Data Processing Addendum

1. Scope and privacy roles

This DPA applies when AARK processes personal data in Customer Data on behalf of the Customer to provide, secure, support, and maintain HisaBooks. For that data, the Customer normally acts as the controller, organisation, Data Fiduciary, or equivalent responsible party, and AARK acts as processor, service provider, data intermediary, Data Processor, or equivalent.

This DPA does not apply to data for which AARK determines its own purposes, including account administration, company-code administration, legal-policy acceptance, billing, fraud prevention, service security, product reliability, support administration, and AARK's own legal records. Those activities are described in the Privacy Policy.

2. Processing details

3. Customer instructions

AARK will process Customer Data only to provide HisaBooks, follow the Customer's documented instructions, comply with the Terms, keep the service secure, support the Customer, comply with law, or as otherwise described in this DPA. The Terms, order form, workspace configuration, administrator actions, user actions, API calls, support requests, and documented privacy or deletion requests are Customer instructions.

If AARK believes an instruction is unlawful or creates material risk, AARK may notify the Customer, pause the relevant processing where reasonable, or decline the instruction unless legally required to proceed.

4. Confidentiality and access

AARK will limit access to Customer Data to personnel, contractors, and providers who need access to operate, secure, support, or maintain HisaBooks. Those people must be subject to confidentiality obligations or equivalent professional duties. Customer support access should be limited to the information needed to resolve the request or operate the service.

5. Security measures

AARK will maintain administrative, technical, and organisational safeguards appropriate to the nature of the service and the risk of processing. Current measures include HTTPS transport, tenant-scoped access controls, role and permission checks, password hashing, session protections, CSRF controls, security headers, optional two-factor authentication, email verification, audit and security events, restricted desktop API origins, mobile secure storage, backup controls, and privacy-request execution evidence.

The Security Overview describes current controls and customer responsibilities. Security measures may evolve over time if the overall protection is not materially reduced.

6. Subprocessors

The Customer authorises AARK to engage subprocessors needed to provide, secure, bill, support, host, back up, notify, or maintain HisaBooks. Current provider categories are listed in the Subprocessor Register.

AARK must require subprocessors that process Customer Data for AARK to protect that data under written terms appropriate to the service they provide. AARK remains responsible to the Customer for subprocessors engaged by AARK, subject to the Terms and applicable law.

Material provider changes should be reflected in the Subprocessor Register before or promptly after the change, depending on urgency. Customers may raise a good-faith data-protection objection, and AARK will review whether the concern can be resolved through information, alternative configuration, suspension of the affected feature, or another commercially reasonable path.

Customer-selected recipients, exports, public links, email recipients, and future Customer-selected integrations are not general HisaBooks subprocessors; they process data at the Customer's direction.

7. International transfers

AARK is based in Singapore. HisaBooks and its providers may process data in Singapore and other countries where infrastructure, payment, email, notification, support, app-store, security, or backup providers operate. The Customer authorises these transfers for service delivery, subject to applicable law and any written order terms.

Where required, the parties must use appropriate transfer safeguards, such as contractual protections, provider due diligence, access controls, encryption in transit, or standard contractual clauses. This DPA does not itself complete every country-specific transfer assessment; Customers with EU/UK, India, Singapore, or other regulated transfer requirements should obtain appropriate legal review.

8. Assistance and data-subject requests

Taking into account the nature of processing and information available to AARK, AARK will provide reasonable assistance for Customer obligations relating to access, correction, export, deletion, restriction, objection, consent withdrawal, security, breach assessment, impact assessments, and regulator enquiries. Assistance may be provided through product features, exports, support, logs, documentation, or the Data and Account Requests page.

If AARK receives a request about Customer-controlled workspace data, AARK may direct the requester to the Customer or coordinate with the Customer unless law requires a different response.

9. Security incidents

AARK will assess suspected unauthorised access, loss, disclosure, alteration, or destruction of Customer Data. If AARK confirms a personal-data incident affecting Customer Data, AARK will notify affected Customers without undue delay after confirmation and provide information reasonably available to help the Customer meet its own duties.

Notice may be delayed where law enforcement, containment, investigation integrity, or legal restrictions require it. Unsuccessful attacks, spam, scanning, blocked attempts, or events that do not compromise Customer Data are not automatically notifiable incidents.

10. Return, deletion, and retention

During the subscription, authorised users may export available records through product features. After verified closure, AARK will handle deletion, anonymisation, retention, backup expiry, and provider actions according to the Privacy Policy, retention schedule, deletion runbook, legal holds, statutory duties, disputes, and documented Customer instructions.

Deletion does not automatically remove business, tax, payroll, accounting, payment, refund, legal acceptance, support, security, audit, privacy-request, or backup records that must be retained. Removing an app from a device does not delete server records or cancel a subscription.

11. Audit and information

AARK will provide reasonable information needed to demonstrate compliance with this DPA, usually through the Privacy Policy, Security Overview, Subprocessor Register, support responses, audit summaries, or written questionnaires. Customer audits must be reasonable, scheduled in advance, protect other customers and AARK confidential information, avoid service disruption, and be limited to the Customer's own environment and relevant controls.

12. Conflicts, changes, and contact

If this DPA conflicts with the Terms for Customer-controlled personal data processing, this DPA controls only for that processing. The Terms continue to control commercial, liability, payment, suspension, support, and general service matters unless a signed order form states otherwise.

Material changes to this DPA should receive a new version. Contact support@hisabooks.com with the subject "DPA Request" for data-processing questions.