Data Processing Addendum

This Data Processing Addendum (the DPA) sets out how RSM Software processes personal data on behalf of the companies that use Tideward, as Article 28 of the GDPR requires. It forms part of the Terms of Service for every company customer and applies automatically when a company accepts them.

If you use Tideward as a seafarer for yourself, this DPA does not apply to you. Our Privacy Policy explains how we handle your data.

1. Parties and scope

1.1 The parties

• RSM Software, we, us and our mean Rogue Star Marine Software Ltd, trading as RSM Software, a company registered in the Republic of Cyprus under number HE496769, with its registered office at Pavlou Aggelinide 21, 3110 Limassol, Cyprus. Tideward is RSM Software's product.
• The Customer or you means the company or other organisation that holds a company Tenant on Tideward, such as a manning agency, maritime operator, port agent or fleet owner, on a free or a paid plan.

1.2 When this DPA applies

This DPA applies whenever we process Customer Personal Data in providing the Service to you, and for as long as we do so. It applies to free and paid plans alike.

1.3 How this DPA is agreed

This DPA is part of the Terms. By accepting the Terms for your company you also enter into this DPA, and no separate signature is needed. If you would like a copy signed by both parties for your records, write to legal@rsm-software.com.

If your company has signed an order form or a master services agreement with us that contains its own data processing terms, those signed terms prevail over this DPA where the two differ.

2. Definitions

Words used in this DPA and not defined here, such as controller, processor, data subject, personal data, processing and supervisory authority, have the meanings given in the GDPR.

• Administrators are the Users who hold the administrator role in the Customer Tenant.
• Customer Personal Data means personal data that we process on your behalf, as your processor, in providing the Service. Section 3 and Annex 1 describe it.
• Customer Tenant means your company Tenant, together with any Tenant you own or manage through the Service to the extent of your role in it, such as an Unclaimed Tenant you entered or a vessel Tenant you own or manage.
• Data Protection Law means the GDPR, the Cyprus Law providing for the Protection of Natural Persons with regard to the Processing of Personal Data and for the Free Movement of such Data (Law 125(I)/2018), and any other data protection law that applies to the processing under this DPA, including the UK GDPR where it applies.
• GDPR means Regulation (EU) 2016/679.
• Personal Data Breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• Pool means your register of memberships in the Service: the seafarers, vessels and companies you work with.
• SCCs means the standard contractual clauses for transfers of personal data to third countries set out in the Annex to Commission Implementing Decision (EU) 2021/914.
• Service means the Tideward platform, its portals, its API and the related services we provide under the Terms.
• Sub-processor means another processor that we engage to process Customer Personal Data.
• Tenant means an account space on Tideward. Every seafarer, every company and every vessel on Tideward is a Tenant, and every User belongs to one or more Tenants.
• Terms means the Tideward Terms of Service or, where one has been signed, the order form or master services agreement between you and us.
• Unclaimed Tenant means a seafarer or company Tenant that you entered in the Service and that the person or company it represents has not yet claimed.
• Users means the people you authorise to use the Service under the Customer Tenant, including your staff and, where you use a vessel portal, the crew you give access to.

3. The roles of the parties

3.1 You are the controller and we are your processor

For the records held in the Customer Tenant, you are the controller and we are your processor. This includes:

• your Users and their accounts as they are used within your Tenant;
• the crew files and other records you create or upload, including documents you hold, assignments, contracts, crew changes, appraisals, rest-hour records, payroll, allotments, and P&I and welfare cases;
• Unclaimed Tenants you entered, until they are claimed;
• your Pools and the relationships recorded in them;
• your side of any record you share with another Tenant; and
• for port agents, the appointments, expenses and invoices you handle, and for fleet owners, your fleet register and the information you see about your vessels.

Where you are yourself a processor for another controller, for example a manning agency acting for a shipowner, we are your sub-processor. You confirm that your controller has authorised our engagement on the terms of this DPA, and you pass its instructions and any information it needs between us.

3.2 Shared records

Tideward is a shared record by design: the same person, company or vessel exists on the platform once, and several Tenants can work with the same record. Where a record concerns you and another Tenant, for example a crewing contract or a sea-service record shared with a seafarer, both of you can read it. We process your side of that record on your behalf under this DPA, and we process the other Tenant's side under that Tenant's own arrangements with us. Neither of you is responsible for the other's processing.

