Data Processing Addendum
These documents are product terms for APZWatch. They are not a substitute for legal advice specific to your organisation. Contact counsel before relying on them for regulatory filings.
1. Roles
For screening subject data you submit, you are the Responsible Party / Controller; APZOR is the Operator / Processor. For account billing data, APZOR acts as Responsible Party.
2. Instructions
We process screening data only to provide APZWatch features you enable (screening, cases, monitoring, webhooks, AI assist) and as required by law.
3. Security
- Encryption in transit (TLS); secrets stored hashed or sealed.
- Role-based console access; API keys scoped; optional 2FA gates for key minting.
- Audit logging of sensitive actions.
4. Subprocessors
Current subprocessors are listed at /legal/subprocessors. Material changes will be notified.
5. Breach notice
We will notify you without undue delay after becoming aware of a personal information security compromise affecting your tenant data.
6. Return / deletion
On written request after termination, we will make available an export of retained screening evidence then delete or anonymise operator copies within 90 days, except where retention is legally required.