Customer Data Processing Addendum

1. Contracting parties and commencement

“Customer” means the person or organization identified as customer in the service order or other binding service agreement. “Provider” means the actual person or entity identified in that agreement as providing the YSUITS service. YSUITS is a service brand; its use does not represent that a particular corporation has been formed. The parties must be identifiable from their agreement and its incorporated records.

This Addendum becomes part of that agreement only when the parties expressly incorporate it through an authorized acceptance method. Publication, reading a legal page, a general website account, or a privacy request does not by itself execute this Addendum. The service order identifies the covered service, customer organization, authorized instructions, applicable period, and any service-specific processing details required below. The order must not describe an unavailable feature as an operating service.

2. Roles and scope

Customer determines the purposes and essential means of processing personal data entrusted to Provider for the covered organization service (“Customer Personal Data”). Provider processes that data on Customer’s behalf as processor or service provider. Where Customer is itself a processor, these terms govern Provider as subprocessor and Customer must have authority from the relevant controller to engage Provider and issue the instructions.

The roles depend on the actual processing. Provider’s own website operation, account administration, legal compliance, and business contact activities may involve independent controller responsibilities described in the Privacy Policy. Calling data “service data” does not permit Provider to convert Customer Personal Data to an unrelated purpose. This Addendum does not replace the organization’s privacy information to its users.

3. Documented instructions and permitted purposes

Provider shall process Customer Personal Data only on documented instructions needed to supply, secure, support, maintain, and conclude the covered service, including instructions concerning access, disclosure, deletion, and international transfers. The service agreement, service order, authorized configuration choices, and verified written directions form those instructions. Customer remains responsible for the lawfulness of its instructions and for notices or authorizations that it must obtain.

Provider shall promptly inform Customer if it considers an instruction to infringe applicable data-protection law and may suspend the affected instruction while the issue is resolved. Where law requires otherwise uninstructed processing, Provider shall give advance information unless that law prohibits doing so on important public-interest grounds. A general product-improvement statement is not permission to use identifiable workspace information for an unrelated purpose.

4. Restrictions on independent use

Provider shall not sell Customer Personal Data, use it for cross-context behavioral advertising, or use it to train a general-purpose or foundation AI model. Provider shall not retain, use, or disclose it outside the purposes and business relationship authorized by these terms, except as applicable law permits or requires. Combining information from different customers or other sources is allowed only where the applicable law and documented service instructions permit the specific combination.

An optional processing activity outside the covered instructions requires a separate lawful arrangement and any additional notice or consent that the affected individuals require. Customer agreement alone does not waive individuals’ rights or supply missing authority over children’s, student, tax, health, or other specially protected information. These terms do not authorize a separate AI or professional service.

Where Provider acts as a service provider or contractor under the CCPA, Provider shall comply with the CCPA and its regulations and provide the same level of privacy protection required of the business for the covered information. Provider shall notify Customer if it determines it can no longer meet those obligations. Customer may, upon notice, take reasonable and appropriate steps to ensure compliant use and to stop and remediate unauthorized use. Provider shall reasonably cooperate with those steps and applicable consumer-request, assessment and audit duties.

5. Confidentiality and access

Provider shall ensure that personnel permitted to process Customer Personal Data are bound by appropriate confidentiality obligations. Access shall be limited to people who need it for an authorized service or legal purpose and reviewed when duties change or access is no longer needed. Provider shall take reasonable steps to keep one organization’s information from being disclosed to another organization.

Customer shall manage its authorized users, workspace permissions, and instructions concerning its own records. A customer-configured sharing setting does not authorize Provider to disclose information outside the setting or to disregard a legal restriction.

6. Contractual security requirements — Annex II

For processing covered by an accepted Addendum, Provider shall maintain documented technical and organizational measures proportionate to the nature, sensitivity, volume, and risks of the processing. Those measures shall address access control and least privilege; authentication appropriate to the access risk; protection of data in transit over public networks; protection of stored data through encryption or other documented appropriate safeguards; tenant separation; change and vulnerability management; operational logging; recovery arrangements; and secure disposal.

