Data Processing Addendum

1. Roles and instructions

For customer personal data submitted to a contracted ASI workspace, the customer is controller and Erguvan is processor unless the order form states otherwise. Erguvan processes that data only on documented instructions to provide, secure and support ASI, or as required by law.

2. Processing schedule

• — Data subjects: authorized customer users, representatives and counterparties included by the customer.
• — Data: work identity and contact data, role, activity/audit records, portfolio or correction content, support communications and network metadata.
• — Purpose: authentication, workspace operation, evidence and export workflows, alert delivery, security, support and legal compliance.
• — Duration: the service term plus the documented return, deletion, backup and legal-retention period.
• — Special-category and children's data: prohibited unless expressly agreed in writing with additional safeguards.

3. Processor duties

• — Confidentiality, least-privilege access and appropriate technical and organizational measures.
• — Assistance with data-subject requests, impact assessments and regulator consultations.
• — Prompt incident notice and cooperation, with the contractual notification deadline set in the signed DPA.
• — Sub-processors bound by equivalent protections and lawful international-transfer safeguards.
• — Return or deletion at termination, subject to backups and legal holds, with evidence on request.

4. Completion required

The signed version must identify both parties, addresses and registration numbers; processing details; approved sub-processors and locations; transfer mechanism; security schedule; incident deadline; audit terms; deletion timeline; governing law; and signatures. Request the current execution copy from legal@erguvan.co.