Data Processing Addendum

• Subject matter: running the SuperHQ workspace for your business.
• Duration: while your workspace is open, plus the deletion period in section 8.
• Nature and purpose: storing, syncing, displaying, searching and sending your data; AI reading and drafting by Pal; fraud and abuse checks your workspace switches on.
• People concerned: your customers, leads, members and contacts, and your own team.
• Kinds of data: contact details, account and usage records synced from your systems, conversations and email, files and recordings, payment and subscription details read from your payment provider, and sign-in signals such as IP address and device. You decide what to bring in. Please don't bring in special-category data (health, biometrics, beliefs) unless you need it and have a legal basis for it.

We process your data only to provide SuperHQ as you configure and use it, which is your documented instruction. If we believe an instruction breaks data-protection law, we will tell you. Actions Pal proposes run only once someone on your team approves them.

Everyone at Plutio Ventures FZE LLC with access to your data is bound to keep it confidential.

• Encryption in transit; encryption at rest by our database provider.
• Every record belongs to one workspace, and access is checked against the workspace.
• Production access limited to the people who run the service.
• Captcha and rate limits on sign-up and sign-in.
• Proposed-then-approved actions, so nothing is sent or changed in your name without approval.

You authorise the subprocessors on the Subprocessors page. Each is bound by data-protection terms at least as protective as these. We give 30 days' notice of a new one; if you object on reasonable grounds and we can't resolve it, you can close your workspace. We remain responsible for our subprocessors.

Your data is hosted in London, United Kingdom. Where a subprocessor processes it outside the UK, the EEA or the UAE (for example AI processing in the United States), the transfer relies on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or an equivalent safeguard under the UAE Personal Data Protection Law.

• We help you answer requests from people exercising their rights (access, correction, deletion, portability).
• We tell you without undue delay, and within 72 hours of confirming it, about a personal-data breach affecting your data.
• We help with data-protection impact assessments where our part of the processing matters.

When your workspace closes, ask us at hello@getsuperhq.com and we will return a copy of your data and then delete it within 30 days, including from backups as they expire, unless the law requires us to keep something.

We will answer reasonable written questions about how we protect your data and make available the information needed to show we meet this addendum. Write to hello@getsuperhq.com.

If this addendum and the Terms of Service disagree about personal data, this addendum wins.