Data Processing Addendum

Last updated: 2026-10-01

This Addendum forms part of the Terms of Service between the customer ("Controller") and Individual Entrepreneur -, identification code 0000 ("Processor"), and applies when the Processor processes personal data on behalf of the Controller in ReleaseDesk Cloud.

1. Subject matter and duration

The Processor hosts the Controller's builds and update feeds and records usage statistics for the Controller's apps. Processing lasts for the term of the subscription plus the export period in the Terms.

2. Nature, purpose and data

• Nature and purpose: storage, delivery, and statistical analysis of app releases and updates.
• Data subjects: the Controller's testers, employees and end users of its apps.
• Data types: names and email addresses of testers, hashed device identifiers, app version and platform, download and update-check events, country derived from IP address.

3. Processor obligations

The Processor will:

1. process personal data only on the Controller's documented instructions, which are these Terms, this Addendum and the Controller's use of the features;
2. ensure that persons authorised to process the data are bound by confidentiality;
3. apply appropriate technical and organisational measures (encryption in transit, access control, hashed tokens, logging, backups);
4. assist the Controller with data subject requests, security, breach notification and impact assessments, as far as reasonably possible;
5. notify the Controller without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach;
6. delete or return personal data on termination as set out in the Terms, unless law requires retention;
7. make available information needed to demonstrate compliance and allow reasonable audits, once per year on 30 days' notice, at the Controller's cost.

4. Sub-processors

The Controller gives general authorisation for the sub-processors listed in the Privacy Policy. The Processor will inform the Controller of changes at least 30 days in advance, and the Controller may object on reasonable data protection grounds. The Processor remains responsible for its sub-processors.

5. International transfers

Data is stored in the EU. Transfers to countries without an adequacy decision rely on Standard Contractual Clauses.

6. Liability

Liability under this Addendum is subject to the limits in the Terms.

7. Contact

Data protection requests: privacy@releasedesk.dev.