Provider shall also maintain procedures for personnel confidentiality, access removal, incident response, oversight of relevant service providers, and periodic review of whether the measures remain appropriate. A service order may require additional measures for its specific data. Those additional requirements must be agreed and satisfied before the corresponding processing begins.

This Annex states duties that attach when the Addendum is accepted. It is not a statement that YSUITS has an independently audited certification, a particular assurance report, end-to-end encryption, a zero-retention architecture, or an absolute security guarantee. A factual service-security description or specific assurance claim must be supported separately.

7. Personal data incidents

Provider shall notify Customer without undue delay after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. An initial notice may be supplemented as the facts become available and shall describe, to the extent known, the incident, affected data and individuals, likely consequences, mitigation, and a contact for follow-up.

Provider shall take appropriate containment and remediation steps and reasonably assist Customer with its own assessment and notification duties. This is not a promise to resolve every incident within a fixed number of hours. Provider shall not issue a notice in Customer’s name without authority unless a legal requirement applies. Notice or cooperation does not by itself determine fault or liability.

8. Individual rights and regulatory assistance

Taking account of the processing and information available to it, Provider shall reasonably assist Customer with lawful requests for access, correction, erasure, restriction, portability, objection, and other applicable rights, using appropriate technical or administrative measures. Provider shall promptly direct a request concerning Customer-controlled records to Customer unless instructed or legally required to respond itself. Referral does not excuse Provider’s independent duties.

Provider shall also supply information reasonably needed for Customer’s data-protection impact assessments, applicable regulatory consultation, security obligations, and incident notifications. A receipt, support ticket, or review decision is not evidence that an export, correction, or deletion has actually been completed.

9. Subprocessors and authorization

Before a subprocessor receives Customer Personal Data, Provider shall obtain Customer’s specific or general written authorization and make available the relevant identity, function, processing location, and transfer information. An initial service-specific list may be incorporated into the service order or supplied as an expressly identified register. An absent public list is not a representation that no suppliers are used and is not automatic authorization of unnamed parties.

For a planned change under general authorization, Provider shall give at least 30 calendar days’ advance notice and a meaningful opportunity to object on reasonable data-protection grounds. A shorter period requires Customer’s written authorization for that change or an already authorized emergency procedure consistent with applicable law. Provider shall address a reasonable objection before sending affected data to the proposed new subprocessor; if it cannot resolve the issue, the parties shall arrange an appropriate alternative or conclusion of the affected processing under their service agreement.

Provider shall impose materially equivalent applicable data-protection obligations on subprocessors by binding contract and remain responsible to Customer for their performance to the extent required by applicable law and this Addendum. Customer-connected independent services are addressed separately below.

10. Customer-directed integrations and disclosures

If Customer chooses an independent integration or directs delivery to another recipient, Customer shall confirm the authority and information necessary for that instruction. A recipient is not automatically Provider’s subprocessor merely because Customer connects it. Provider shall disclose the recipient’s relevant role and the extent of any Provider-controlled processing before an integration requiring additional sharing is enabled.

Customer instructions do not excuse Provider from complying with transfer restrictions, confidentiality duties, or legally required consent. A connection must not silently expand access to other workspaces or unrelated personal data.

11. International transfers

Provider shall not carry out a restricted international transfer of Customer Personal Data without an applicable lawful mechanism, necessary Customer authorization, and information about the relevant recipients and locations. Where adequacy or an approved contractual safeguard is relied on, the parties shall document that it applies to the particular recipient and processing.

If standard contractual clauses or another transfer agreement are needed, they must be separately completed or lawfully incorporated with the applicable module, parties, selections, annexes, and any required transfer assessment or supplementary measures. This Addendum alone does not execute standard contractual clauses, certify Data Privacy Framework participation, or establish that all countries provide equivalent protection. UK, Swiss, and other transfer requirements must be addressed separately where relevant.

12. Return, deletion, and retained copies

On completion of the covered service or a lawful earlier instruction, Provider shall, at Customer’s choice, return or delete Customer Personal Data and delete existing copies without undue delay, except to the extent retention is required and permitted by applicable law. The parties shall use a secure, reasonably accessible return method appropriate to the data; the service order specifies any necessary service-specific export and closure arrangements.

