Data Processing Addendum (Business Users)

1. Roles and Subject Matter

The Business User is the controller for personal data entered into the workspace; Planicas LLC processes it only to provide the service under the Terms of Service and the User's documented instructions (use of the service). The controller is responsible for the lawfulness of the data (notice, legal basis).

2. Processor's Obligations

• Not to use data outside instructions; to bind authorised persons to confidentiality
• To apply the technical and organisational measures in the Security Policy
• To use sub-processors only under written contract with equivalent protection; the current list is on the Sub-processors page, changes are notified 30 days ahead with a reasonable right to object
• To assist the controller, as far as possible, with data subject requests
• To notify the controller of a personal data breach without undue delay and within 48 hours of becoming aware
• On termination, to return and delete data per the switching terms below
• To provide reasonable information demonstrating compliance and allow reasonable audits

3. International Transfers

Data is processed in the regions shown on the Sub-processors page. For transfers from the EU/EEA/UK the Standard Contractual Clauses apply; for transfers from Türkiye the KVKK Art. 9 mechanisms apply.

4. Switching and Data Portability (EU Data Act)

The Business User may terminate on no more than 2 months' notice to switch to another provider or its own infrastructure; the subscription is monthly and cancellable at any time anyway.

On a switching request: you can obtain your account records at any time in a structured, commonly used, machine-readable format (JSON) via the export feature in account settings; you can download uploaded files from the Documents page or request them at contact@varnevo.com. If further help is needed, support completes the switch within 30 days. At least 30 days of access for export is allowed after the switch, after which data is deleted under the deletion policy.

No switching charges are made.

5. Term and Deletion

This Addendum applies for as long as the service continues. On termination data is deleted under the Data Retention and Deletion Policy, except where a legal retention obligation exists.