Data Processing Addendum

This Data Processing Addendum forms part of the Terms or signed order when ToolOn processes personal data on behalf of a customer. The customer is the data fiduciary controller or equivalent responsible party and Scriza Private Limited is the data processor service provider or equivalent unless the context requires otherwise.

1 Processing Instructions

ToolOn will process Customer Personal Data only to provide secure support maintain and improve the contracted service under the documented instructions in the Terms order account settings API requests and this Addendum. ToolOn will inform the customer if an instruction appears unlawful unless law prevents notice. ToolOn will not sell Customer Personal Data or use recipient lists for its own independent advertising.

2 Customer Responsibilities

The customer determines the lawful purpose means recipients content tracking and retention settings and must provide required notices obtain valid consent or another lawful basis answer rights requests and ensure that its instructions comply with applicable law. The customer must minimise data restrict sensitive information manage authorised users and protect credentials. The customer must not instruct ToolOn to send unlawful or unsolicited email.

3 Confidentiality and Personnel

ToolOn will limit access to personnel and contractors who need it for authorised duties and who are bound by confidentiality obligations. Access will be reviewed and removed when no longer required.

4 Security Measures

• Access control based on role and least privilege with authentication and administrative access protection.
• Encryption in transit and appropriate protection for stored data secrets and backups.
• Logging monitoring abuse detection vulnerability remediation backup and incident response processes.
• Separation of customer environments or logical tenant controls appropriate to the architecture.
• Supplier review confidentiality and security commitments appropriate to each subprocessor role.
• Business continuity recovery testing and secure deletion processes proportionate to the service.

5 Subprocessors

The customer gives general authorisation for ToolOn to use subprocessors needed for hosting storage database security analytics payment support and email delivery. ToolOn will publish the current Subprocessor List and provide notice of material new subprocessors through the website account or registered email where contractually required. A customer with a reasonable data protection objection must notify ToolOn during the stated notice period. If the parties cannot resolve the objection the customer may stop the affected service subject to the order and law.

6 International Transfers

ToolOn and the customer will use any transfer mechanism required by applicable law including contractual safeguards and supplementary security measures where appropriate. The customer authorises transfers necessary to reach recipients and use listed subprocessors subject to the order and published locations.

7 Rights Requests

ToolOn will provide reasonable assistance for access correction deletion consent withdrawal objection nomination and grievance requests relating to Customer Personal Data. If ToolOn receives a request directly it may refer the person to the customer and will not respond substantively except on customer instruction or where law requires. Assistance beyond standard product features may be chargeable when permitted and agreed.

8 Personal Data Breach

ToolOn will notify the affected customer without undue delay after confirming a Personal Data Breach involving Customer Personal Data. Available information may include the nature categories approximate scale likely consequences containment and contact route. ToolOn may provide updates as investigation continues. The customer remains responsible for its regulatory and individual notices unless law assigns the duty to ToolOn.

9 Deletion and Return

During the term the customer may export or delete supported Customer Personal Data using account features. After termination ToolOn will delete or return Customer Personal Data within the period in the order or Privacy Policy unless law requires retention. Backups are removed through normal rotation. ToolOn may retain suppression and complaint evidence only as necessary to prevent unwanted email protect rights or comply with law.

10 Audit Information

ToolOn will provide reasonable information needed to demonstrate compliance such as policy security and subprocessor documentation. Where required by applicable law and not satisfied by existing assurance the customer may request a proportionate audit under confidentiality during business hours at its cost and without exposing other customers data or creating security risk.

11 Processing Details