Data Processing Addendum
This addendum describes the processing commitments of Sansa Group AB, acting through its Sansa Vision subdivision, when HoloSignal processes personal data on a customer's behalf. The applicable order form must be completed before execution.
01
Roles and instructions
The customer is the controller or processor that determines the permitted purpose and scope. HoloSignal acts as processor or subprocessor for customer content and processes it only on documented instructions, including the service agreement, workspace policies and lawful support requests.
The customer is responsible for lawful instructions, notices, rights, source access and any special-category-data basis. HoloSignal will promptly disclose an instruction it reasonably believes violates applicable data-protection law unless prohibited from doing so.
02
Confidentiality and security
Personnel and subprocessors with access are bound by confidentiality. HoloSignal applies access control, tenant-scoped storage and retrieval, encrypted transport, secret isolation, audit trails, network egress controls, approval-bound writes, vulnerability management and incident response appropriate to the risk.
03
Subprocessors and transfers
The current subprocessor notice identifies purpose and processing location. HoloSignal remains responsible for subprocessor obligations to the extent required by law and provides notice of material additions so customers can raise a reasoned objection.
Where a restricted transfer occurs, the parties will use an applicable transfer mechanism, including the EU Standard Contractual Clauses where appropriate, plus supplementary measures reflected in the service configuration.
04
Rights, incidents and assessments
Taking account of the nature of processing, HoloSignal assists with verified data-subject requests, security assessments, breach obligations, DPIAs and regulator consultations through product controls and reasonably available information.
HoloSignal will notify the customer without undue delay after confirming a personal-data breach affecting customer content and will provide material facts as they become available.
05
Return, deletion and audit
During the service term, administrators can request portable exports. At termination or on lawful instruction, HoloSignal deletes or returns customer personal data subject to documented retention, backup expiry and legal obligations.
HoloSignal provides current security documentation and audit information reasonably necessary to demonstrate compliance. Any additional audit must protect other customers, security and confidentiality and avoid unreasonable disruption.
Questions or requests?
Email privacy@holosignal.xyz or use the privacy controls in your workspace. General support is available at support@holosignal.xyz.