Data processing addendum

Where you use the service to process personal data about other people — a client's details in a plan you are preparing for them, for instance — you are the controller and we are the processor. We process that data only on your documented instructions, which for most customers means: as necessary to provide the service.

For your own account data we are the controller, and the privacy policy governs it.

Everyone with access to customer data is bound by confidentiality obligations. Access is limited to the people who need it to operate or support the service.

Our current technical measures are described in full on the security page, including what is not yet in place. We will not list a control here that we have not implemented.

We use subprocessors to run the service, including the AI, payment, email and hosting providers named in the privacy policy. Each is bound by terms no less protective than these.

We will give notice before engaging a new subprocessor that processes plan content, and you may object on reasonable data-protection grounds.

Data is processed in the United States. For transfers out of the EEA, the UK or Switzerland we rely on the Standard Contractual Clauses and the UK addendum, which are incorporated here by reference and take precedence over anything in this document that conflicts with them.

We will help you respond to data subject requests and to regulators, to the extent you cannot do it yourself through the product's own export and deletion tools.

We will notify you without undue delay, and in any case within seventy-two hours of becoming aware, of a personal data breach affecting your data, with what we know at the time.

On termination we will delete customer data, subject to the backup cycle described in the privacy policy, or return it — though the export tools mean you can take it with you at any point without asking.

To have this countersigned, or to ask for our current subprocessor list, write to hello@getventurely.com.