Commercial Data Processing Addendum

1. Applicability and precedence

This Addendum applies only when an approved commercial agreement or order expressly incorporates it. It supplements that agreement for the processing identified in the applicable service schedule.

If applicable data-protection law gives this Addendum priority for its subject, that priority applies only to the conflict and processing at issue.

2. Roles and instructions

The service schedule must identify whether ASCA and the customer act as a controller, processor, service provider, contractor, data intermediary, or analogous role for each workflow. No universal role is created merely by using ASCA.

Where ASCA processes personal information on documented customer instructions, ASCA will process it only to provide, secure, support, and improve the agreed service, comply with lawful instructions, and meet applicable legal requirements.

3. Processing details

The applicable schedule must identify:

• The subject matter and duration.
• The nature and purpose.
• Categories of personal information and sensitive information.
• Categories of affected people.
• Authorized services, modules, integrations, and locations.
• Customer instructions and restrictions.
• Retention, deletion, return, and legal-preservation treatment.

4. Customer responsibilities

The customer is responsible for lawful instructions, notices, permissions, consents, configuration, administrator authority, data accuracy, and use of exports. The customer must not instruct ASCA to process prohibited data or use a service outside its documented scope.

5. Confidentiality and security

ASCA limits processing access to authorized personnel and services subject to confidentiality and scoped access. ASCA maintains controls appropriate to the service and risk, which may include encryption, tenant isolation, least privilege, auditability, private storage, secure development, incident response, backup, and file-safety controls.

Public security information is available in the Security Overview. Confidential security details may be provided through an approved review process rather than published.

6. Service providers

ASCA may use providers for the functional categories listed in Service Providers and Subprocessors. Where required, the applicable commercial schedule will identify named subprocessors, required contract terms, objection procedure, and change notice.

ASCA remains responsible for provider obligations to the extent required by the applicable agreement and law.

7. Individual requests

Taking account of the service and role, ASCA will provide reasonable assistance for supported access, correction, deletion, restriction, objection, portability, and complaint requests. The customer remains responsible for responding where it determines the purpose and means of processing.

ASCA may verify identity, authority, scope, and lawful exceptions before acting.

8. Incidents and legal requests

ASCA will notify the customer of a confirmed incident affecting covered customer personal information without undue delay as required by the approved agreement and applicable law. Notice content and timing depend on available facts and must not compromise security, affected rights, or an investigation.

ASCA reviews legal requests for validity, scope, authority, and applicable notice restrictions. The Law Enforcement Request Policy provides the public framework.

9. International transfers

The service schedule identifies relevant processing locations and any required transfer mechanism. ASCA uses contractual and organizational safeguards appropriate to the affected data flow and applicable law rather than applying one universal mechanism.

10. Return and deletion

At the end of covered processing, ASCA will return, delete, or de-identify covered information according to the approved schedule, subject to security, backup, legal-preservation, transaction, and other lawful retention.

11. Audit information

ASCA may provide current security documentation, summaries, questionnaires, or other reasonable evidence appropriate to the service. On-site access, penetration testing, confidential architecture, and provider details require separate authorization and safeguards.

12. Contact

Commercial privacy and DPA inquiries may be sent to [email protected].