This addendum forms part of the Terms of Serviceand applies where Customer Data contains personal data. The Customer is the controller and decides what personal data enters the platform and why; Cetruces LLC is the processor and acts on the Customer’s instructions.

Where the Customer is itself acting as a processor for one of its own clients, Cetruces acts as a subprocessor and this addendum applies accordingly.

Cetruces processes personal data only on the Customer’s documented instructions, which comprise this addendum, the Terms of Service, the platform configuration the Customer selects, and any further written instruction the Customer gives. We will inform the Customer if an instruction appears to conflict with applicable data-protection law.

• Individuals— the Customer’s employees and contractors, the Customer’s client contacts, and individuals named in incident reports.
• Personal data— identifiers and contact details, employment and role data, licenses and certifications, schedule and attendance records, event-based and on-duty location data, photographs, electronic signatures, and free-text report content.
• Sensitive data— where the Customer chooses to collect them, Social Security numbers and bank account details, which the platform encrypts at rest. Cetruces does not require any other special category of data and recommends against recording such data in free-text fields.
• Purpose and duration— processing is limited to providing and supporting the platform, for the duration of the subscription plus the wind-down period below.

Cetruces personnel with access to personal data are bound by written confidentiality obligations and are granted access on a need-to-know basis limited to what their role requires. Administrative access to sensitive records is logged.

Cetruces maintains the following technical and organizational measures:

• Encryption of personal data in transit using TLS.
• AES-256-GCM encryption at rest for Social Security numbers and bank account details, with keys held separately from the database.
• Authorization checks on every request, against the signed-in user’s account and role.
• Role-based access control within the account.
• Audit logging of significant, administrative, and export actions.
• Continuous database backups with point-in-time recovery, and redundant storage for uploaded files.

The Customer authorizes Cetruces to engage subprocessors for hosting, data and file storage, notification delivery, text and voice messaging, and support tooling. Cetruces imposes data-protection obligations no less protective than this addendum, remains responsible for their performance, and will give at least 30 days’ notice before adding or replacing a subprocessor. The Customer may object on reasonable data-protection grounds within that period. A current list is available on request.

Cetruces will not respond directly to a request from an individual concerning Customer Data, except to direct that person to the Customer. We provide reasonable assistance, including the platform’s own tools for access, correction, export, and deletion.

Cetruces will notify the Customer without undue delay after becoming aware of a personal data breach affecting that Customer’s data, and will provide the information reasonably available to us to assist the Customer’s own notification obligations, including what happened, the categories of data involved, and the steps taken.

On request, and no more than once per year absent a breach or a regulator’s requirement, Cetruces will provide the security information reasonably necessary to demonstrate compliance with this addendum and will respond to a reasonable security questionnaire. Where applicable law entitles the Customer to an on-site audit, it may be conducted subject to reasonable notice, scope, and confidentiality.

The Customer may export its data at any time during the subscription and for 30 days afterwards. After that window, Cetruces deletes or returns personal data at the Customer’s election within 90 days, except for copies required by law. Backups expire on their normal rotation schedule.

Cetruces processes personal data in the United States. Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland, the EU Standard Contractual Clauses (Module Two, or Module Three where Cetruces acts as subprocessor) are incorporated by reference, with the UK Addendum and Swiss amendments as applicable. This addendum supplements, and does not override, those clauses.