This addendum applies where [REGISTERED COMPANY NAME] processes personal data on your behalf, and forms part of the Terms of Service.

You are the controller. We are the processor. Where we engage others, they are our sub-processors.

If this addendum conflicts with the Terms of Service on a data protection point, this addendum wins.

Subject matter: providing the Relayno platform.

Duration: for as long as your subscription is active, plus the 30-day retention window afterwards.

Nature and purpose: storing, organising, transmitting and displaying the data you put into your workspace.

Categories of data subject: your customers, guests, contacts, suppliers and staff.

Categories of personal data: names, contact details, message content, order and reservation records, and any other field you choose to fill.

We process personal data only on your documented instructions, which include your use of the product’s features.

If the law requires us to process it otherwise, we tell you first unless the law forbids that.

Everyone we allow near production data is bound by confidentiality.

We implement appropriate technical and organisational measures, described in the Security section of the Privacy Policy.

You give general authorisation for us to engage the sub-processors listed on this page.

We will tell you at least 30 days before adding or replacing one, and you may object on reasonable data protection grounds.

If you object and we cannot offer an alternative, you may terminate the affected part of the service without penalty.

We remain liable for our sub-processors’ performance.

We help you respond to data subject requests, using the export and deletion tools in the console.

We help you with data protection impact assessments and prior consultations where they apply.

We notify you without undue delay after becoming aware of a personal data breach affecting your data, with enough detail for you to meet your own notification duties.

You can export your data at any time from the console, in JSON and CSV.

On termination we delete your data after the 30-day retention window, except where the law requires us to keep it.

Backups age out on their own cycle, within 90 days.

We make available the information needed to demonstrate compliance with this addendum.

You may audit no more than once a year, on reasonable notice, at your cost, subject to confidentiality — or accept a current third-party report where one exists.

Where personal data leaves the EEA, we rely on an adequacy decision or on Standard Contractual Clauses, which are incorporated here by reference.

Each sub-processor’s region is stated in the table on this page.