3.3 Where we are a controller

Some processing is ours as controller. It is described in our Privacy Policy and is not covered by this DPA:

• account, billing and payment data for your subscription, and our communications with you about the Service;
• sign-in, security, fraud-prevention and audit data we need to run and protect the Service, and the record of each User's acceptance of the Mediator & employment notice;
• a seafarer's own Tenant once the seafarer has signed up or claimed it. The seafarer decides what they share with you: joining your Pool needs the seafarer's consent, and a profile-share link shows only the fields the seafarer chooses and can be revoked by them; and
• job adverts sourced from third-party job boards, and the messages we send to recruiters named on those adverts.

When a seafarer or another Tenant makes personal data available to you through the Service, you are a controller of your own use of that data.

3.4 When an Unclaimed Tenant is claimed

When the person or company that an Unclaimed Tenant represents claims it, control of that Tenant passes to them. From then on we process that Tenant's own profile for its owner rather than for you. You keep the records held in your own Tenant, and you keep the relationship recorded in your Pool subject to the consent the Service asks of the seafarer.

3.5 Tideward is a mediator, not an employer

We are not the employer of any seafarer, and we do not decide who is recruited, assigned or employed. Those decisions, and the processing they involve, are yours. The Mediator & employment notice says this in full.

4. Your responsibilities as controller

You are responsible for:

1. having a lawful basis for the Customer Personal Data you enter into the Service or instruct us to process, including a condition under Article 9 of the GDPR for health data such as occupational medical fitness records;
2. giving the people whose data you enter the information that Articles 13 and 14 of the GDPR require, including seafarers, their next of kin and allotment beneficiaries. Our Privacy Policy is shown to people who sign up to Tideward themselves, but it does not replace your own notice, and the Service does not send notices on your behalf;
3. the accuracy of the data you enter, and checking any existing record the Service suggests before you create a new one, so that the same person or company is not entered twice;
4. managing your Users, their roles and permissions, keeping their credentials secure, and removing access for people who leave;
5. using the Service's sharing features, such as Pools, port agent appointments, document access grants and shared records, only as your lawful basis allows;
6. using the medical features for occupational fitness evidence only. The Service is not designed for clinical treatment records, and you should not store such records in it beyond what crew operations need;
7. deciding how long records must be kept under the rules that apply to you, such as the Maritime Labour Convention, flag-state, ISM, payroll and tax rules and limitation periods, and instructing us accordingly; and
8. following our Acceptable Use Policy.

Your instructions to us must comply with Data Protection Law.

5. Our obligations as your processor

5.1 Processing only on your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are:

• the Terms and this DPA;
• your use and configuration of the Service by your Users, for example entering data, adding members to a Pool, appointing a port agent, sharing a document, granting or revoking access, setting a document's retention or legal hold, and requesting the erasure of a document; and
• any other written instructions we agree with you.

You instruct us to operate Tideward as a shared record, which includes making your data available to other Tenants as you direct and, where the Service does so, checking new entries against the Tenants already on the platform to avoid duplicates.

If EU or Member State law requires us to process Customer Personal Data in any other way, we will tell you before we do so, unless that law prohibits it. We will tell you promptly if, in our opinion, an instruction infringes Data Protection Law. We are not obliged to carry out an instruction that goes beyond the functions of the Service unless we have agreed to it.

5.2 No other use

We do not sell Customer Personal Data. We do not use it for our own purposes, for advertising or for profiling, and we do not use it to train models or to improve the Service for other customers. Corrections your Users make to text the Service reads from documents are stored for your Tenant only and are not shared with any other Tenant.

5.3 Confidentiality

Everyone at RSM Software who is authorised to process Customer Personal Data is bound by a duty of confidentiality, by contract or by law, and has access only as far as needed to provide, support and secure the Service or to follow your instructions.

5.4 Access by our operators

Our platform operators reach a Tenant's data through operator tools that act on one Tenant at a time. When an operator reads a Tenant's data, the tools open it read-only, and any change an operator makes is recorded in the audit trail under that operator's own identity.

6. Security of processing

6.1 Our measures

We implement the technical and organisational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, taking account of the nature of the data, including health data and bank details. We may change these measures over time, provided the overall level of protection is not reduced.

