This addendum applies when a customer organization uses SINAD WholesaleERP to process personal data under the customer's instructions and data protection law requires controller-processor terms.
Last updated
April 10, 2026
For customer data submitted to the ERP workspace, the customer generally acts as the controller or equivalent business customer, and the operator acts as the processor or service provider for the hosted service. For account administration, billing, security logging, fraud prevention, and direct legal compliance data, the operator may act under its own independent legal obligations as described in the Privacy Policy.
We process customer data only to provide, secure, support, maintain, and improve the contracted service in line with documented customer instructions, the product configuration chosen by the customer, and mandatory legal obligations.
Personnel acting on our behalf must be subject to confidentiality obligations. We apply role-based access controls, authentication safeguards, logging, and commercially reasonable technical and organizational measures appropriate to the service. Where we use subprocessors, they must be engaged for legitimate service purposes and bound to protect relevant data under appropriate contractual obligations.
Taking into account the nature of the processing and the information available to us, we provide reasonable assistance for privacy requests, security issues, and legally required notifications that relate to the hosted service. Upon termination or valid customer instruction, customer data should be returned, exported, deleted, or placed beyond active use according to the product capabilities, retention schedule, and overriding legal obligations.
If a transfer mechanism is required for a restricted cross-border transfer, it must be handled through the appropriate legal mechanism for that transfer. Reasonable compliance information may be provided upon legitimate request, subject to confidentiality, security, and scope limits. If a signed commercial agreement or statutory addendum imposes stricter data protection terms, that signed document controls over this public summary to the extent of the conflict.
