CUSTOMER DATA PROTECTION
Data Processing Addendum
Standard data-processing terms for SONO’s provision of the SaaS services.
1. Roles and instructions
For personal data submitted to the service, Customer acts as controller or processor and Sono Software FZE acts as processor or subprocessor according to Customer’s documented instructions. Each party remains independently responsible for processing it determines for its own purposes.
2. Processing details
| Field | Standard description |
|---|---|
| Subject | Provision, hosting, security, support and administration of SONO SaaS |
| Duration | Subscription term plus the documented export and deletion period |
| Data subjects | Authorised users, customer personnel, managers and business contacts |
| Data | Identity, business contact, organisation, access logs and governance records submitted by Customer |
| Operations | Collection, storage, organisation, access, backup, support viewing, transmission, export and deletion |
| Special-category data | Not supported unless expressly identified by SONO and protected by additional approved measures |
3. Customer obligations
Customer ensures lawful instructions, notices, legal bases, permissions, data accuracy and minimisation. Customer will not instruct SONO to process data unlawfully or outside the documented service.
4. Confidentiality and access
SONO limits access to personnel and subprocessors with a need to know, binds them to confidentiality and applies role-based access and least-privilege principles.
5. Security measures
- Unique identities, role-based access and strong administrator authentication
- Encryption in transit and appropriate encryption at rest
- Logging, monitoring, vulnerability and configuration management
- Backup, restoration testing and business-continuity procedures
- Incident response, evidence preservation and corrective action
- Personnel confidentiality and security awareness
6. Security incidents
SONO will notify Customer without undue delay after confirming a personal-data breach affecting Customer Data and will provide available information about nature, impact, mitigation and contact points. Notification is not an admission of fault.
7. Subprocessors
Customer gives general authorisation for the subprocessors on the published list. SONO remains responsible for their performance of applicable processing obligations and will provide advance notice of material additions or replacements.
8. International transfers
Where data is accessed or stored outside the originating jurisdiction, the parties will use the legally required transfer mechanism. Prescribed clauses, including applicable KVKK standard contracts, EU SCCs or UK transfer addenda, are completed separately when required and are not modified beyond permitted selections.
9. Data-subject requests
Taking into account the nature of processing, SONO will reasonably assist Customer with requests from individuals. SONO will not independently respond for Customer unless legally required or authorised.
10. Assessments and regulator cooperation
SONO will provide reasonable information needed for Customer’s impact assessments, consultations and regulator enquiries relating to the service, subject to confidentiality and security limitations.
11. Audit information
SONO will make available relevant policies, certifications, summaries or questionnaire responses. On-site audits are limited to justified circumstances, reasonable notice, business hours, confidentiality and protection of other customers.
12. Return and deletion
Customer may export data using available service functions during the subscription. After termination, active-system data is retained for up to 60 days for export and then deleted or anonymised; backup copies are removed through normal rotation within up to 90 additional days, unless law requires retention.
13. Conflict and liability
This DPA controls for personal-data processing. Liability is governed by the SaaS Terms, subject to non-waivable data-protection law and any mandatory transfer instrument.
