Data Processing Addendum

Parties, scope and instructions

The proposed processor is Individual Entrepreneur Alexander Netesov, based in Moscow, Russia, operating Well-Clean. Registration details: Taxpayer ID (INN): 502805882183; State registration number (OGRNIP): 321508100080669. The customer is the organisation identified in the separate agreement accepting this Addendum. Privacy and incident communications for the processor must use +7-495-142-00-62; Telegram: https://t.me/welldone_chat_bot; service communications can use +7-495-142-00-62; Telegram: https://t.me/welldone_chat_bot.

This Addendum applies only to personal data processed on behalf of the customer to provide the agreed workspace service. It does not convert the processor's independent website, business-contact, account administration or security purposes into processing on the customer's behalf. The Privacy Notice covers the English marketing website only; other independent service purposes require their applicable information.

The customer determines its purposes and lawful instructions and normally acts as controller. If the customer acts as a processor for another controller, it must have that controller's authority and give us instructions consistent with it. Each party remains responsible for the legal duties applying to its role.

Once accepted, the service agreement, this Addendum, the agreed account configuration and the customer's authorised written directions form the documented instructions. We will process customer personal data only on those instructions, including instructions concerning transfers, unless binding law requires otherwise. Where legally permitted, we will inform the customer of such a requirement before processing. We will promptly inform the customer if we consider an instruction to infringe applicable data protection law.

Processor duties

We will limit authorised access to personnel who need it for the agreed service and who are bound by confidentiality duties. We will implement technical and organisational measures appropriate to the processing risks and the applicable security obligations, including Article 32 where it applies. The specific measures and review evidence must be provided and agreed before this draft is executed.

We will not use customer content for an independent advertising purpose or expand the agreed purpose merely because the system can store additional fields. We will not sell customer content as a means of providing the agreed processing. Any proposed independent use must undergo separate role, purpose and legal review.

The customer must provide lawful, proportionate instructions, inform affected individuals and establish its legal grounds, including any additional conditions for specially protected information. These customer duties do not remove our direct duties as processor. The parties must agree a lawful scope before enabling a new category of sensitive information or a new monitoring function.

Requests, incidents and assistance

Taking account of the nature of processing and information available to us, we will assist the customer with data-subject requests, security duties, breach notification assessments, data protection impact assessments and any required prior consultation. We will notify the customer of a request concerning its content and will not decide that request on its behalf unless instructed or required by law.

We will notify the customer without undue delay after becoming aware of a personal-data breach affecting its data. The notice will include available information about the nature of the breach, affected data and people, likely consequences, contact point and measures taken or proposed. Information not available initially can be supplied in phases without undue further delay. No unsupported fixed incident-response hour commitment is created by this draft.

We will cooperate with the customer to investigate and mitigate the incident and provide information reasonably needed for its legal assessment. The customer remains responsible for notifications it must make as controller. This does not transfer our own direct legal obligations to the customer.

Subprocessors and international transfers

No general authorisation is created by publishing this draft. Before execution, the parties must identify the approved subprocessors and choose specific or general written authorisation. Under a general authorisation, we must give advance information about an intended addition or replacement and a meaningful opportunity to object before that provider receives the relevant data. The agreed notice procedure must be operational before it is relied on.

We will bind an authorised subprocessor to the same relevant data protection duties, including confidentiality, security, assistance and deletion/return obligations, and remain responsible to the customer for that subprocessor's performance as required by applicable law. The review list is an evidence register, not a list that the customer has already authorised.

Customer instructions must cover the processing and remote-access countries. A non-EEA recipient, first-party proxy or signed service agreement is not itself a lawful international-transfer mechanism. Any required transfer instrument, annexes, assessment and supplementary measures must be completed before the relevant disclosure. This draft incorporates no standard contractual clauses, UK Addendum, UK IDTA, Swiss adaptation or adequacy claim by implication.

No EEA, UK or Swiss customer work data may be submitted under this unexecuted draft. If an agreed transfer can no longer satisfy its legal requirements, the parties must suspend the affected processing or establish a lawful alternative before continuing.

Return, deletion and accountability

At the end of the agreed processing, we will, at the customer's choice, return or delete customer personal data and delete existing copies unless applicable law requires storage. The parties must first agree an achievable return format, the handling period, backup expiry and any required preservation; the service's token-expiry or archive function is not that agreement. Data preserved under a legal duty must remain protected and restricted to that duty.

We will make information needed to demonstrate compliance with this Addendum available to the customer and allow and contribute to audits and inspections by the customer or its mandated auditor. The parties can arrange reasonable confidentiality and security protections for an audit without removing legally required audit rights or preventing a competent authority's access.

For applicable US service-provider or contractor rules, the final agreement must specify the permitted business purposes, restrictions on use/disclosure and any other required terms. This draft does not assert that the customer or processor meets every US state's statutory threshold.

Where this Addendum conflicts with a general service term on customer processing, the agreed data-protection provision prevails to the extent necessary to perform its obligations. Mandatory law and individual rights are not excluded by a liability or commercial term.

Annex 1: processing description

Annex 2: security review and execution conditions

This annex is a review boundary, not a completed security assurance. Available implementation evidence includes authentication and authorisation checks, hashed password handling, TLS public routes and a private quarantine path for certain uploads. Those observations do not establish access protection for every historical photograph, encrypted storage/backups, a certification or a tested recovery commitment.

Before execution, the customer must receive the applicable security schedule covering access and tenant separation; personnel confidentiality; transport and storage protection; authorised support access and logging; backup/restore; vulnerability and incident handling; export/deletion, including backups; and the review of subprocessors and remote access. The parties must also complete the processing locations, retention instructions and required transfer arrangements. If those conditions are not met, the draft is not an instruction to begin the processing.