Data processing addendum

Where you use ProjectX to process personal data, you are the controller and ProjectX is the processor. This addendum governs that processing and forms part of the terms of service. Where ProjectX engages sub-processors, it stays responsible for their performance.

ProjectX processes your personal data only to provide the service and only on your documented instructions, which your configuration of the service expresses. It does not process it for its own purposes.

Processing is subject to the technical and organisational measures the trust page describes — one policy engine, one audit log, residency enforced in software, and encryption of data at rest and in transit. Access by ProjectX staff to your data is break-glass, approved and audited, and strict residency removes it entirely.

The regions your data may be placed in are the ones you choose. Where capacity is served by a contracted provider, that provider is a sub-processor for the data placed on it; the current list is available on request and changes are notified. Strict residency confines your data to one region, including from sub-processors outside it.

ProjectX assists you with data-subject requests, with security and with impact assessments, to the extent the service allows, and notifies you without undue delay of a personal-data breach affecting your data. On the end of the agreement it returns or deletes your personal data at your choice.