Data Processing Addendum

1. Roles

Customer is the data controller; Asetavo acts as data processor for personal data entered into the platform.

2. Scope & subject matter

This DPA covers personal data processed as part of delivering the Asetavo service.

3. Processing details

Nature, purpose, duration and categories of data are set out per the main services agreement.

4. Sub-processors

A current list of sub-processors (hosting, email delivery, analytics) is available on request.

5. Security measures

Encryption at rest and in transit, tenant isolation, RBAC and revocable tokens — see Security & Compliance.

6. International transfers

Standard Contractual Clauses apply where data crosses borders.

7. Data-subject requests

We assist customers in responding to data-subject access, correction and deletion requests.

8. Breach notification

We notify affected customers without undue delay upon confirming a data breach.

9. Audit rights

Customers may request audit information consistent with applicable law and reasonable notice.

10. Return / deletion

On termination, data can be exported and is deleted within a defined retention window.

11. Contact

legal@asetavo.com