Data Processing Addendum

This Data Processing Addendum ("DPA") supplements the Terms of Service between you ("Customer", the controller) and Asetavo ("Processor"). Where there is a conflict on data-protection matters, this DPA prevails.

1. Roles

For personal data contained in Customer's workspace, the Customer is the controller (or itself a processor acting for its own customers) and Asetavo is the processor. Asetavo processes such personal data only on the Customer's documented instructions, including as set out in the Terms, this DPA and the Customer's use of the Service, unless required to do otherwise by law (in which case we will inform you, unless prohibited).

2. Scope & subject matter

This DPA applies to the processing of personal data that Asetavo carries out on the Customer's behalf to provide the Service. The subject matter is the provision of asset tracking, tagging, audit, maintenance and reporting functionality, and the duration is the term of the agreement plus any post-termination export period.

3. Processing details

Nature and purpose: hosting, storing, transmitting and securing Customer Data to deliver the Service. Categories of data subjects: the Customer's staff, contractors and other individuals whose details the Customer chooses to record (e.g. asset custodians, users). Categories of personal data: names, work contact details, role, workspace user IDs and activity, and any personal data the Customer includes in asset records. The Customer must not submit special-category data unless expressly agreed.

4. Sub-processors

The Customer authorizes Asetavo to engage sub-processors (e.g. cloud hosting, email delivery, analytics and payment processing) to support the Service. We impose data-protection obligations on each sub-processor no less protective than this DPA and remain responsible for their performance. A current list is available at privacy@asetavo.com; we will give notice of intended changes and a reasonable opportunity to object on legitimate data-protection grounds.

5. Security measures

Asetavo maintains appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest, tenant isolation, role-based access control, revocable credentials, signed device/reader ingest, network hardening, logging and access review. Details are summarized on our Security & Compliance page. Personnel authorized to process personal data are bound by confidentiality.

6. International transfers

Where personal data is transferred outside its country of origin, Asetavo ensures an appropriate safeguard is in place — such as standard contractual clauses or an equivalent recognized mechanism — so that the transferred data receives a comparable level of protection.

7. Data-subject requests

Taking into account the nature of the processing, Asetavo will assist the Customer by appropriate technical and organizational measures, insofar as possible, to respond to requests from data subjects to exercise their rights (access, correction, deletion, restriction, portability and objection). Where a data subject contacts Asetavo directly about workspace data, we will refer them to the Customer.

8. Breach notification

Asetavo will notify the Customer without undue delay after becoming aware of a personal-data breach affecting Customer Data, and will provide information reasonably available to help the Customer meet its own notification obligations to authorities and data subjects.

9. Audit rights

Asetavo will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, subject to reasonable notice, confidentiality, and no more than once per year unless required by a supervisory authority or following a breach.

10. Return / deletion

On termination or expiry of the agreement, Asetavo will, at the Customer's choice, make Customer Data available for export for 30 days and then delete or anonymize it, unless retention is required by law. The Customer may also export data at any time during the term using the Service's tools.

11. Contact

For data-protection matters under this DPA, contact privacy@asetavo.com or legal@asetavo.com.