6.2 Your part

You are responsible for the security of your own use of the Service: the roles and permissions you give your Users, the use of multi-factor authentication, the devices your Users work from, and any data you download or export out of the Service.

6.3 No certification

RSM Software does not hold a security certification such as ISO/IEC 27001 or a SOC 2 report. The certifications of our hosting provider cover the infrastructure it provides, not RSM Software's own operations.

7. Sub-processors

7.1 General authorisation

You give us general authorisation to engage Sub-processors. The current list is on our Sub-processors page, which forms part of this DPA. Sub-processors marked there as optional receive Customer Personal Data only when they are switched on, and we switch one on for your data only at your request or after giving you notice under section 7.3.

7.2 Our contracts with Sub-processors

We engage each Sub-processor under a written contract that imposes data protection obligations no less protective than those in this DPA, as far as they apply to the service that Sub-processor provides. We remain fully liable to you for the performance of each Sub-processor's obligations.

7.3 Notice of changes

At least 30 days before a new Sub-processor begins to process Customer Personal Data, we will update the Sub-processors page and email your Administrators.

7.4 Your right to object

You may object to a new Sub-processor within the notice period, on reasonable grounds relating to data protection, by writing to dpo@rsm-software.com. We will discuss your concern in good faith and may propose an alternative. If we cannot resolve it, you may cancel your subscription so that it ends before the change takes effect. Paid plans are billed monthly and the notice period is at least 30 days, so this is normally possible without losing paid time. If the change takes effect before the end of a month you have already paid for, we will refund the fees for the rest of that month, as an exception to our Refund and cancellation policy.

7.5 Urgent replacement

If a Sub-processor must be replaced urgently to protect Customer Personal Data or to keep the Service running, for example after a security incident or because a provider stops its service, we may make the change with shorter notice. We will tell your Administrators as soon as we can, and your right to object under section 7.4 still applies.

8. International transfers

8.1 Where your data is kept

We host Customer Personal Data in the European Union, in the Amazon Web Services Europe (Ireland) region. The application, its database, file storage, our identity service, outgoing email and the optional Amazon Textract text reading all run there.

8.2 Transfers we make

We transfer Customer Personal Data outside the European Economic Area only to Sub-processors on our Sub-processors page with the safeguard shown there, on your instructions, or where EU or Member State law requires it. Any transfer to a country without an adequacy decision is covered by the SCCs or another safeguard under Article 46 of the GDPR.

8.3 Transfers you direct

When you or your Users use the Service from outside the European Economic Area, or use it to share data with a Tenant established outside it, such as a manning agency abroad or a port agent at a foreign port, that disclosure is made on your instructions and you are responsible for its lawfulness.

8.4 Customers outside the European Economic Area

If you are established in a country that is not covered by an adequacy decision and the GDPR applies to our processing, Module Four (processor to controller) of the SCCs applies between us, with RSM Software as data exporter and you as data importer, and is incorporated into this DPA by reference.

8.5 How the SCCs are completed

Wherever the SCCs apply under this DPA:

• the optional docking clause in Clause 7 applies;
• for Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 7.3;
• the optional wording in Clause 11 does not apply;
• for Clause 13, where it applies, the competent supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus;
• for Clauses 17 and 18, the SCCs are governed by the law of the Republic of Cyprus and disputes go to the courts of the Republic of Cyprus;
• Annex I of the SCCs is completed by section 1.1 and Annex 1 of this DPA, Annex II by Annex 2, and Annex III by the Sub-processors page; and
• if the SCCs conflict with this DPA, the SCCs prevail.

Where the UK GDPR applies to a transfer, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner applies, completed with the information in this DPA. Where Swiss data protection law applies, the SCCs apply with the adjustments that law requires.

9. Help with data subject requests

9.1 Functions in the Service

You can use the Service to respond to most requests yourself. Users with the right permissions can view and correct the records in your Tenant, suspend or disable a User's membership, remove a member from a Pool, download documents, use the exports a module offers, and request the erasure of a document you hold. An erased document is archived and its file is removed from the Service by the nightly retention run, unless a legal hold applies to it. The document's recorded details, such as its number, its dates and the fields entered for it, stay in your Tenant until your Users remove them or you instruct us under section 11.4.

