Data Processing Addendum

For customer data submitted to the ERP workspace, the customer generally acts as the controller or equivalent business customer, and the operator acts as the processor or service provider for the hosted service. For account administration, billing, security logging, fraud prevention, and direct legal compliance data, the operator may act under its own independent legal obligations as described in the Privacy Policy.

We process customer data only to provide, secure, support, maintain, and improve the contracted service in line with documented customer instructions, the product configuration chosen by the customer, and mandatory legal obligations.

• The customer remains responsible for the lawfulness, accuracy, and permitted scope of the data uploaded to the service.
• The customer is responsible for user roles, workspace access control, notices to its own data subjects, and choosing lawful bases for its own processing and communications.
• If the customer asks for a workflow that requires additional consent, notices, or transfer steps, the customer must ensure those prerequisites are met.

Personnel acting on our behalf must be subject to confidentiality obligations. We apply role-based access controls, authentication safeguards, logging, and commercially reasonable technical and organizational measures appropriate to the service. Where we use subprocessors, they must be engaged for legitimate service purposes and bound to protect relevant data under appropriate contractual obligations.

Taking into account the nature of the processing and the information available to us, we provide reasonable assistance for privacy requests, security issues, and legally required notifications that relate to the hosted service. Upon termination or valid customer instruction, customer data should be returned, exported, deleted, or placed beyond active use according to the product capabilities, retention schedule, and overriding legal obligations.

If a transfer mechanism is required for a restricted cross-border transfer, it must be handled through the appropriate legal mechanism for that transfer. Reasonable compliance information may be provided upon legitimate request, subject to confidentiality, security, and scope limits. If a signed commercial agreement or statutory addendum imposes stricter data protection terms, that signed document controls over this public summary to the extent of the conflict.