Data Processing Addendum

1. Parties, roles and scope

The customer and provider are those identified in the accepted service agreement. “Customer Personal Data” means personal data submitted to or collected through the contracted Services for processing on your instructions. You act as controller or, where you are a processor for your own client, as the authorized processor instructing us as a subprocessor. Each party must comply with the data-protection law applicable to its role.

Our own account administration, billing, website inquiries and security processing performed as controller are described in the Privacy Policy, not reclassified as processor activity by this Addendum. This Addendum prevails for Customer Personal Data over conflicting general terms; mandatory transfer clauses prevail where required.

2. Processing description

The order and lawful configuration instructions narrow this description; they do not authorize unrelated uses. Before processing begins, the parties must identify the applicable modules, permitted data, locations, authorized providers and any additional security or transfer requirements. You must not submit a category excluded by the agreed scope.

3. Documented instructions and confidentiality

We will process Customer Personal Data only on your documented instructions, including for transfers, unless applicable law requires otherwise. Where lawful, we will tell you of such a legal requirement before processing. Where EU GDPR Article 28 applies, this exception is limited to Union or Member State law binding on us; the corresponding UK rule applies where UK GDPR governs. No exception overrides mandatory international-transfer restrictions. We will immediately inform you if we believe an instruction infringes applicable data-protection law and may pause the disputed processing while the issue is resolved.

You are responsible for the lawful basis, notices, permissions and authority needed to provide the data and instructions, including authority from your own controller where relevant. We do not assume your role in deciding the purposes of your customers’ processing.

We will limit access to authorized people who need it for the Services and who are bound by confidentiality obligations or an appropriate statutory duty. Those obligations continue after access or employment ends.

4. Security obligations

We will implement and maintain technical and organizational measures appropriate to the processing risk, considering the state of the art, implementation costs, nature of the data and potential harm. These obligations include access control and least privilege, secure credential handling, appropriate protection in transit and storage, separation of customer contexts, incident handling, and processes for maintaining and assessing security.

The measures must address confidentiality, integrity, availability and resilience; timely restoration where appropriate; and regular assessment of their effectiveness. The applicable service security schedule must identify any specific encryption, recovery, authentication, logging or testing commitments. We will not materially reduce agreed protection during the service term.

These are contractual duties when this Addendum is accepted, not a claim that a particular certification, audit, encryption implementation or recovery target has been independently verified. Public product descriptions do not replace the service-specific security schedule.

5. Authorization and changes

We may engage a subprocessor only under your specific authorization or the general written authorization given in the accepted service agreement. The applicable register must identify the provider, processing purpose and location. Website-only providers are not automatically authorized to receive Customer Personal Data.

Under a general authorization, we will notify you in advance of an intended addition or replacement, with sufficient information and time for a reasonable data-protection objection before the new processing begins. We will work in good faith to resolve an objection, including an alternative where reasonably available. If the issue cannot be resolved, the affected processing must not proceed without a lawful basis; either party may end the affected service, with appropriate treatment of unused prepaid fees.

We will impose written obligations on subprocessors that provide equivalent protection for the processing they perform, and remain responsible to you for their performance of those obligations. We will supply the information needed to assess authorization and protection, subject to lawful confidentiality safeguards.

6. Rights requests and compliance assistance

Considering the nature of processing, we will assist you through appropriate measures with requests for access, correction, deletion, restriction, portability, objection and other applicable individual rights. If we receive a request about data controlled by you, we will refer it to you where appropriate and will not independently decide your response unless law requires it.

We will provide reasonable assistance, taking account of the processing and information available to us, with security duties, impact assessments, required regulator consultations and breach obligations. We will not condition mandatory assistance on an unrelated purchase. Any charge for additional non-mandatory work must be agreed in advance.

7. Personal-data breaches

We will notify you without undue delay after becoming aware of a personal-data breach affecting Customer Personal Data. As available, the notice will describe the nature of the breach, affected data and individuals, likely consequences, mitigation and a contact for follow-up. We may provide information in phases as the investigation develops.

We will take appropriate containment and remediation measures and cooperate with your lawful notification duties. An initial report is not an admission of fault. This clause does not replace any direct legal duty we owe to individuals or authorities, and does not promise an unverified fixed response-time SLA.

8. International transfers

We will not make a restricted international transfer without the applicable lawful mechanism and supplementary safeguards where needed. If standard contractual clauses, a UK Addendum or an International Data Transfer Agreement are required, the correct instrument and processing, party and security details must be completed and made binding before the transfer.

This Addendum does not by itself execute those instruments, assert a privacy-framework certification or guarantee that all data stays in a particular region. The parties will cooperate on required transfer assessments and lawful responses to public-authority requests, including challenges where reasonably available and appropriate.

9. US service-provider and processor restrictions

Where applicable US law treats us as a service provider, contractor or processor, we will process personal data only for the limited, specified purposes of the agreement and lawful instructions. We will not sell or share it as those laws define those terms, retain or use it outside those purposes or the direct business relationship, or combine it with other data except as permitted by applicable law.

We will provide the protection required by applicable law, notify you if we can no longer meet those obligations, and permit reasonable steps to monitor compliance and stop or remediate unauthorized use. These commitments do not convert our distinct controller processing into processor processing.

10. Return, deletion, information and audits

At the end of the processing service, at your choice we will return Customer Personal Data and delete existing copies, or delete it, unless applicable law requires retention. Where EU GDPR Article 28 applies, that retention exception is limited to Union or Member State law; the corresponding UK rule applies where UK GDPR governs. We will provide a practical means and reasonable opportunity for return. Any necessary backup expiry and completion schedule must be documented for the service; a retained backup remains protected, isolated from ordinary use and subject to eventual deletion.

We will explain a lawful retention requirement where permitted, limit retained data to that purpose and provide confirmation of completed deletion on reasonable request. An account suspension does not itself authorize deletion or establish that deletion has occurred.

We will make available information reasonably necessary to demonstrate compliance and allow and contribute to audits, including inspections, by you or a suitably qualified auditor you appoint. Reasonable confidentiality, safety and scheduling procedures may protect other customers without preventing required verification or regulatory access. We will cooperate with competent supervisory authorities.

• Privacy Policy
• Providers and subprocessors
• Security information