Data Processing Addendum

Version 2026-08-10.1

This addendum forms part of the agreement between you ("Controller") and Hanover Tech LLC ("Processor") and applies whenever we process personal data on your behalf — that is, personal data belonging to your end users.

1. Roles

You determine why and how your end users' personal data is processed. We process it only on your documented instructions, which are: to build, host, operate, monitor, back up, and support your project as described in your approved specification, and to comply with law.

2. Subject matter and duration

Processing lasts for as long as we host your project, plus the retention periods in our Privacy Policy. The subject matter is the operation of your application.

3. Categories of data and data subjects

As described in the "Data and compliance" section of your approved specification. The categories are derived from the modules you selected, and change only when you approve a new specification.

4. Our obligations

We will: process only on your instructions; ensure people with access are bound by confidentiality; implement the security measures described in our Security Policy; assist you with data-subject requests and with security and impact assessments; notify you without undue delay and in any case within 72 hours of becoming aware of a personal data breach affecting your data; and delete or return the data at the end of the agreement.

5. Subprocessors

You authorise the subprocessors listed at /factory/policies/subprocessors/. We will give you 30 days' notice before adding one, and you may object on reasonable data-protection grounds; if we cannot resolve the objection you may terminate the affected project without penalty.

6. International transfers

Where personal data is transferred out of the EEA or UK we rely on the Standard Contractual Clauses, incorporated by reference.

7. Audit

We will provide the information reasonably needed to demonstrate compliance with this addendum, and allow an audit no more than once a year on 30 days' notice, at your cost, subject to confidentiality.

8. Your obligations

You are responsible for having a lawful basis for the processing you instruct, for giving your end users the notices they are entitled to, and for the lawfulness of the data you supply to us.