma's own premises, equipment, records and systems. Such an inspection takes place on 30 days' prior written notice, during normal business hours, subject to the auditor signing a reasonable confidentiality undertaking and to proportionate measures protecting other customers' data, Druma's security and any third-party confidentiality obligation. Druma will make competent personnel available for the inspection and will respond to findings in writing. The notice period and the frequency limit in 9.4 do not apply, and Druma will cooperate promptly and without additional conditions, where an inspection or the production of information is required by a competent supervisory authority, or where it follows a personal data breach affecting Customer Data.

9.4 Frequency. Other than in the cases described at the end of 9.3, audits and inspections are limited to once per calendar year, so that they remain proportionate to the processing.

9.5 Costs. Druma bears its own costs of responding to audit requests, including the information listed in 9.1 and the personnel time spent on a remote or on-site audit; Druma makes no charge for meeting its Article 28(3)(h) obligation. The Customer bears the fees of any third-party auditor it mandates and its own costs of attendance. Where the Customer requests audits beyond the frequency in 9.4 for reasons other than those in 9.3, the parties will agree in advance a reasonable charge for Druma's additional time.

10.1 The Customer-to-Druma leg needs no transfer safeguard. Druma is established in Romania and its central administration is in Romania. Customer Data is hosted in the European Union by default. A transfer from the Customer (controller) to Druma (processor) is therefore an intra-EEA transfer and does not engage Chapter V. No Standard Contractual Clauses are required, or entered into, for that leg — and this DPA does not purport to make the Customer a party to any SCCs.

10.2 Druma is the exporter for the onward leg. Where a sub-processor in Annex III is established outside the EEA, or processes Customer Data outside the EEA, the transfer is made by Druma as data exporter to that sub-processor as data importer. Where Druma itself transfers Customer Data to a recipient outside the EEA, the transfer is covered by the mechanism stated for that sub-processor in Annex III: an adequacy decision, the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) where the recipient is certified, or the European Commission's 2021 Standard Contractual Clauses (Implementing Decision (EU) 2021/914) under the recipient's own data processing terms. Druma does not state that it has separately executed Module Three SCCs with every recipient. Google Cloud: Druma's sub-processor is Google Cloud EMEA Limited, which is established in the EEA. Onward transfers by Google, for example access by Google LLC in the United States, are Google's own: Google relies on the EU-US Data Privacy Framework (Google LLC is certified) for the United States, and on Standard Contractual Clauses between Google and its own subprocessors for other third countries (Google Cloud Data Processing Addendum, Appendix 3, section 4.1). Google's subprocessors are listed at cloud.google.com/terms/subprocessors.

10.3 Assessment of transfers. Before relying on a non-EEA recipient, Druma reviews the categories of data it receives and the recipient's published transfer terms (its data processing agreement, the Standard Contractual Clauses it offers, and any adequacy or Data Privacy Framework status), and applies the supplementary measures described in this DPA — encryption in transit and at rest, and minimisation of what is sent to each recipient. Druma has not prepared a separate written transfer impact assessment for each recipient; the Customer, as controller, remains responsible for its own transfer assessment, and Druma will provide the information it holds on request. Druma reviews this again when a recipient's circumstances or the legal environment materially change.

10.4 Copies. Copies of the Standard Contractual Clauses and recipient data processing terms Druma relies on (with commercial terms redacted) are available to the Customer on request to privacy@druma.io. The Customer, as controller, may rely on them as evidence of the safeguards applying to the onward transfers of its data.

10.5 Recipients outside the EEA. The following recipients in Annex III receive, or may receive, personal data outside the EEA. The safeguard for each is stated alongside it:

