Data Processing Addendum

Roles

Where you use the service to process personal data of your own users (your 'Customer Data'), you are the data controller and [Company] is the data processor. This Addendum applies in addition to our Terms of Service and forms part of our agreement. A signed copy is available on request.

Order of precedence

If this Addendum conflicts with the Terms of Service on a data-protection matter, this Addendum prevails. Where the Standard Contractual Clauses apply, the SCCs prevail over both in the event of a conflict.

Scope and instructions

We process Customer Data only to provide the service and on your documented instructions (the agreement, the product configuration, and your use of the features). We'll tell you if an instruction appears to breach applicable data-protection law.

Confidentiality and security

Personnel with access to Customer Data are bound by confidentiality. We maintain the technical and organizational measures described at /security (encryption in transit and at rest, access controls, audit logging, backups).

Subprocessors

You authorize us to engage the subprocessors listed at /legal/subprocessors. We impose data-protection obligations on each, and we'll give notice before adding or replacing a subprocessor so you can object.

Data subject rights and assistance

We provide self-service tools (export, deletion) that help you meet data-subject requests, and we'll assist with requests we receive directly by referring them to you. We'll support your data-protection impact assessments and regulator consultations as required.

International transfers

Where Customer Data is transferred outside its region, the transfer relies on appropriate safeguards such as the Standard Contractual Clauses, as reflected in each subprocessor's terms.

Breach notification

We'll notify you without undue delay after becoming aware of a personal-data breach affecting Customer Data, with the information you need to meet your own notification duties.

Deletion and return

On termination, and on request, we delete or return Customer Data in accordance with our Privacy Policy and retention schedule, subject to legal retention obligations.

Audits

We'll make available the information needed to demonstrate compliance and allow for audits in line with the agreement, including reliance on our subprocessors' certifications and reports where available.

Annex 1 — Details of the processing

Subject matter & duration: processing of Customer Data for the term of the agreement and any wind-down/retention period.

Nature & purpose: hosting, storing, and processing Customer Data to provide the service's features at your instruction.

• Categories of data subjects: your users, team members, customers, and anyone whose data you choose to put into the service.
• Types of personal data: identifiers (name, email), account/profile data, organization membership, content you create, and usage/log data. You decide what to put in — don't load special-category data unless [Company] has agreed to it in writing.
• Frequency: continuous, for the duration of the agreement.

Annex 2 — Security measures (TOMs)

We maintain the technical and organizational measures appropriate to the risk, summarized here and at /security:

• Encryption of Customer Data in transit (TLS 1.3) and at rest (AES-256).
• Access controls: least-privilege, role-based access; authentication for personnel; no shared credentials.
• An append-only audit log of security-relevant events; tenant isolation between organizations.
• Resilience & backups with a tested restore process; the ability to restore availability after an incident.
• Pseudonymization / crypto-shredding so deleted data becomes unreadable, and a documented breach-response process.

Liability

Each party's liability under this Addendum is subject to the limitations and exclusions of liability in the Terms of Service.