Data processing addendum

Purpose and roles

This draft is intended for review where a business customer acts as controller and the service operator processes prospect data to provide FollowUpSignal. The actual controller, processor and independent-controller roles depend on the parties' purposes and applicable law and must be confirmed in the signed agreement.

Instructions and confidentiality

The operator would process customer personal data only to provide, secure and support the service and follow documented lawful customer instructions, subject to applicable law. Access should be limited to personnel who need it and are subject to confidentiality obligations; the operator must confirm the actual controls and personnel arrangements.

Security, subprocessors and assistance

The operator must document technical and organizational measures, maintain an accurate subprocessor list and provide notice of material changes. Potential configured providers include MongoDB hosting, Paystack, Resend and Meta WhatsApp Business Platform; the actual deployment list and locations have not been verified here.

The parties should define assistance with data-subject requests, security incidents, impact assessments and regulator inquiries, including response times and allocation of costs. This draft does not establish compliance with every applicable law.

Retention, deletion and audit

At the end of service, the customer should be able to request return or deletion of personal data, subject to applicable retention obligations. Self-service workspace deletion and export are not currently implemented. Backup periods, deletion timelines, audit rights, breach-notification timing and governing terms must be agreed and completed by the parties before relying on this addendum.