Data Processing Addendum
Effective August 2, 2026 · Forms part of the Terms of Service
This Addendum applies where Tandem processes personal information on behalf of a Customer in connection with the Service. Where it conflicts with the Terms, this Addendum controls for that subject matter.
1. Roles
Customer is the controller (or “business”) and determines the purposes and means of processing. Tandem is the processor (or “service provider”) and processes personal information only on Customer’s documented instructions — which include providing the Service under the Terms and Customer’s use of product features.
Tandem will not sell or share personal information, retain it outside the direct business relationship, or use it for any purpose other than providing the Service.
2. Scope of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of vendor and procurement management software |
| Duration | Term of the agreement, plus the retention period in Section 7 |
| Nature and purpose | Hosting, storage, organization, retrieval, document generation, AI-assisted analysis, email delivery |
| Types of personal information | Business contact details of Customer’s users and of vendor, broker, and carrier personnel; notes and correspondence Customer uploads |
| Categories of data subjects | Customer’s personnel; vendor, broker, and carrier representatives |
| Sensitive data | None. Customer must not submit protected health information or other sensitive categories. |
3. Confidentiality
Tandem limits access to personnel who need it to provide the Service and who are bound by confidentiality obligations.
4. Security
Tandem maintains technical and organizational measures appropriate to the risk, including: encryption in transit; verified database connections; logical isolation of each customer’s data with authorization checks on every request; hosted payment processing so card data never reaches our systems; rate limiting and abuse controls; restricted administrative access; and secret management outside source code.
5. Subprocessors
Customer authorizes the subprocessors listed in the Privacy Policy (currently Supabase, Vercel, Stripe, Anthropic, and Resend). Tandem imposes data protection obligations on each subprocessor no less protective than this Addendum and remains responsible for their performance. Tandem will give at least 30 days’ notice before adding or replacing a subprocessor; Customer may object on reasonable data-protection grounds, and if the parties cannot resolve the objection, Customer may terminate the affected Service without penalty for the remainder of the term.
6. Data subject requests and assistance
Taking into account the nature of processing, Tandem will assist Customer in responding to data subject requests and, where applicable, with data protection impact assessments and regulator consultations. Where Tandem receives a request directly, it will refer the individual to Customer unless legally required to respond.
7. Deletion and return
On termination, Customer may export Customer Data for 30 days. After that, Tandem will delete it within a commercially reasonable period, except where retention is required by law. Backups are deleted on their ordinary cycle.
8. Security incidents
Tandem will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data, and will provide information reasonably available to help Customer meet its own notification obligations.
9. Audits
On reasonable written request, no more than once per year (unless required by a regulator or following a breach), Tandem will provide information reasonably necessary to demonstrate compliance with this Addendum. On-site audits may be substituted with written responses or third-party reports where available.
10. International transfers
Customer Data is processed in the United States. Tandem does not currently transfer Customer Data outside the United States. [If you take EU/UK customers, this section needs Standard Contractual Clauses — raise it with your attorney.]
11. Liability
Each party’s liability under this Addendum is subject to the limitations in the Terms.
12. Contact
tandemprocurement@gmail.com