9.2 What the Service does not do

The Service does not assemble a single access or portability package across all of its modules. The account export a User can download covers that User's account details only. The "delete account" control in the product deactivates the login; it does not erase crew records, documents, payroll records or audit entries.

9.3 Requests that reach us

If a data subject contacts us about Customer Personal Data, we will not answer the request ourselves, apart from telling the person to contact you where we can identify you, and we will pass the request on to you without undue delay.

9.4 Further help

Taking into account the nature of the processing, we will help you meet your obligations to data subjects as far as we reasonably can. On your documented instruction we will assist with the exports the Service already provides and with steps you define, such as compiling data from several modules, or carrying out an erasure or anonymisation that we have agreed with you can be done without breaching a legal retention requirement. Where the help you ask for goes beyond the functions of the Service, we may charge a reasonable fee, which we will agree with you before we start.

10. Personal data breaches, impact assessments and consultation

10.1 Telling you about a breach

We will notify you without undue delay after becoming aware of a Personal Data Breach, by email to your Administrators. As far as the information is available at the time, and in stages where it is not, our notice will describe:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• its likely consequences;
• the measures we have taken or propose to take to address it and to reduce its effects; and
• a contact for further information, normally dpo@rsm-software.com.

We will take reasonable steps to contain and investigate the breach and will keep you informed. You decide whether to notify a supervisory authority or the people affected; we will not do so on your behalf unless we agree it with you or the law requires us to. Our notice of a breach is not an admission of fault or liability.

10.2 Impact assessments and prior consultation

Taking into account the nature of the processing and the information available to us, we will give you reasonable information about the Service to help you carry out a data protection impact assessment, or to consult a supervisory authority before processing, where the GDPR requires it.

11. Retention, return and deletion

11.1 While your Tenant is in use

Customer Personal Data is kept while your Tenant exists, unless your Users change or delete it through the Service. Documents follow a retention schedule, whose period runs from the date a document is archived or its erasure is requested; a document that is never archived has no retention date until one is set. Each document can carry a retention date and a legal hold, which your Users with the right permissions can set. After the retention date has passed, the nightly retention run removes the document's file, and the text read from it, from the Service unless a legal hold applies. A short record of the removed version remains, showing that it existed, its size and fingerprint, and when its file was removed. The document's recorded details, such as its number, its dates, its issuer and the fields entered for it, are not removed with the file.

11.2 Deactivating a login is not erasure

Deactivating a login, whether a User does it with the "delete account" control or an Administrator disables a User's membership, marks that membership as disabled. It is not erasure. The following stay in your Tenant after a login is deactivated, unless you instruct otherwise under section 11.4:

• seafarer identity and contact details;
• next-of-kin and emergency-contact records;
• documents and their files;
• rest-hour records, complaints, assignments and sea-service history;
• payroll records, bank details, payslips and contracts;
• P&I and welfare case records; and
• audit-trail entries.

We do not delete crew records or files automatically when a login is deactivated.

11.3 When a paid subscription ends

When a paid subscription ends, whether because it expired, was cancelled or was not paid, the plan's modules are hidden after the paid-through date. Your data is not deleted at that point and becomes available again if you subscribe again. We do not currently delete a Tenant's data automatically after a subscription ends. You should export anything you need before your paid period ends, using the exports the Service's modules offer.

11.4 Return or deletion on request

When we stop providing the Service to you, one of your Administrators may ask us, by writing to dpo@rsm-software.com, to do either of the following:

1. return your Customer Personal Data, by providing it in the formats the Service's exports use; or
2. delete your Customer Personal Data.

We will do so within 90 days of your request, unless we agree a different timetable with you, and we will confirm in writing when it is done. The following are not deleted:

• data that EU or Member State law requires us to keep;
• records that another Tenant also holds or co-owns, Tenants that have been claimed by the person or company they represent, and Tenants that other customers also hold in their Pools. For these, your access and your membership end instead;
• audit-trail entries, which are append-only. We keep them with restricted access, for security, for accountability and to establish or defend legal claims; and
• backups, which expire on their normal rolling cycle, and the recovery copies of earlier file versions that our file store keeps. Both are used only to restore data after a failure or an accidental deletion.

