Data Processing Addendum

Contractual rules for processing on documented instructions where required by the approved role assessment.

  1. This Addendum applies only to the extent that CUTO Technology, LLC processes personal data for the Customer as a processor and the applicable contract expressly incorporates this version.

  2. The parties determine their data protection roles separately for each processing purpose. The role map in Schedule 1 governs the boundary between processing on Customer instructions and processing for CUTO’s own purposes.

  3. “Customer Personal Data” means personal data in Customer Content that CUTO processes for the Customer within the applicable processor scope. “Instruction” means a documented direction from the Customer within the agreed Service scope. “Subprocessor” means another processor engaged by CUTO for that scope.

  4. The subject matter, duration, nature and purpose of the processing and the categories of data subjects and personal data are set out in Schedule 2. Schedule 2 may be executed only with the details approved for the specific contract scope.

  5. CUTO processes Customer Personal Data only on the Customer’s documented instructions, including for transfers, unless applicable law requires different processing. The incorporated contract documents, approved configurations and permitted Service actions form the documented instruction framework.

  6. If CUTO considers an instruction to infringe applicable data protection law, CUTO informs the Customer to the extent legally permitted and suspends the affected processing pending clarification.

  7. CUTO ensures that persons authorised to process Customer Personal Data are subject to an appropriate confidentiality obligation and receive access only to the extent required.

  8. Access to Customer Personal Data for support or administration is limited to the required case, the authorised scope and the designated roles. The applicable access and location details are set out in Schedule 1 and Schedule 5.

  9. CUTO does not engage a Subprocessor for the applicable processor scope without the Customer authorisation required by the approved Subprocessor model.

  10. CUTO contractually binds each authorised Subprocessor to data protection obligations that are no less protective for its processing than the applicable obligations in this Addendum and remains responsible to the Customer for performance of those obligations.

  11. For an intended addition or replacement of a Subprocessor, CUTO informs the Customer under the approved change model so that the Customer can review the designated information and use the agreed objection path.

  12. Taking into account the nature of the processing, CUTO assists the Customer through appropriate technical and organisational measures in responding to data-subject requests within the agreed scope. CUTO does not respond in place of the Customer where the Customer is responsible for deciding the request.

  13. Taking into account the nature of the processing and the information available to CUTO, CUTO assists the Customer within the agreed scope with data protection impact assessments and any required prior consultation.

  14. CUTO informs the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provides the information available within the agreed scope to assist the Customer with its obligations.

  15. CUTO provides the Customer with information reasonably required to demonstrate compliance with the applicable obligations of this Addendum and permits audits under the approved audit and evidence procedure.

  16. After the applicable processing scope ends, CUTO returns or deletes Customer Personal Data in accordance with the agreed choice and Schedule 3, unless applicable law requires further retention.

  17. Approved expiry, restriction and deletion rules in Schedule 3 apply to remaining backup copies and data retained by law. Such data must not be further processed for other purposes.

  18. CUTO arranges a transfer of Customer Personal Data to a third country or international organisation only within the documented instruction framework and under the legal conditions and safeguards approved for the specific data path in Schedule 5.

  19. The Customer is responsible for the lawfulness of its instructions, the permissibility of data submitted to the Service, the required information to data subjects and the decisions allocated to it as controller.

  20. Notices, instructions, privacy requests, security reports and objections are submitted only through the contact and evidence paths approved in the applicable contract or Schedule.

  21. This Addendum applies for the duration of the incorporated processor scope and thereafter for as long as CUTO processes or retains Customer Personal Data under this Addendum.

  22. In the event of a conflict, this Addendum prevails over general contract terms for its subject matter; mandatorily applicable transfer clauses remain unaffected within their scope. The final order of precedence requires express approval.

  23. Each executable version of this Addendum and its Schedules receives a unique version and effective date. Changes are incorporated only through the approved contracting and versioning process; earlier versions are archived under control.