1. Roles
This Addendum forms part of the Terms. For personal data contained in customer content, Customer is the controller/business and ForgeRP is the processor/service provider, processing only on Customer's documented instructions to provide the Service.
2. Processor obligations
We will: (a) process personal data only to provide the Service and as instructed; (b) ensure personnel are bound by confidentiality; (c) implement appropriate technical and organizational security measures; (d) not sell or share personal data; (e) assist you with data-subject requests and, to the extent applicable, with DPIAs and regulator inquiries.
3. Subprocessors
You authorize the subprocessors listed on the Subprocessors page. We remain responsible for their performance and will give notice of material changes, giving you an opportunity to object.
4. Data-subject requests, breach, deletion
We will notify you without undue delay after becoming aware of a personal-data breach affecting your data, and will support your notification obligations. On termination, we delete or return personal data per the Terms and your instructions, subject to legal retention requirements.
5. International transfers
Where personal data is transferred across borders, the parties will rely on a lawful transfer mechanism (e.g., Standard Contractual Clauses) where required.