When we process personal data on your behalf during an engagement, this addendum sets the terms. It supplements the signed services agreement.
Roles
For client data we handle during a project, you are the controller and CodeLexer is the processor, acting on your documented instructions.
Security measures
We apply appropriate technical and organisational measures, access controls, encryption in transit and at rest where applicable, and least-privilege by default.
Sub-processors
We use vetted sub-processors only as needed and remain responsible for their compliance. A current list is available on request.
International transfers
Where data moves across borders, we rely on recognised transfer mechanisms such as Standard Contractual Clauses.
This document is a starting draft, have qualified counsel review it for your jurisdictions before relying on it.