Data processing addendum
Provisional draft · 2026-10-17-draft-1 · 17 October 2026
1. Draft, not executed
This proposed addendum is for organisations using LetX to process personal information. It is not an executed data-processing agreement. Operator identity, contract parties, processing schedule, approved subprocessors, transfer safeguards, security commitments and retention schedules must be completed and agreed before relying on it as an Article 28 agreement.
2. Scope and instructions
Proposed processing covers hosting and operating authorised business workflows during the agreed service period, including storage, retrieval, communication and deletion on documented instructions. Data subjects may include users, staff, customers, tenants, owners, contractors and suppliers. Data categories follow the enabled modules; special-category data requires explicit documented instructions and a lawful condition.
3. Controller responsibilities
The organisation determines purposes and lawful bases, provides notices, limits data to what is needed, controls user access and verifies authority to disclose information. It must identify any required high-risk processing assessment and maintain human review of significant decisions.
4. Proposed processor duties
The final agreement should require processing only on lawful documented instructions, confidentiality for authorised personnel, proportionate technical and organisational measures, assistance with rights requests and assessments, and incident notification without undue delay after awareness. Exact measures and operational arrangements remain to be confirmed; this text does not assert an implemented guarantee.
5. Subprocessors and transfers
The final schedule must identify subprocessors, processing locations, applicable authorisation and change-notice procedures, and any legally required transfer mechanism. Connected services chosen independently by an organisation may have separate controller or processor roles. Do not assume all integrations are included in a single agreement.
6. Return, deletion and assurance
At service end, the final agreement should specify return or deletion, statutory retention exceptions, backups and feasible timescales. Audit and assurance arrangements, allocation of costs and confidentiality must be agreed. No fixed export, deletion or audit entitlement is invented here.
7. Completion checklist
Before execution confirm: both legal parties and contacts; service term; processing purposes and categories; authorised users; sensitive data instructions; security schedule; subprocessors; transfer safeguards; incident and rights contacts; retention and exit process; signature or authorised acceptance. Individual draft acknowledgement does not execute this addendum.