Data Processing Addendum

1. Parties and roles

The customer is the controller of Customer Personal Data, or a processor authorized by another controller. Justin Marroquin, operating Aestro, operating Aestro, is the processor. Each party remains responsible for its own legal obligations.

2. Processing details

Subject and duration: providing Aestro for the customer's account term and the deletion or return period described below.

Nature and purpose: hosting, organizing, securing, backing up, displaying, searching, exporting, sharing at the customer's direction, and providing support for workspace records.

People: the customer's clients, prospective clients, crew, collaborators, employees, contractors, vendors, quote requesters, and other contacts whose information the customer enters.

Information: identity and contact details, professional roles, project and schedule records, notes, invoices and work-payment records, expense records and receipts, gear assignments, shared-link settings, support context, and files chosen by the customer. Aestro is not intended for special-category information and the customer must not enter it unless lawful and necessary safeguards are in place.

3. Customer instructions

Aestro will process Customer Personal Data only on documented customer instructions, including instructions expressed through product settings, imports, sharing choices, exports, support requests, and this DPA. Aestro will notify the customer if it believes an instruction violates applicable data-protection law unless prohibited from doing so.

4. Confidentiality and security

Aestro will limit access to people who need it to provide or secure the service and who are bound by confidentiality. Aestro maintains measures appropriate to the risk, including encrypted transport, authentication, workspace-scoped authorization, row-level database controls, protected server credentials, access-controlled storage, rate limits, security headers, backups, and tested private-sharing boundaries.

5. Subprocessors

The customer gives general authorization for the providers listed on the Subprocessors page. Aestro will require substantially equivalent data-protection obligations, remain responsible for their performance to the extent required by law, provide advance notice of material additions where practical, and consider reasonable objections.

6. Individual rights and compliance assistance

Taking into account the nature of the processing, Aestro will provide reasonable technical and organizational assistance so the customer can respond to access, correction, deletion, restriction, objection, and portability requests. Aestro will also reasonably assist with security, breach notification, impact assessments, and regulator consultations, considering the information available to Aestro.

7. Security incidents

Aestro will notify the affected customer without undue delay after confirming a personal-data breach involving Customer Personal Data. Notice will describe the known nature, likely consequences, affected information, and mitigation as information becomes available. Notification is not an admission of fault.

8. Return and deletion

Customers can export workspace information during the service term. On verified account deletion or termination, Aestro will delete Customer Personal Data from active systems unless law requires retention. Residual encrypted backups will age out under the Privacy Policy. The customer remains responsible for copies it exported or disclosed.

9. International transfers

If Customer Personal Data protected by the GDPR is transferred to a country without an adequacy decision, the applicable 2021 European Commission Standard Contractual Clauses are incorporated by reference: Module Two when the customer is a controller, or Module Three when the customer is a processor. The customer is exporter, Aestro is importer, optional docking applies, the law of the EU member state where the customer is established governs where it allows third-party beneficiary rights, and the competent authority is determined under Clause 13.

Annex I.A: the exporter is the customer identified by its Aestro account and workspace details; the importer is Justin Marroquin, operating Aestro, operating Aestro, at the configured business address, using the configured privacy contact. Each party is deemed to sign the Clauses when it accepts this DPA.

Annex I.B: the people, information, nature, and purposes are described in section 2. Transfers occur continuously as instructed through the service for the account term and deletion period. No special-category data is intended. The purpose is to provide, secure, support, and delete the customer workspace.

Annex I.C: the competent authority is determined under Clause 13. Annex II is the security description in section 4 and the current technical measures documented for Aestro. Annex III is the Subprocessors page.

10. Information and audits

Aestro will make information reasonably necessary to demonstrate Article 28 compliance available to the customer. The parties will first use current policies, provider reports, questionnaires, and independent assurance. If those are insufficient, the customer may request a proportionate audit no more than once annually, or after a confirmed incident, with reasonable notice and protections for other customers, security, confidentiality, and service continuity.

11. Priority and contact

If this DPA conflicts with the Terms about processing Customer Personal Data, this DPA controls. The Standard Contractual Clauses control over conflicting terms where they apply. Questions should be sent to the configured Aestro privacy contact.