Anything we keep for these reasons stays protected by this DPA, and we do not process it for any other purpose.

12. Information and audits

12.1 Information

We will make available to you the information needed to demonstrate that we meet our obligations under Article 28 of the GDPR. That includes this DPA and its annexes, the Sub-processors page, written answers to a reasonable security questionnaire once in any 12 months, and summaries of our Sub-processors' own audit reports and certifications where they are available to us.

12.2 Audits

If that information is not enough to demonstrate compliance, if a supervisory authority requires it, or after a Personal Data Breach, you may audit our compliance with this DPA yourself or through an independent auditor who is bound by confidentiality and is not our competitor. Unless a supervisory authority or a Personal Data Breach requires otherwise:

1. you will give us at least 30 days' written notice and agree the scope with us in advance;
2. audits take place no more than once in any 12 months, during normal business hours, with as little disruption as possible;
3. the audit will not give access to other customers' data, or to information whose disclosure would put the security of the Service at risk; and
4. you bear the cost of the audit, and we may charge for our reasonable time where supporting it takes more than one working day.

We meet audit requests that concern our Sub-processors by providing their audit reports or certifications.

12.3 Supervisory authorities

Nothing in this section limits the powers of a supervisory authority.

13. Liability

Each party's liability arising out of or in connection with this DPA is subject to the limitations and exclusions of liability in the Terms. The cap on liability in the Terms applies to all claims under the Terms and this DPA taken together; this DPA does not create a separate or additional cap. Nothing in this DPA limits either party's liability to data subjects under Article 82 of the GDPR, or any liability that the law does not allow to be limited.

14. Duration

This DPA stays in force for as long as we process Customer Personal Data, including after the Terms end, until that data has been returned or deleted under section 11. Provisions that by their nature should continue after it ends, such as confidentiality and liability, continue.

15. Changes to this DPA

We may update this DPA to reflect changes in the law, in regulators' guidance, in the Service or in our Sub-processors. We will give at least 30 days' notice of a material change, by email to your Administrators and by publishing the new version on this page. We will not change this DPA in a way that lowers the protection of Customer Personal Data, unless the law requires it. Changes to Sub-processors follow section 7.

16. Order of precedence, law and contact

16.1 Order of precedence

Where they apply, the SCCs prevail over this DPA. This DPA prevails over the rest of the Terms on any matter of personal data processing, except that the data processing terms of an order form or master services agreement signed by both parties prevail over this DPA, as section 1.3 explains.

16.2 Governing law and courts

This DPA is governed by the law of the Republic of Cyprus, and the courts of the Republic of Cyprus have jurisdiction over any dispute arising from it, except where the SCCs provide otherwise.

16.3 Contact

• Data protection matters under this DPA: dpo@rsm-software.com
• Contract and legal notices: legal@rsm-software.com

Our lead supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus.

Annex 1 — Description of the processing

Subject matter

The provision of the Tideward Service to the Customer under the Terms.

Duration

For the term of the Customer's use of the Service, and afterwards until the Customer Personal Data is returned or deleted under section 11.

Nature of the processing

• hosting, storage and backup;
• organising and structuring records, and displaying them to authorised Users;
• making records available to other Tenants as the Customer directs, through Pools, appointments, access grants and shared records;
• where the Service does so, comparing new entries with the Tenants already on the platform to avoid duplicates;
• reading text from uploaded documents to fill in their details (by default inside the Service itself, and through an optional Sub-processor only when switched on);
• generating documents, such as PDFs, from the Customer's records;
• sending email notifications and invitations;
• applying retention dates and legal holds, and removing files when their retention ends; and
• security monitoring, logging, audit and support.

Purposes

To provide the Service to the Customer as described in the Terms, to support the Customer and its Users, to keep the Service secure, and to comply with the law.

Categories of data subjects

• the Customer's Users;
• seafarers the Customer works with or considers, including crew, candidates and applicants, whether in Unclaimed Tenants the Customer entered or in records shared with the Customer;
• seafarers' next of kin and emergency contacts;
• beneficiaries of seafarers' allotments;
• contacts at other companies the Customer works with, such as principals, managers, owners, port agents, training providers and suppliers; and
• other people named in the Customer's records, such as people mentioned in an incident report or a P&I case.

