Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Paternoster (“Jectos”, “processor”) and the member (“you”, “controller”). It applies when Jectos processes personal data of your clients, contacts and other people on your behalf (“Customer Personal Data”). It does not apply to data for which Jectos is itself the controller (your account and billing data, support chats, site analytics, waitlist), which the Privacy Notice covers.

You are the controller (or, where you act for your own customer, a processor) of Customer Personal Data. Jectos is your processor. If your law uses different words (for example “business” and “service provider”), the same roles apply. Payment details given at checkout are handled by Polar as an independent business and are outside this DPA.

2. Details of the processing

3. Our obligations

1. Instructions. We process Customer Personal Data only on your documented instructions, which are the Terms of Service, this DPA and your use and configuration of the service, including for any transfer outside your country, unless the law requires otherwise (in which case we tell you first, unless the law forbids it). We tell you if we think an instruction breaks the law.
2. Confidentiality. People who can access Customer Personal Data are bound by confidentiality.
3. Security. We apply the measures in section 7 and keep them appropriate to the risk.
4. Sub-processors. See section 5.
5. Requests from people. We help you answer requests to access, correct, delete, restrict or move Customer Personal Data using the service’s tools. If a person contacts us directly, we pass the request to you within 5 business days and do not answer it ourselves, except to say that we have passed it on.
6. Breaches. We tell you without undue delay after we become aware of a personal-data breach affecting Customer Personal Data, aiming for within 72 hours, with the information we have to help you meet your own duties.
7. Assistance. We give reasonable help with data protection impact assessments and with consultations with regulators, taking into account the information we hold.
8. No selling. We do not sell or share Customer Personal Data, and we do not use it for any purpose other than providing the service to you.

4. Your obligations

You confirm that you have a lawful basis to process Customer Personal Data and to have us process it; that you have given the required notices and obtained any consents (including for sending notifications to clients); and that your instructions comply with the law. You respond to requests from the people concerned.

5. Sub-processors

1. You authorise the sub-processors on our Sub-processors page. We have a written contract with each one that imposes data-protection obligations no less protective than this DPA, and we remain responsible for them.
2. We give you at least 30 days’ notice of a new or replaced sub-processor, by email to the account owner and by updating the page. You can object on reasonable data-protection grounds within that time. If we cannot resolve the objection, you may end your subscription and have it refunded for the unused period.

6. International transfers

Customer Personal Data is stored in Seoul, South Korea. Where the law of the UK or EU/EEA applies, transfers to Korea rely on the adequacy decisions for Korea (Decision (EU) 2022/254 and the UK’s Data Protection (Adequacy) (Republic of Korea) Regulations 2022). Further transfers to our sub-processors rely on the standard contractual clauses (and the UK addendum) in their data processing terms. Where another country’s law restricts transfers, we agree to protect the data to an equivalent standard through this DPA and our contracts with sub-processors, and to cooperate with you on any further steps the law requires.

7. Security measures

• Encryption in transit (TLS) and encryption at rest for sensitive fields (phone numbers, client emails and phone numbers, payment instructions, connected calendar addresses) using AES-256-GCM.
• Per-member data separation through database row-level access rules; team roles limit what team members can see.
• Files stored without public addresses and shown through short-lived signed links.
• Client links are unguessable and only a hash is stored; repeated failed identity checks lock the link.
• IP addresses stored as one-way hashes, or encrypted where needed as signing evidence.
• Access logging, rate limiting, and restricted administrative access.

8. Information and audits

On request we give you the information needed to show we comply with this DPA and allow reasonable audits by you or an auditor you appoint, with reasonable notice, during business hours, no more than once a year unless a breach or regulator requires more, and subject to confidentiality and without access to other customers’ data. We may meet an audit request by providing the relevant documentation or a summary report from our sub-processors.

9. Deletion and return

You can export your records and delete them in Settings at any time. When the agreement ends we delete Customer Personal Data as set out in the Privacy Notice: within 30 days after you delete your account, or on the schedule shown there for archive mode, apart from what the law requires us to keep and short-lived backups. On request we confirm the deletion by email.

10. General

1. If this DPA conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA applies. The limits on liability in the Terms apply to this DPA to the extent the law allows.
2. The law and courts stated in the Terms apply, except where data-protection law requires otherwise.
3. Contact for this DPA and for breach notices: privacy@jectos.com. Please send us a signed copy only if your own policies require one; this DPA applies without signature once you accept the Terms.