Data processing addendum

#Scope

This addendum forms part of the terms of service for customers who are subject to data-protection law and need AevoraeX to act as their processor. It applies to personal data that the customer or its users enter into AevoraeX (team members, notes, pipeline activity, exported files). It does not apply to Redfin listing data that AevoraeX reads and scores on its own behalf, which is covered by the privacy policy.

#Roles

The customer is the controller of customer data. AevoraeX is the processor and acts only on the customer's documented instructions, which are the terms, this addendum and the settings the customer chooses in the app.

#Processing details

• Subject matter: running the AevoraeX app and emails for the customer.
• Duration: the subscription term plus the retention period in the privacy policy.
• Nature and purpose: storing, displaying, exporting and emailing customer data as the product requires.
• Types of data: names, emails, roles, notes, pipeline stages, saved views, percentile tiers, product events.
• Data subjects: the customer's users and, where a customer types them into notes, the people the customer contacts.

#Subprocessors

AevoraeX uses the providers listed on the security page under subprocessors. We give at least 30 days' notice by email before adding one; customers who object may end the subscription for the affected service without penalty.

#Security

AevoraeX applies the measures described on the security page: encryption in transit and at rest, role-based access, audit logs, least-privilege staff access, and tested backups. We notify customers of a personal-data breach without undue delay and within 72 hours of confirming it.

#Assistance

We help customers respond to data-subject requests, carry out impact assessments and consult with authorities, within reason and at cost where the work is substantial.

#Deletion and return

Customers can export their data at any time on plans with exports, and on every plan from Settings. On termination we delete or de-identify customer data on the privacy policy's schedule, unless the law requires longer retention.

#Audits

Once a year, and after any breach, customers may request our current security documentation and, where that is not enough, an audit by an independent assessor under a confidentiality agreement, at the customer's cost.

#Transfers

Data is stored in the United States. Where a customer's law restricts transfers, the parties rely on the standard contractual clauses or another mechanism named in an order form.

#Contact

burhan@aevoraex.com for anything under this addendum.