Data Processing & Security Addendum

9.1 Processing instructions

Tyden will process Client Personal Data only to provide the Services, comply with documented customer instructions consistent with the agreement, secure/support the Services, and comply with applicable law. Tyden will notify Customer if, in Tyden’s reasonable view, an instruction violates applicable data-protection law, unless prohibited from doing so.

9.2 Confidentiality

Tyden will ensure persons authorized to process Client Personal Data are subject to appropriate confidentiality obligations.

9.3 Security measures

Tyden will maintain reasonable administrative, technical, and organizational safeguards appropriate to the risk and nature of the data, which may include access controls, credential protections, least privilege, logging/monitoring, encryption in transit where supported, backups, vendor management, incident response, and secure deletion practices.

9.4 Subprocessors

Customer generally authorizes Tyden to use subprocessors necessary to provide the Services. Tyden will maintain a current subprocessor list or other reasonable notification method and impose appropriate data-protection obligations on subprocessors. Customer objections and available remedies should be finalized in the Order for enterprise customers.

9.5 Data subject requests

Taking into account the nature of processing, Tyden will provide commercially reasonable assistance to Customer with legally required requests to access, correct, delete, obtain, or restrict Client Personal Data, where Customer cannot reasonably fulfill the request through the Services.

9.6 Security incidents

Tyden will notify Customer without undue delay after confirming a security incident involving Client Personal Data for which notice is required under the agreement or applicable law and will provide reasonably available information necessary for Customer’s response. Notification does not constitute an admission of fault or liability.

9.7 Return and deletion

Following termination and subject to the Order, legal retention duties, backups, and technical limitations, Tyden will delete or return Client Personal Data as required by applicable law and the agreement.

9.8 Audits and information

Tyden will make reasonably necessary information available to demonstrate compliance with this DPA. Any audit rights should be proportionate, protect Tyden and other customers’ confidentiality/security, avoid unreasonable disruption, and may rely on independent certifications or reports where available.

9.9 U.S. state service-provider restrictions

To the extent required by an applicable U.S. state privacy law, Tyden will not retain, use, disclose, sell, or share Client Personal Data outside the purposes permitted by the agreement and applicable law, and will provide required contractual assurances for its processor/service-provider/contractor role.

9.10 International data transfers

If the Services are intentionally used for personal data subject to non-U.S. transfer restrictions, the parties will implement required transfer mechanisms before such processing. Tyden should not promise GDPR, UK GDPR, or other international compliance by default unless the commercial offering is intentionally expanded to those jurisdictions.