Data Processing Addendum

This Addendum forms part of the Agreement between CIRCLE SUITE LLC and the Customer when Circle Suite processes personal information on the Customer's behalf (“Customer Personal Data”). Terms such as controller, processor, business, service provider, and contractor have the meanings supplied by the applicable data-protection law. The actual processing determines the role; a contractual label does not override the facts.

The Customer determines the lawful purposes and instructions for processing Customer Personal Data. Circle Suite acts as a processor or service provider to the extent applicable. Circle Suite's separately disclosed own-purpose account, billing, security, and business-record processing is governed by the applicable law and Privacy Policy rather than treated automatically as processing solely on Customer instructions.

Circle Suite will process Customer Personal Data only on documented lawful Customer instructions to provide the agreed Services and as otherwise permitted or required by applicable law. The Agreement, enabled Customer configuration, and approved processing schedule document the ordinary instructions. We will inform the Customer where we reasonably believe an instruction infringes applicable data-protection requirements, subject to legal restrictions.

Where required for service-provider or contractor status, Circle Suite will not sell or share Customer Personal Data, retain/use/disclose it outside the specified service purposes or direct business relationship, or combine it with other data except as permitted by the applicable law and documented instructions. We will provide the applicable required certification of understanding and compliance in the released jurisdictional schedule. Independent AI-model training or advertising use is not authorized merely by the operational license in the Terms.

The Customer must provide required notices, obtain necessary permissions, and ensure instructions and data are lawful. The Customer must configure reasonable access and data minimization. The standard service does not authorize PHI, unsupported credential storage, or prohibited sensitive-data/AI uses. Additional regulated processing requires a separate approved arrangement and safeguards; it is not created by signing this Addendum alone.

Circle Suite will limit access to people who need it for an authorized purpose and are subject to appropriate confidentiality obligations. We will maintain reasonable documented safeguards appropriate to the processing, as specified in the verified security schedule, and take account of the nature of information, foreseeable risks, and applicable requirements. We will implement and maintain the safeguards actually promised; provider certifications alone do not establish Circle Suite certification.

The Customer authorizes only the subprocessors identified through the approved subprocessor schedule and applicable change procedure. Circle Suite will maintain appropriate written obligations for subprocessors, limit their access to authorized processing, and remain responsible for required subprocessor performance under applicable law and this Addendum. Independently connected Customer services are identified separately and are not automatically covered as Circle Suite subprocessors.

Taking account of the processing and available information, Circle Suite will reasonably assist the Customer with valid data-rights requests, assessments, audits, and other compliance obligations required by applicable law. Requests received directly about Customer-controlled data will be referred or coordinated appropriately, unless law requires an independent response. We will provide information sufficient to demonstrate compliance and permit legally required audits, using reasonable confidentiality, security, scope, and scheduling safeguards that do not eliminate required rights.

Extra assistance charges, if permitted, must be disclosed and agreed; we do not invent a fee that blocks a mandatory right or ordinary contractual assistance. A security review can use relevant documentation or independent assurance where appropriate; an audit provision must not grant unrestricted access to other customers' data or infrastructure we cannot legally open.

Circle Suite will notify the Customer of a personal-data breach affecting Customer Personal Data without undue delay after becoming aware, and within a shorter period if applicable law or an expressly agreed lawful requirement requires it. We will provide reasonably available information about the nature, affected information, likely consequences, and measures taken, and supplement material information as it becomes available. Notification is not an admission of liability. Circle Suite and the Customer will coordinate their respective legal notice duties; neither party's responsibility automatically displaces the other's.

At service end or on a valid documented instruction, Circle Suite will provide return or deletion of Customer Personal Data as required by applicable law and the approved exit schedule, subject to lawful retention. The schedule identifies supported formats and methods, nonportable assets, timing, restoration limits, and separately controlled resources. We will explain material technical constraints rather than promise an export of every asset.

Information retained for a legal obligation or in appropriately isolated backups remains safeguarded and restricted to the permitted purpose until deletion according to the verified schedule. Deletion must propagate appropriately to subprocessors and not be undone by a restoration. Consent and suppression evidence retained for legitimate legal purposes must be segregated from active marketing.

The approved schedule identifies relevant processing locations and any required safeguards. This U.S. launch does not establish U.S.-only processing. International customer expansion requires separate review. If the processing independently triggers another jurisdiction's law, that applicability must be assessed rather than excluded merely by a U.S. customer-address setting.

The jurisdictional schedule supplies any mandatory state service-provider/processor terms and relevant contractual safeguards. Nothing here claims blanket GDPR compliance, supplies an incomplete international transfer instrument, or treats a standard service as HIPAA-enabled.

This Addendum controls a conflict about processing Customer Personal Data. Liability and dispute provisions remain governed by the final Agreement only to the extent they are compatible with non-waivable privacy obligations.