PackagePass

Data Protection

Data Processing Addendum

This Data Processing Addendum applies when Sedrino Labs, Inc. processes personal data through PackagePass on behalf of a customer organization under the Terms of Service or an order form.

Effective date

May 5, 2026

Provider

Sedrino Labs, Inc.

Kentucky, United States

Data processing terms for customers that submit personal data to PackagePass as part of private package distribution workflows.

1. Scope and roles

This DPA forms part of the Terms of Service or other written agreement between Sedrino Labs, Inc. and the customer. The customer is the controller or business, and Sedrino Labs, Inc. is the processor or service provider, for customer personal data processed to provide the service.

For account administration, billing, security, marketing analytics, and business operations, Sedrino Labs, Inc. may act as an independent controller.

2. Processing instructions

Sedrino Labs, Inc. will process customer personal data only to provide, secure, support, and improve the service; comply with documented customer instructions; meet legal obligations; prevent abuse; and perform obligations under the agreement.

The agreement, dashboard settings, API requests, package publishing workflows, support requests, and this DPA are the customer's documented instructions.

3. Categories of data

  • Users and administrators: names, email addresses, authentication identifiers, organization membership, role, and activity metadata.
  • Registry subjects: customer, agent, group, service, package, grant, and token metadata that may include personal data if submitted by the customer.
  • Operational records: audit events, registry request metadata, support communications, diagnostics, and security logs.
  • Package content: any personal data the customer chooses to include in package metadata, package artifacts, generated code, or related files.

4. Security measures

  • Access controls for dashboard, API, registry, and administrative operations.
  • Hashed storage for PackagePass token values and authorization checks for registry metadata and tarball access.
  • Audit logging for key package, grant, token, billing, and administrative events.
  • Provider and infrastructure controls for hosting, authentication, billing, storage, monitoring, and incident response.

5. Subprocessors

Sedrino Labs, Inc. may use subprocessors to provide hosting, storage, authentication, billing, email, analytics, security, support, and infrastructure services. We remain responsible for subprocessors we engage to process customer personal data under this DPA.

We will provide reasonable notice of material subprocessor changes where required by applicable data protection law or a written agreement.

6. Assistance

Taking into account the nature of the service and information available to us, Sedrino Labs, Inc. will provide reasonable assistance for data subject requests, security obligations, data protection impact assessments, and regulator consultations where required by applicable law.

If we receive a request about customer-controlled personal data, we may direct the requester to the customer or ask the customer for instructions.

7. Security incidents

Sedrino Labs, Inc. will notify affected customers without undue delay after confirming a security incident involving customer personal data. Notice will include information reasonably available to help customers meet legal obligations.

Notice of a security incident is not an admission of fault or liability.

8. International transfers

Where applicable law requires a transfer mechanism for customer personal data, the parties will use an appropriate mechanism such as standard contractual clauses, a successor framework, or another lawful transfer basis.

9. Deletion and return

Upon termination or written request, Sedrino Labs, Inc. will delete or return customer personal data within a reasonable period, unless retention is required by law, security, backup, dispute, fraud prevention, or legitimate business continuity needs.

Package artifacts, audit logs, backup data, and billing records may follow different retention periods based on plan, infrastructure, and legal requirements.

10. Audits

Sedrino Labs, Inc. will make information reasonably necessary to demonstrate compliance with this DPA available to customers. Audits must be reasonable, limited in scope, protect other customers and confidential information, and avoid disrupting the service.

Contact

Questions, notices, privacy requests, and abuse reports can be sent to michael@sedrino.com.