Data Processing Addendum

This page is Outborn's public reference Data Processing Addendum (DPA). It becomes contractually binding only when an applicable Outborn service agreement, order form, online agreement, or signed DPA expressly incorporates it. It does not create a processor relationship for a website visitor by itself.

The DPA applies when Outborn Group Co., Ltd. processes personal data on behalf of a customer in connection with covered Outborn services. The customer is the controller or a processor acting for another controller, and Outborn is the processor or subprocessor, as applicable.

Outborn will process customer personal data only to provide, secure, support, maintain, and improve the contracted service in accordance with the customer's documented instructions, the agreement, product configuration, and applicable law. If law requires processing beyond those instructions, Outborn will inform the customer before processing unless the law prohibits that notice.

The subject matter, duration, nature, and purpose of processing depend on the subscribed products and configuration. Processing can include collection, storage, organization, retrieval, transmission, hosting, analysis, communication delivery, automated processing, support, deletion, and other operations necessary for the requested service.

• Data subjects can include customer personnel, administrators, end users, applicants, customers, contacts, suppliers, invitees, recipients, and other people whose data the customer places in the service.
• Personal data can include identity/contact information, account/authentication data, workspace records, files, communications, HR/CRM/finance-related data, usage/security metadata, AI prompts/context, browser context where enabled, and other customer-provided data.
• Sensitive data may be processed only where the subscribed product supports it and the customer has an appropriate legal basis and configuration.

Outborn will ensure that people authorized to process customer personal data are subject to confidentiality obligations and access it only as needed for their duties. Access controls, tenant boundaries, role-based permissions, authentication, logging, and other safeguards are applied according to the service and risk.

Outborn will maintain technical and organizational measures appropriate to the risk, taking into account the state of the art, implementation costs, processing context, and risks to affected people. Measures can include encryption in transit and at rest where applicable, least-privilege access, secret protection, secure development practices, logging and monitoring, backups, vulnerability remediation, tenant separation, and incident response.

Security information reasonably necessary for a customer's assessment can be provided under appropriate confidentiality conditions. Outborn does not represent that any particular certification applies unless Outborn expressly states that certification for the relevant service and period.

The customer grants Outborn general authorization to use subprocessors needed to provide the service, subject to the agreement and applicable law. Outborn remains responsible for imposing data-protection obligations on subprocessors that are appropriate to the processing they perform.

Material centrally managed subprocessors are listed on the Outborn Subprocessors page. Where the agreement or applicable law requires advance notice of additions or replacements, Outborn will provide notice through the agreed channel and handle objections in accordance with the agreement.

Taking into account the nature of processing and information available to Outborn, Outborn will provide reasonable assistance required by the applicable agreement or law for customer obligations concerning access, correction, deletion, restriction, portability, objection, automated decision rights, security, breach assessment, data-protection impact assessments, and regulator consultations.

If Outborn receives a rights request relating to customer-controlled data, Outborn may direct the requester to the customer and will not independently act on the request except as permitted by the agreement or required by law.

If Outborn becomes aware of a personal-data breach affecting customer personal data, Outborn will investigate and mitigate the incident and notify the customer without undue delay as required by applicable law and the agreement. Outborn will provide information reasonably available about the nature of the incident, affected data, likely consequences, and remediation so the customer can assess its own notification duties.

At the end of the service or on a valid customer instruction, Outborn will return or delete eligible customer personal data according to the agreement, product capabilities, legal requirements, and documented retention controls. Data that must be retained by law or for a valid legal hold will be isolated from ordinary processing where appropriate.

Deletion from backups follows the applicable backup rotation. If a backup containing deleted data is restored for disaster recovery, the restored data remains subject to the applicable deletion and access controls.

Outborn will use an appropriate transfer mechanism where customer personal data is transferred to a country and applicable law requires safeguards. Depending on the transfer, this may include recognized standard contractual clauses, contractual safeguards, adequacy mechanisms, approved frameworks, or another lawful transfer basis.

The Outborn Subprocessors page and Privacy Policy describe material processing locations and how to request product-specific transfer information.

Outborn will make information reasonably necessary to demonstrate compliance with applicable processor obligations available to the customer, subject to reasonable confidentiality, security, scope, frequency, and cost protections. Where required by the agreement or law, this can include questionnaires, documentation, independent reports if available, or a proportionate audit process.

The customer must use audit rights in a way that avoids unnecessary disruption, exposure of other customers' information, or weakening service security.

The customer is responsible for its instructions, lawfulness and transparency of processing, accuracy and minimization of data, account administration, user permissions, retention configuration, and responding to data subjects when it is the controller. The customer must not instruct Outborn to process data in a way that violates applicable law or the service agreement.

If this DPA is incorporated into an agreement and conflicts with the agreement on protection of customer personal data, the executed or incorporated DPA controls to the extent specified by that agreement. Mandatory transfer clauses, where applicable, take precedence to the extent required by law.

For an executed copy, customer-specific processing details, transfer safeguards, or privacy questions, contact [email protected].