Data Processing Addendum

The customer is controller and Tuturuuu is processor for personal data submitted to a workspace, except where each acts as an independent controller. Tuturuuu processes data only on documented instructions in the agreement, product configuration, support requests and lawful customer directions. Processing supports the service categories disclosed in the Privacy Policy for the agreement term and applicable retention period.

Personnel authorized to process personal data are bound by confidentiality. Tuturuuu maintains safeguards appropriate to risk, including access control, encryption, tenant isolation, monitoring, secure development, incident response, resilience and recovery measures. The customer remains responsible for lawful collection, notices, permissions, endpoint security and configuration.

The customer generally authorizes the subprocessors in the maintained registry. Tuturuuu will provide notice of material additions where contractually required and a reasonable objection process. International transfers use applicable legal mechanisms, including recognized contractual clauses and supplementary measures where required.

Tuturuuu will notify the customer without undue delay after confirming a personal data breach affecting customer data, consistent with legal and security constraints. Tuturuuu will reasonably assist with data-subject requests, impact assessments and regulatory consultation, taking account of processing nature and available information.

Upon reasonable request, Tuturuuu will provide information needed to demonstrate compliance. Audits must protect other customers, security and confidentiality and ordinarily begin with independent reports or written evidence. On termination, customer data is returned or deleted according to product export capabilities, backup rotation, legal retention and documented instructions.