Data Processing Addendum

Roles and instructions

The customer is the controller and we are the processor for personal information processed in client review. We process that information only on the customer's documented instructions, which include the instructions given through the service, unless law requires otherwise.

We will tell the customer if, in our opinion, an instruction breaches applicable data-protection law.

Details of processing

Subject matter: providing the client review and approval service. Duration: for the term of the subscription plus the retention periods in the Privacy Policy. Nature and purpose: hosting, transmitting, displaying, scanning and recording review material and approval evidence.

Categories of data: identification and contact details, account credentials in hashed form, project and review content, attachments, approval records, and technical and security event data. Data subjects: agency personnel and the client reviewers the agency invites.

Confidentiality and security

Access is restricted to personnel who need it and who are bound by confidentiality. We maintain technical and organisational measures appropriate to the risk, including tenant isolation by row-level security, encryption in transit, encryption of stored origin credentials, hashed and revocable review tokens, attachment scanning and audit logging.

Subprocessors

The customer authorises the subprocessors listed in the Privacy Policy: Vercel for application hosting, content delivery and attachment storage, Neon for managed PostgreSQL hosting, Stripe for subscription billing and connected-account payments, Resend for transactional email delivery, GitHub for scheduled snapshot capture and attachment scanning, together with the managed database and object-storage providers described there.

We impose data-protection obligations on each subprocessor that are materially equivalent to those in this addendum, and we remain responsible for their performance. We will give notice before adding or replacing a subprocessor, and the customer may object on reasonable data-protection grounds.

Assistance and incidents

We will provide reasonable assistance with data-subject requests, privacy impact assessments and regulator enquiries, taking into account the nature of the processing and the information available to us.

We will notify the customer without undue delay after becoming aware of a personal data breach affecting their data, with the information needed for the customer to meet its own notification obligations.

Audits

On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will provide the information needed to demonstrate compliance with this addendum and will contribute to an audit conducted by the customer or an independent auditor subject to confidentiality.

Transfers

Where personal information is transferred outside its country of origin, the transfer is made under an approved mechanism such as standard contractual clauses, together with the measures described in the Privacy Policy.

Deletion and return

At the end of the service the customer may export its records during the read-only period. After that we delete or anonymise the personal information we process for the customer, except where retention is required by law.

Precedence

If this addendum conflicts with the Terms of Service on the processing of personal information, this addendum prevails.

Contact

Sam William Leverenz (ABN 19 624 756 890). The registered business address is available on request.

Privacy: privacy@approvela.com · Security: security@approvela.com · Support: support@approvela.com