Data Processing Addendum

When this applies

This Addendum forms part of the Terms of Service between you and Advancer Limited. It applies where you are a controller of personal data and we process that data on your behalf — which is the case for the content inside your projects.

You do not need to sign anything separately. It applies automatically. If your organisation requires a countersigned copy, ask us.

What we process, and on whose instructions

Subject matter: providing Askance. Duration: the term of your subscription plus the retention periods in the Privacy Policy. Nature and purpose: hosting, indexing, searching, transmitting and displaying project content, and routing Questions to the people you designate.

Categories of data subject: your personnel, your invited experts, and any individual identified within the content of a Question, Answer or attachment.

Categories of personal data: identity and contact details, authentication data, usage records, and whatever personal data your content happens to contain — which is under your control, not ours.

We process this data only on your documented instructions, which include these Terms and your use of the product. If we believe an instruction breaches data protection law, we will tell you.

Our obligations

We keep the data confidential and ensure our personnel are bound to confidentiality. We maintain appropriate technical and organisational measures, including encryption in transit and at rest, project-scoped access control, and an append-only audit trail.

We assist you, so far as is reasonable, with data-subject requests, with data protection impact assessments, and with breach notification. We will notify you without undue delay if we become aware of a personal data breach affecting your content.

On termination we delete your data in line with the Privacy Policy, or return it — the export function is available throughout.

We permit you, or an auditor you appoint, to verify our compliance on reasonable notice, no more than once a year unless a regulator requires otherwise.

Sub-processors

We use the following sub-processors. Each is bound by written terms no less protective than these.

• Microsoft Azure (Sweden Central, European Economic Area) — hosting, database, file storage. Provides the compute and storage the whole service runs on.
• Stripe — payment processing and tax calculation for paid plans. Receives billing contact and payment data; does not receive project content.
• Transactional email provider — sends notification and account emails. Receives recipient email addresses and notification text. Provider to be confirmed before paid launch; it will be named here before it processes any of your data.

We will update this list before adding a sub-processor and will email account owners at least 30 days beforehand. If you object on reasonable data-protection grounds, tell us and we will work with you; if we cannot resolve it, you may terminate and receive a refund of any unused prepaid fees.

If we later offer AI-generated Answers, the provider of that capability will be added to this list before any of your content reaches it.

International transfers

Your project content is stored and processed in the European Economic Area. We are a New Zealand company and administer the service from New Zealand.

New Zealand holds an adequacy decision from the European Commission, so transfers from the EEA to us do not require Standard Contractual Clauses. Where a sub-processor operates outside the EEA or New Zealand, transfers rely on that provider's own approved mechanism.