Categories of personal data

• identity: name, date of birth, nationality and photograph;
• contact details: email address, telephone numbers, postal address, messaging and social profile handles, and home airport;
• identity documents and certificates: passports, seafarer's books, visas, certificates of competency and proficiency, and training records, including document numbers, machine-readable zones and the text read from them;
• employment and career: rank, availability, sea service, assignments, contracts, crew changes, appraisals, evaluations, training and salary offers;
• working time: rest-hour and work-hour records;
• pay: payroll and payslip data, wages and allotments, and the bank details of seafarers and beneficiaries, such as IBAN, account number, BIC or SWIFT code and account holder name;
• health: occupational medical fitness records and vaccination records; blood type, vision aid, colour vision, hearing aid, allergies and dietary requirements; and P&I and welfare records about illness or injury;
• clothing and equipment sizes, height and weight;
• travel: crew-change travel and port appointment details;
• communications: messages, notifications and support requests;
• next of kin: name, relationship, contact details and address; and
• account and technical data: User name, email address, role and permissions, sign-in and session data, multi-factor authentication status, audit-trail entries and document access records.

Special categories of data and extra safeguards

The Customer Personal Data includes data concerning health within Article 9 of the GDPR: occupational medical fitness records and vaccination records; blood type, vision aid, colour vision, hearing aid, allergies and dietary requirements; and P&I and welfare records about illness or injury. The purpose is evidence for crew operations, not diagnosis or treatment; Tideward does not diagnose, treat or certify medical fitness. Access follows the Customer's roles and permissions; documents are opened only through the Service's authenticated access, for the Tenant that holds them and those it grants; views and downloads of documents are recorded; and the account export a User can download does not include medical documents.

Bank details are not a special category, but they are sensitive. They are shown masked in lists.

Frequency

Continuous, for as long as the Customer uses the Service.

Retention

As set out in section 11.

Sub-processors

As listed on the Sub-processors page.

Competent supervisory authority

The Commissioner for Personal Data Protection of the Republic of Cyprus.

Annex 2 — Technical and organisational measures

Hosting and network

• The Service runs on Amazon Web Services in the Europe (Ireland) region.
• The database runs in isolated private subnets that cannot be reached from the internet.
• Traffic to the Service is encrypted in transit with TLS, and the file store refuses unencrypted connections.

Encryption at rest and secrets

• Database storage and its backups are encrypted with keys held in AWS Key Management Service.
• The file store is encrypted with keys held in AWS Key Management Service.
• Application secrets are held in AWS Secrets Manager and are not kept in source code.

Separation between Tenants

• The database enforces row-level security on Tenant-owned tables, and the Tenant for each request is taken from the signed-in session rather than from what the request asks for.
• The application applies matching checks of its own.
• Stored files are kept under a storage path specific to their Tenant, in a file store that blocks all public access, and documents are opened only through routes that check the requester's Tenant and permissions, or through a share that the document's holder has issued.

Access control and identity

• Sign-in runs through an identity service that RSM Software operates itself, with protection against repeated password guessing.
• Multi-factor authentication with one-time passcodes is available to Users.
• Access within a Tenant follows roles and permissions derived from the Tenant's type, its plan and the User's type, which the Customer's Administrators can narrow further.
• Administrators can suspend or disable a User's membership of the Tenant.

Audit and accountability

• Changes to Tenant records are recorded in an audit trail naming the person who made them, including RSM Software's operators when they act on a Tenant.
• Each document keeps a record of who viewed, downloaded or shared it.

Operator access

• RSM Software's operator tools act on one Tenant at a time; read access is read-only and changes are audited.
• Our personnel access Customer Personal Data only as far as needed to provide, support and secure the Service or to follow the Customer's instructions, and are bound by confidentiality.

Resilience and recovery

• The database is backed up automatically, and the backups are encrypted and expire on a rolling cycle.
• The production database is protected against accidental deletion.

Retention

• Documents carry retention dates and legal holds, and files past their retention date are removed from the Service by a nightly run unless on hold.
• Service logs are kept for a limited period and then expire.

Changes to the Service

• Changes reach the production environment only with the explicit approval of RSM Software's management.

Personal data breaches

• Personal Data Breaches are handled and notified as described in section 10.