• Supabase (Supabase, Inc.) (may leave the EEA) — Data is stored in the EU. The vendor is US-established, so remote support access is covered by the 2021 SCCs in the Supabase DPA.
• Cloudflare, Inc. (leaves the EEA) — 2021 SCCs in the Cloudflare DPA; EU-US Data Privacy Framework where applicable.
• Sentry (Functional Software, Inc.) (may leave the EEA) — Data is stored in the Sentry EU region. The vendor is US-established, so support access is covered by the 2021 SCCs in the Sentry DPA.
• Resend, Inc. (leaves the EEA) — 2021 SCCs in the Resend DPA. Migration to an EU-resident email provider is on the roadmap.
• Google Cloud — Vertex AI, Google Search grounding (company and site enrichment only) (may leave the EEA) — Google’s terms exclude Google Search grounding from the EU data-location commitment, so the search query derived from the identifiers above, and the grounded request, may be processed outside the EEA. Google retains grounding queries for up to 3 days for debugging; this cannot be disabled. Transfer safeguards: Google Cloud EMEA Limited is in the EEA; for onward transfers Google relies on the EU-US Data Privacy Framework (Google LLC is certified) for the US and on Standard Contractual Clauses between Google and its own subprocessors for other third countries (Google Cloud DPA, Appendix 3, section 4.1). This is not a new sub-processor (Google already) but a disclosure refinement for this one feature.
• Anthropic PBC (leaves the EEA) — Transfer to the United States under the 2021 EU Standard Contractual Clauses (Module Two, controller to processor, and Module Three, processor to processor) incorporated in Anthropic’s Data Processing Addendum, which forms part of its commercial terms, with a UK Addendum and a Swiss Addendum (Irish law and courts). Anthropic notifies changes to its own sub-processors in advance, with a 15-day objection window; customer data is deleted within 30 days after termination. Under Anthropic’s commercial terms, API inputs and outputs are not used to train its models; retention is as stated in those terms. Druma prefers Google Gemini on the EU endpoint where EU-only processing is required: the fallback for the documentation chatbot is Gemini.
• Mistral AI SAS (may leave the EEA) — Mistral AI SAS is established in France. Under its API terms customer data is not used to train its models; the API keeps requests for a short period for abuse monitoring unless zero data retention is agreed for the account. Because the processing location of every request and the sub-processors of Mistral are not yet confirmed in writing, Druma lists the transfer as possible and relies on the 2021 EU Standard Contractual Clauses (Module Three, processor to processor) for any onward transfer outside the EEA.
• Google Cloud Translation API (leaves the EEA) — Google Cloud Translation (Basic) has a global endpoint, so data cannot be kept in a specific region. Google Cloud EMEA Limited is in the EEA; for onward transfers Google relies on the EU-US Data Privacy Framework (Google LLC is certified) for the US and on Standard Contractual Clauses between Google and its own subprocessors for other third countries (Google Cloud DPA, Appendix 3, section 4.1). Message auto-translation can be switched off per user in profile settings.
• Google LLC — Firebase Cloud Messaging (leaves the EEA) — EU-US Data Privacy Framework (Google LLC is certified).
• Meta Platforms (WhatsApp Business Cloud API) (leaves the EEA) — 2021 SCCs. Off unless the company enables the WhatsApp driver channel.
• Transporeon GmbH (Germany, Trimble group) (may leave the EEA) — Processing is in the EU; the parent group is US-established, so group-level access is covered by the 2021 SCCs in the Transporeon DPA.
• Dr. Meier & Schmidt GmbH, Cargoclix (Germany) (may leave the EEA) — The hosting location and any transfer safeguard are confirmed with Cargoclix before a Customer connects.
• Geotab Inc. (may leave the EEA) — Druma connects to whichever Geotab database host the Customer’s own Geotab account resolves to. Where that host is outside the EEA the Customer’s own agreement with Geotab governs the transfer.
• Samsara Inc. (may leave the EEA) — Druma connects to Samsara’s EU shard by default. The vendor is US-established, so vendor-side access is covered by the 2021 SCCs in the Samsara DPA; a Customer that overrides the endpoint to a non-EU shard makes that transfer under its own agreement.
• ORBCOMM Inc. (leaves the EEA) — 2021 SCCs in the ORBCOMM agreement.
• Thermo King TracKing (Trane Technologies) (leaves the EEA) — 2021 SCCs in the Thermo King agreement.
• Carrier — Lynx Fleet (Carrier Global Corporation) (leaves the EEA) — 2021 SCCs in the Carrier agreement.
• CHEP (Brambles Limited) (may leave the EEA) — No personal data is transmitted. Where CHEP processing takes place outside the EEA it is covered by the Customer’s own CHEP account terms.

18 of the 35 recipients in Annex III fall into this group; the remainder process Customer Data exclusively within the EEA.

At the end of the provision of services relating to processing, Druma will, at the Customer's choice, either return all Customer Data to the Customer or delete it, and will delete existing copies — unless Union or Member State law to which Druma is subject requires continued storage. The choice is the Customer's; Druma does not decide it.

11.1 The default, if the Customer says nothing. Customer Data is retained for 90 days from the effective date of termination or suspension. Throughout that window the Customer can export a complete copy at any time from Settings → GDPR (machine-readable JSON and CSV plus the stored documents), and the account can be reactivated with its data intact. At the end of the 90 days Druma deletes Customer Data from its live systems. The same 90-day period is stated in section 13 of the Terms of Service and in the retention table of the Privacy Notice.

11.2 Return, or earlier deletion, on instruction. The Customer may instruct Druma in writing at any time — during the subscription or during the 90-day window — to return Customer Data, to delete it, or both. Druma will act on the instruction within 30 days of receiving it and will confirm completion in writing. Return is provided in the same machine-readable export format, by a secure transfer method agreed with the Customer.

11.3 Existing copies, including backups. Deletion extends to existing copies of Customer Data. Encrypted database backups and point-in-time-recovery snapshots held by our database provider are immutable and cannot be selectively edited without destroying their integrity as a recovery mechanism. Customer Data still present in a backup is therefore not individually erased at the moment of deletion from the live systems: it is overwritten as that backup ages out of the normal rotation, and in any event no later than 35 days after deletion from the live systems. During that period the backups remain encrypted at rest and access-controlled, and are used only for disaster recovery — never to restore, serve, or otherwise process data that has been deleted. Deletion also covers copies held by sub-processors, on the deletion timelines in their own agreements with Druma.

