Data Processing Addendum

1. Scope and roles

This addendum forms part of the Business Terms of Service. It applies to personal data that the Business, as controller, records in the Services about its customers and team ("Business personal data"), which Converx processes as processor.

It does not cover data Converx controls itself, such as Converx accounts, customer portal profiles and sharing choices, review integrity records, and billing records; the Privacy Policy covers those.

2. Processing on instructions

Converx processes Business personal data only to provide the Services, on the Business's documented instructions — which are the agreement and the Business's use and configuration of the Services — or where the law requires it, in which case Converx will tell the Business unless the law forbids it. Converx will tell the Business if it believes an instruction breaks the law.

3. Details of the processing

4. Confidentiality of personnel

Converx limits access to Business personal data to personnel who need it, who are bound by confidentiality. Support access follows a named case, a stated reason, approval by a second administrator, a time limit, and is recorded in the Business's audit history.

5. Security measures

• Encryption in transit with TLS and at rest using provider-managed encryption; private object storage reached only through short-lived signed links.
• Separation of each Business's data by organization and branch, enforced in the application and the database.
• Hashed passwords and verification codes, rate-limited sign-in, optional authenticator-app sign-in for business users, and mandatory authenticator-app sign-in for Converx administrators.
• Append-only audit logs that exclude secrets and verification codes.
• Backups kept on a rolling 30-day basis, and application logs kept for 30 days.
• Review of security controls whenever the Services change materially.

6. Subprocessors

The Business authorizes Converx to use the subprocessors listed in the Subprocessors document. Converx binds each subprocessor to data protection terms at least as protective as this addendum and remains responsible for its performance.

Converx will give at least 30 days' notice before adding or replacing a subprocessor. If the Business objects on reasonable data protection grounds, the parties will discuss it in good faith; if they cannot resolve it, the Business may end the affected Services and receive a refund of prepaid fees for the unused period.

7. International transfers

Business personal data is hosted in Singapore and may be processed by subprocessors in other countries. Converx will transfer it only with the safeguards the applicable law requires.

8. Assistance to the Business

The Services let the Business find, correct, export, and delete customer records. If Converx receives a request from one of the Business's customers, it will forward the request to the Business without responding on the merits unless the Business asks it to. Converx will reasonably help the Business with data protection impact assessments and with consultations with authorities.

9. Personal data incidents

Converx will notify the Business without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting Business personal data. The notice will describe what is known, the data and people likely affected, the likely consequences, and the measures taken or proposed, and Converx will update it as it learns more.

10. Return and deletion

During the agreement and while read-only, the Business can export its data in open formats. When an organization is archived, Converx keeps the data for a 90-day recovery period and then deletes or anonymizes it, except where the law requires Converx to keep it. Deleted data remains in backups until they expire after 30 days.

11. Information and audits

Converx will make available the information reasonably needed to show compliance with this addendum, including summaries of its security controls. Where that is not sufficient, the Business may request an audit on 30 days' written notice to legal@converx.net, no more than once a year, conducted during business hours in a way that protects other customers' data and Converx's confidential information.