Business data processing terms

We process customer personal data only to provide, secure, support, and improve the contracted service, on documented instructions, and subject to confidentiality obligations.

We maintain access control, encryption in transit and at rest, client-side memory encryption, tenant isolation, logging controls, dependency monitoring, backups, and incident response. We notify affected customers without undue delay after confirming a personal-data breach.

The published subprocessors list identifies current providers. We remain responsible for subprocessors under this addendum and use lawful transfer mechanisms where data crosses jurisdictional boundaries.

We assist with data-subject requests, impact assessments, and regulator inquiries appropriate to the service. On termination, customers can export hosted data and request deletion, subject to legal retention and backup expiry.