Data processing addendum

1. When this applies

This addendum applies whenever Inerica Systems (“we”) processes personal data on behalf of a client (“you”) in the course of providing a service. It forms part of the terms of service and takes precedence over them on anything concerning personal data.

Under the California Consumer Privacy Act as amended, you are the business and we are a service provider. Where another state’s law uses the words controller and processor, read them accordingly.

2. What each of us decides

You decide what data is collected, from whom, and why. We process it only on your documented instructions — which includes the configuration you set, the workflows you approve and the requests you make in writing.

We will tell you if an instruction appears to us to be unlawful, and we will not carry it out while that is unresolved.

3. What we will not do with it

The commitments a service provider has to make, made:

• We do not sell your customers’ personal data, and we do not share it for cross-context behavioral advertising.
• We do not retain, use or disclose it for any purpose other than performing the service — not for our own marketing, not to build a product, not to benchmark you against another client.
• We do not combine it with personal data from another client or from any other source, except where you have told us to.
• We do not use it to train an AI model, and neither do our model providers. See the AI use policy.

4. Subprocessors

You give general authorization for us to engage the subprocessors listed on the subprocessors page. Each one is bound by written terms no less protective than these.

We will give you thirty days’ notice by email before a new subprocessor begins handling your data. You may object on reasonable data-protection grounds; if we cannot resolve the objection, you may terminate the affected service without penalty and without losing what has already been delivered.

5. Security

We maintain the measures described on the security page, which forms part of this addendum. In summary: encryption in transit and at rest, per-tenant credential isolation, secrets encrypted with no plaintext read-back, multi-factor authentication on administrative accounts, and access limited to the people who need it for as long as they need it.

We will not materially reduce those measures during the engagement.

6. If there is a breach

We will notify you without undue delay and in any event within 72 hours of becoming aware of a personal data breach affecting your data, with what we know at the time — what happened, what categories of data and roughly how many people are affected, what we are doing about it, and who to talk to. We will keep you updated as we learn more rather than waiting for a complete picture.

Notifying affected individuals is your decision and your obligation as the business; we will give you what you need to make it.

7. Helping you answer your customers

When one of your customers exercises a right — access, deletion, correction, opt-out — you answer them and we help. We will action a verified request you pass to us within ten business days, so that you can meet the 45-day statutory deadline comfortably.

If a request reaches us directly, we will not answer it on your behalf. We will tell the person to contact you, and tell you it happened.

8. Return and deletion

At the end of the engagement you get the data in a usable format — the database, the files, the credentials — and we delete our copies within 30 days, or immediately if you ask. Backups roll out within 35 days and are not restored to recover deleted data. We will confirm deletion in writing if you want it confirmed.

We keep only what a law requires us to keep, which in practice means invoices. See the retention schedule.

9. Demonstrating compliance

We will give you the information reasonably needed to show that these obligations are met, and answer a security questionnaire once a year at no charge.

You may audit, on thirty days’ written notice, no more than once a year unless a breach has occurred, during business hours, and without access to another client’s data. An honest note: we hold no SOC 2 report and no ISO certificate, so there is no attestation we can send you instead of an audit — if your process requires one, say so early.

10. Where this addendum stops

This is written for United States privacy law, with California’s as the strictest. If you have customers in the European Economic Area, the United Kingdom or Switzerland, this document alone is not enough — you would need Standard Contractual Clauses and a transfer assessment on top. Ask and we will put them in place; do not assume this covers it.

11. Getting it signed

This page is incorporated into the terms of service and binds us as published, so most clients need do nothing. If your process requires a signed counterpart, email admin@inericasystems.com and we will send this same text as an executable document, usually the same day.