Data Processing Addendum

The contractor is the controller of the personal data contained in the documents, customer records and portal contacts it uploads. CableVault is the processor and processes that data only on the contractor's documented instructions, which include operating the service as described in the Terms.

Processing lasts for the term of the subscription. Categories of data subjects include the contractor's staff and its customers' contacts. Categories of data include names, business contact details, project information and any personal data contained in uploaded documents.

Personnel with access to personal data are bound by confidentiality obligations and access is limited to what is necessary to operate and support the service.

Encryption in transit and at rest; row-level access control isolating each workspace; private document storage served through short-lived signed URLs; role-based access within a workspace; logging of uploads, downloads and portal activity; and least-privilege administrative access.

The contractor authorises the sub-processors below. We will give notice before adding a new sub-processor, and the contractor may object on reasonable data protection grounds.

We will assist the contractor, taking into account the nature of processing, in responding to data subject requests and in meeting obligations for security, breach notification and data protection impact assessments. Self-service export and deletion are available in the app.

We will notify the contractor without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting their data, with the information reasonably available at that time.

Where personal data is transferred out of the EEA, UK or Switzerland, the transfer relies on the EU Standard Contractual Clauses (with the UK Addendum where applicable) or another lawful safeguard.

On termination, or on request, we delete workspace personal data within 30 days except where retention is required by law. Deleting the account in Settings triggers this process immediately.

On reasonable written request, and no more than once per year, we will provide the information necessary to demonstrate compliance with this addendum.

Data protection enquiries: privacy@cable-vault.com. Contract enquiries: legal@cable-vault.com.