If immediate targeted deletion from a protected backup is not feasible, the remaining copy shall be isolated from ordinary use, safeguarded, and removed through the established, documented backup-retention cycle disclosed for that service. Restoration shall not reintroduce data for a purpose that has ended, and applicable deletion instructions shall be reapplied. A backup label does not permit indefinite retention.

A limited legal-hold or required record shall be retained only for the relevant purpose and period, with access and use restricted accordingly. “Immutable” or “audit” labels do not create a general exemption from privacy rights. Provider shall provide reasonable confirmation of completion and identify any lawful outstanding retention rather than certify an operation that has not occurred.

13. Information, review, and audit

Provider shall make available information necessary to demonstrate compliance with the applicable processor obligations. The parties should ordinarily begin with relevant documentation, responses, and available independent assessment material under appropriate confidentiality protections. An assurance report shall not be represented as available unless it exists.

Where necessary to meet applicable law, Provider shall allow and reasonably cooperate with an audit or inspection by Customer or an appropriately qualified independent auditor mandated by Customer. Scope, timing, access, and confidentiality shall be coordinated to protect other customers, security, and business continuity. Ordinary coordination requirements shall not prevent a legally required inspection, an authority’s powers, or necessary review following a material incident. These terms do not create general access to unrelated customer records.

14. Annex I — subject matter, duration, and operations

The subject matter is processing needed for the expressly contracted, actually available YERP organization workspace or other service specifically identified in the service order. The purposes are to provide the contracted organization function, apply authorized access and sharing choices, maintain security and continuity, respond to support and rights instructions, and return or delete the entrusted data at closure. A public roadmap, website account, or list of brand names does not expand this scope.

Operations may include receipt, organization, structured storage, retrieval, display to authorized users, customer-instructed changes, authorized transmission or export, service-security review, and deletion or return. Only operations required by the covered service and documented instructions are authorized. Processing lasts for that service’s agreed period and the limited closure, backup, and lawful-retention periods described above; it is not indefinite.

15. Annex I — data and individuals

Depending on the contracted YERP function and records Customer lawfully submits, Customer Personal Data may comprise business and personal contact details; account, organization, role and access identifiers; bookkeeping transactions, donor and contribution records, authorized personnel and payroll information, source documents and requested reports; and activity, support or security records generated in performing the instructed service. Individuals can include organization members, donors and household contacts as well as those described below. The service order and Customer’s documented instructions identify the categories that actually apply; not every category is collected from every user.

Individuals may include Customer’s authorized users, personnel, business contacts, customers, suppliers, and people identified in the specific records lawfully entrusted for that service. Sensitive or specially regulated data, child-directed processing, tax-return preparation, student-record services, public credential publication, biometrics, and unrelated AI use are not authorized merely by this general Annex. If a covered service requires them, the actual purpose, data, individuals, lawful authority, safeguards, and any additional agreement must be expressly established first.

16. Annex III — service-specific subprocessors and schedules

Before the relevant processing starts, the identifiable service order or incorporated service-specific register shall state the authorized subprocessors and their functions and locations, the authorized instruction contacts, and any required international-transfer arrangement. A service order shall also identify any special processing categories, service-specific retention cycle, or additional security requirements on which the parties rely.

These are conditions for the processing they concern, not blank permissions to be completed after data is disclosed. If the required information or authorization is missing, Provider shall not begin that affected processing until it is supplied and lawfully agreed.

17. Priority and continuing obligations

For the processing it covers, this Addendum prevails over conflicting general service language concerning personal-data protection. A valid applicable transfer instrument prevails where it requires a different result. The service agreement continues to govern unrelated commercial matters, but it cannot waive mandatory data-protection duties or individuals’ statutory rights.

Confidentiality, authorized retention, security of retained data, completion of return or deletion, and cooperation concerning earlier processing continue for as long as their subject matter remains. Changes to covered purposes, roles, or instructions require an appropriate lawful agreement and any required notice or consent. Questions about these terms may be sent to support@ysuits.com.