11.4 Where law requires Druma to keep the data. Druma retains, and does not delete, data whose storage is required by Union or Member State law to which Druma is subject: invoices and accounting records (10 years from issue date — Romanian Accounting Law 82/1991 Art. 25 and EU VAT Directive Art. 244); eCMR and eFTI consignment documents (7 years, covering the CMR Convention Art. 32 limitation period and the eFTI authority-access requirements of Regulation (EU) 2020/1056); and the audit log (12 months). Those records remain isolated and access-controlled, are processed for no purpose other than the legal obligation that requires them, and are deleted when the retention period expires.

11.5 Certification of deletion. On written request, Druma will confirm in writing that deletion has been completed, and will identify any category of data retained under 11.4 together with the legal basis and the date its retention period expires.

Druma has implemented readiness for the EU eFTI Regulation (EU) 2020/1056. From 9 July 2027, competent transport-enforcement authorities may access transport consignment data linked to an eFTI unique link (UIL) during roadside inspections. Where a transport order managed through the Service is linked to a UIL, the corresponding consignment data — cargo description, route, and consignment parties — may be accessed by authorised authorities via the eFTI platform.

This access is mandated by law (Art. 6(1)(c) GDPR). Druma logs each authority-access event in the eFTI operation log as required by the Regulation and makes those logs available to the Customer on request. The Customer, as operator-controller, is responsible for informing affected data subjects of this possibility in their Article 13 notice.

• Order of precedence — in case of conflict between this DPA and the Terms of Service, this DPA prevails for matters concerning personal data.
• Liability — claims between the parties under this DPA are subject to the liability cap in section 11 of the Terms of Service. That cap does not apply to liability for death or personal injury, to fraud, or to any liability that cannot be limited under applicable law — including liability to data subjects for damage caused by processing in breach of the GDPR under Article 82 GDPR. Nothing in this DPA or in the Terms restricts a data subject's rights or remedies against either party, or alters the allocation of responsibility between controller and processor under Articles 82(1) to 82(3) GDPR.
• Changes — Druma may update this DPA to reflect changes in law, sub-processors, or security measures, on 30 days' email notice.
• Version history — 2026-10-27: added section 4.1 (Form Layout Data). The Customer instructs Druma to derive anonymous form-layout data, which holds no document content, from its documents, and that data is used for all customers. Section 2 and Annex I now refer to it. No new sub-processor. 2026-10-25: Annex I no longer lists location data forwarded to ANAF; Druma does not transmit GPS positions to ANAF. The ANAF entry in Annex III is narrowed accordingly. No new sub-processor. 2026-10-05: clarification that supersedes the 2026-10-04 entry (which stated that personal data may leave the EEA for Vertex AI, and which Druma did not notify to Customers as a sub-processor change). The Google Cloud Vertex AI entry in Annex III now states that requests are processed on Google's EU multi-region endpoint, where, according to Google's terms, data is stored and ML processing runs in EU member states (Druma is configured to use the EU endpoint). Google affiliates, including Google LLC in the US, may in limited cases access data to maintain the service or resolve technical issues; for onward transfers Google relies on the EU-US Data Privacy Framework and on Standard Contractual Clauses with its own subprocessors (Google Cloud DPA, Appendix 3, section 4.1). It also discloses the one exception: Google Search grounding, used by the optional company and site enrichment features, which Google's terms exclude from the EU commitment (a grounded request may be processed outside the EU) and for which Google keeps queries for up to 3 days. Vertex AI was already a sub-processor and is not a new one; 5 October 2026 is the publication date of this version. 2026-10-04: superseded as described. 2026-08-19: previous version.
• Governing law — Romanian law; Bucharest courts.
• Contact — privacy@druma.io.
• Annexes — Annex I (parties and description of processing), Annex II (technical and organisational measures — section 6 above) and Annex III (sub-processors) form an integral part of this DPA and of the Standard Contractual Clauses referred to in section 10.

A. The parties

B. Description of the processing

Annex II (technical and organisational measures, including the measures relied on as supplementary measures for transfers) is section 6 of this DPA.

The complete list of sub-processors and other third-party recipients Druma engages, what each is used for, the personal data each actually receives, where it processes that data, and whether the data leaves the EEA. This table and the sub-processor table in the Privacy Notice are generated from one shared source, so they are always identical.

Entries marked "only if you connect it" receive no data unless the Customer enables that integration. Druma gives the Customer at least 30 days' email notice before a new sub-processor begins processing Customer Data, and the Customer may object as described in section 5.

The optional Druma AI feature is deliberately absent from this list. If a company administrator connects the company's own OpenAI, Anthropic or Google API key, the data sent through Druma AI is processed by that provider under the Customer's own agreement with them. That provider is a sub-processor of the Customer, not of Druma, and Druma gives no transfer safeguard for it.