Data Processing Addendum
Processor terms for organizations that use JASLYN NET to process personal data of their customers, staff or end users.
Important. This document is part of the JASLYN NET service terms. It is written for operational use and should be read with any signed order, applicable service-specific agreement and mandatory law.
1. Roles
For Customer Data processed through JASLYN NET on the customer’s instructions, the customer acts as the data controller or equivalent decision-maker and YURIAN TECH LTD acts as processor/service provider to the extent recognized by applicable law.
2. Processing instructions
The Company will process Customer Data only to provide, secure, support and maintain the Service, comply with documented customer instructions that are lawful and technically feasible, and comply with legal obligations. The customer is responsible for the lawfulness of its instructions and the original collection of Customer Data.
3. Confidentiality
Personnel and contractors authorized to process Customer Data must be subject to confidentiality obligations appropriate to their role.
4. Security measures
- Access control and role-based privileges.
- Tenant-level data isolation controls.
- Encryption in transit and protected secret storage.
- Audit logging and security monitoring.
- Backup and recovery controls appropriate to the Service.
- Vulnerability management and secure software development practices.
5. Subprocessors
The Company may use infrastructure, hosting, payment, communications, monitoring and other subprocessors needed to operate the Service. Subprocessors receive only the access reasonably necessary for their function and are subject to contractual or equivalent confidentiality and security obligations. A current service-specific list may be provided through the Service or support channel.
6. Data subject assistance
Taking into account the nature of processing, the Company will provide reasonable technical assistance for access, correction, deletion, restriction, export or other data subject requests that the customer is legally required to handle. The Company may charge reasonable costs for unusually extensive assistance where permitted by law and the applicable agreement.
7. Security incidents
The Company will notify the customer of a confirmed personal-data security incident affecting Customer Data without undue delay after becoming aware of it, subject to legal restrictions and the need to protect the investigation. Notifications will contain available information about the nature of the incident, affected systems or data, mitigation and relevant next steps.
8. International transfers
Where processing involves a transfer to another jurisdiction, the parties will use transfer mechanisms and safeguards required by applicable data protection law. The customer will not instruct the Company to make a transfer that is unlawful.
9. Deletion and return
At the end of the applicable Service, the Company will delete or return Customer Data according to the customer’s lawful instructions and technical capabilities, except information that must be retained for legal, security, accounting, dispute or backup purposes. Backup copies may persist for a limited period before normal secure expiration.
10. Audit and compliance evidence
The Company may provide reasonable information about its security practices to help customers assess compliance. On-site audits, penetration testing against production infrastructure and access to confidential security material require prior written authorization and must not create operational or security risk.