Data Processing Addendum

01Roles

For the personal data inside your Customer Data you are the controller and we are the processor. For the data we hold about your account and your users in order to run our own business, we are the controller and our Privacy Policy applies.

02The processing

Subject matter

Providing Forge Epic to you under the Terms of Service.

Duration

For as long as your subscription is active, plus the wind-down period.

Nature and purpose

Hosting, storing, and processing the data you put into the application so that the application can configure, calculate, draw, price and document your work.

Types of personal data

Names, business contact details and roles of your staff, your clients and your vendors, and anything else you choose to enter.

Categories of data subject

Your employees and contractors, and the contacts at your clients and vendors.

03Our obligations

• We process personal data only on your documented instructions, which include the Terms of Service and your use of the application, unless the law requires otherwise.
• Everyone we allow to process it is bound by confidentiality.
• We keep appropriate technical and organisational security measures.
• We help you, so far as we reasonably can, to answer data subject requests and to meet your obligations on security, breach notification and impact assessments.
• We tell you without undue delay if we become aware of a personal data breach affecting your data.
• At the end of the agreement we return or delete the personal data, at your choice, except where the law requires us to keep it.
• We make available the information you need to show compliance, and allow audits on reasonable notice, at reasonable intervals and without disrupting the service.

04Sub-processors

You give us general authorisation to use sub-processors for hosting, storage, payment, email and AI features, as described in the Privacy Policy. We impose data protection obligations on them no less protective than these, and we remain responsible to you for what they do. We will tell you before adding or replacing one, and you may object on reasonable data protection grounds. The current list is available from info@cholandynamics.com.

05International transfers

Where we transfer personal data out of the EEA or the UK, we do so under the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies, which are incorporated into this addendum by reference. A signed copy is available on request.

06Signature

If your procurement process needs this addendum signed on paper, write to info@cholandynamics.com and we will execute it.