Data processing addendum
Version September 27, 2026. This addendum forms part of a customer agreement when incorporated by that agreement or otherwise expressly accepted by both parties. RevenuePilot is the processor for customer personal data and the customer is the controller (or an authorized processor). Before restricted processing begins, the parties must complete the customer-specific processing and transfer details.
Ready for lawyer review. Pending Shaun. A SaaS lawyer should review this draft once before a pilot signs. It is not legal advice and it is not a signed agreement.
Scope and processing details
The subject matter is hosting and providing the customer’s Takt workspace for the duration of the service and an agreed return/deletion period. Processing includes collecting, organizing, storing, retrieving, transmitting, securing and deleting operational records on customer instructions. Data subjects may include authorized users, employees, contractors and business contacts. Data types may include names, work contact details, roles, assignments, activity and records entered by the customer. Special-category data, regulated health data and other sensitive categories require a separate written scope and safeguards before submission.
Instructions and confidentiality
RevenuePilot processes customer personal data only on documented customer instructions, including the agreed service configuration, except where law requires otherwise. Where legally permitted, we inform the customer of that requirement. We will notify the customer if an instruction appears to infringe applicable data protection law and may suspend that instruction pending clarification. Personnel authorized to process customer personal data must be subject to confidentiality obligations and access limited to their responsibilities.
Security
We maintain technical and organizational measures appropriate to the agreed processing and risks, including authenticated access, server-enforced workspace permissions, transport encryption, constrained provider access and security-event records. The security page describes the implemented architecture and its limits. Measures may evolve without materially reducing the agreed protection. Certifications, recovery targets, dedicated isolation and region-specific controls apply only when expressly agreed and evidenced.
Subprocessors
The customer authorizes the providers in the subprocessors inventory that are needed for its enabled features. We require written data-protection obligations appropriate to their processing and remain responsible for their performance of delegated obligations under this addendum. We will give customers advance notice of intended additions or replacements and a reasonable opportunity to object on data-protection grounds before the new processing begins. The parties will seek an alternative or agree to end the affected feature if an objection cannot reasonably be resolved.
Assistance and incidents
Taking account of the processing and information available, we assist the customer with data-subject requests, security obligations, impact assessments and regulator consultations. We notify the customer without undue delay after becoming aware of a personal-data breach affecting its data, with available information about its nature, likely effects and mitigation, and provide updates as information develops. We do not communicate to affected individuals or regulators on the customer’s behalf unless instructed or legally required.
Return, deletion and records
At the customer’s choice and subject to applicable legal retention duties, we return or delete customer personal data after the processing service ends and delete existing copies according to the agreed schedule. Backups remain protected, are not used for ordinary processing and expire under the agreed backup schedule. Legally required retained data remains protected and restricted. The parties must record the applicable export format, retention periods and deletion process in the service agreement; there is no self-service deletion promise.
Evidence and audit
We make available information reasonably necessary to demonstrate compliance with this addendum and allow appropriate customer or independent-auditor inspections, subject to proportionate confidentiality, security and scheduling arrangements that do not prevent legally required verification. Audits must protect other customers’ data and service availability. We maintain relevant processing and provider records and cooperate with competent authorities as required by law.
International transfers and order details
This addendum alone does not supply a cross-border transfer mechanism. Where applicable law requires standard contractual clauses, a UK addendum or another safeguard, the parties must execute and complete that mechanism and its annexes before the restricted transfer. The order must identify both parties and contacts, relevant jurisdictions, enabled providers, data categories, instructions, retention and transfer arrangements. Mandatory data-protection rights are not limited by this addendum.