Processor commitments for customer-controlled personal data.
The customer is controller and Tuturuuu is processor for personal data submitted to a workspace, except where each acts as an independent controller. Tuturuuu processes data only on documented instructions in the agreement, product configuration, support requests and lawful customer directions. Processing supports the service categories disclosed in the Privacy Policy for the agreement term and applicable retention period.
Personnel authorized to process personal data are bound by confidentiality. Tuturuuu maintains safeguards appropriate to risk, including access control, encryption, tenant isolation, monitoring, secure development, incident response, resilience and recovery measures. The customer remains responsible for lawful collection, notices, permissions, endpoint security and configuration.
The customer generally authorizes the subprocessors in the maintained registry. Tuturuuu will provide notice of material additions where contractually required and a reasonable objection process. International transfers use applicable legal mechanisms, including recognized contractual clauses and supplementary measures where required.
Upon reasonable request, Tuturuuu will provide information needed to demonstrate compliance. Audits must protect other customers, security and confidentiality and ordinarily begin with independent reports or written evidence. On termination, customer data is returned or deleted according to product export capabilities, backup rotation, legal retention and documented instructions.
Processing may involve workspace members, guests, customers, contacts, learners and other people whose data the customer submits. It covers hosting, storage, retrieval, access control, transmission, support, deletion and configured AI or integration processing for the service term and applicable return/deletion period. Data categories are described in the Privacy Policy and customer instructions. The customer must not submit data prohibited by its agreement and must identify any special processing requirements before use.
A provider acting as an independent controller for its own billing, legal or payment obligations is not a subprocessor for those activities merely because it appears in the provider registry. Executed agreements must identify the applicable roles, locations, transfer mechanism and security annex. A registry entry alone is not an executed international-transfer agreement.
Where processor obligations apply, Tuturuuu notifies the customer without undue delay after becoming aware of a personal data breach affecting customer data; notification is not postponed solely to await a completed investigation. Available information may be provided in stages, with reasonable assistance for the customer's reporting and rights-response obligations.
On termination, the customer may request return or deletion of customer-controlled personal data under the agreement. Backup cycles and legally required retention must be explained, and retained data remains protected and limited to the permitted purpose. Account-level billing records retained under an independent legal obligation are handled under the Privacy Policy. Plan downgrade or credit exhaustion does not override these obligations.
Draft revision for review; not a newly effective agreement. The DPA forms part of an applicable customer agreement when Tuturuuu processes personal data on the customer’s behalf.
