Data Processing Addendum

Terms such as “personal data,” “processing,” “controller,” and “processor” carry the meanings given to them in applicable data-protection law. For the processing described here, the customer is the controller and Intuitum is the processor.

Intuitum processes personal data only to provide the Services, and only on the customer's documented instructions — including those set out in the agreement and this addendum — unless the law requires otherwise, in which case we will tell the customer before processing where we are permitted to.

The customer authorizes Intuitum to engage subprocessors to deliver the Services. Our current subprocessors are listed at intuitum.xyz/subprocessors; each is bound to obligations no less protective than these, and we remain responsible for their performance. We will update that list and give notice before adding or replacing a subprocessor so the customer has a chance to object.

Intuitum maintains technical and organizational measures appropriate to the risk — including encryption in transit and at rest, access control, and the principle of least privilege — and reviews them as the Services change.

Taking into account the nature of the processing, Intuitum will assist the customer in responding to requests from individuals exercising their rights, and will promptly forward any such request it receives directly rather than responding on the customer's behalf.

Intuitum will notify the customer without undue delay after becoming aware of a personal-data breach affecting the customer's data, and will provide the information reasonably needed for the customer to meet its own notification duties.

Where processing involves transferring personal data across borders, the parties rely on an appropriate transfer mechanism — such as the Standard Contractual Clauses — which is incorporated into this addendum by reference.

On termination of the Services, Intuitum will delete or return the customer's personal data as instructed, except to the extent the law requires us to retain it.

Intuitum will make available the information reasonably necessary to demonstrate compliance with this addendum, and will allow for and contribute to audits, subject to reasonable confidentiality and security conditions.