Data Processing Addendum

1. Roles

For customer content and personal information processed on behalf of the customer, the customer remains responsible for determining the purposes and permitted use of the information. Gotekky acts as a service provider or processor only to the extent necessary to deliver the agreed services.

2. Processing Instructions

Gotekky will process personal information only on documented customer instructions, as required to provide the services, as needed for security and support, or as otherwise required by law.

3. Confidentiality

Gotekky personnel with access to customer personal information are bound by confidentiality obligations appropriate to their role.

4. Security Measures

Gotekky maintains administrative, organizational, and technical measures appropriate to the nature of the services, the sensitivity of the information, and the risks reasonably associated with processing.

5. Subprocessors and Service Providers

Gotekky may use sub-processors and service providers to operate the business, including infrastructure, data center, software, support, monitoring, communications, and payment vendors. Where personal information is entrusted to a third party, Gotekky uses written terms appropriate to the service and legal context.

6. Confidentiality Incidents

If Gotekky becomes aware of a confidentiality incident involving customer personal information and requiring notification under applicable law, Gotekky will notify the customer without undue delay after confirming the incident and gathering enough information to provide a meaningful notice.

7. Assistance

Where reasonable and appropriate, Gotekky will assist the customer with privacy-related requests, security questions, or regulator-facing issues that directly relate to the services, subject to cost recovery where the work is outside standard support scope.

8. Return and Deletion

Upon termination of the relevant services, Gotekky will handle customer data in accordance with the service agreement, operational retention practices, and applicable law. Customers remain responsible for exporting their own data where needed before service termination.

9. Priority

If this Addendum conflicts with a signed service order or statement of work dealing specifically with data processing, the more specific signed document controls to the extent of the conflict.