Data Processing Addendum

1. Definitions

• “Data Protection Laws” means, as applicable: the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”); the UK GDPR and Data Protection Act 2018; the Swiss Federal Act on Data Protection; and any other data protection or privacy law applicable to the Processing of Personal Data under this DPA.
• “Personal Data,” “Processing” (and “Process”), “Controller,” “Processor,” “Data Subject,” and “Supervisory Authority” have the meanings given in the GDPR, and “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.
• “Customer Data” has the meaning given in the Agreement, to the extent it constitutes Personal Data Processed by Onset on Customer’s behalf (“Customer Personal Data”).
• “Subprocessor” means any third party engaged by Onset to Process Customer Personal Data on behalf of Customer.
• “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses for the transfer of personal data to third countries annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, and, where applicable, the UK International Data Transfer Addendum issued by the UK Information Commissioner.

2. Roles of the Parties

The parties agree that with regard to the Processing of Customer Personal Data, Customer is the Controller (or, where Customer Processes Personal Data on behalf of a third-party Controller, a Processor) and Onset is a Processor acting on Customer’s behalf. Each party will comply with the obligations under Data Protection Laws applicable to its role.

3. Scope and Instructions

Onset will Process Customer Personal Data only (a) to provide, secure, and support the Service, (b) as described in Annex 1 (Details of Processing), and (c) on Customer’s documented instructions, including those given through the Agreement, this DPA, and Customer’s configuration and use of the Service, unless Processing is otherwise required by law applicable to Onset, in which case Onset will inform Customer of that legal requirement before Processing, unless the law prohibits this on important grounds of public interest. Onset will promptly notify Customer if, in its opinion, an instruction infringes Data Protection Laws.

4. Personnel

Onset will ensure that persons authorized to Process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and are only granted access on a need-to-know basis consistent with their role.

5. Security

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of Processing, as well as the risk to the rights and freedoms of Data Subjects, Onset will implement and maintain the technical and organizational measures described in Annex 2.

6. Subprocessors

Customer generally authorizes Onset to engage the Subprocessors listed in Annex 3 to Process Customer Personal Data. Onset will impose data protection obligations on each Subprocessor that are materially no less protective of Customer Personal Data than those in this DPA. Onset remains liable to Customer for a Subprocessor’s performance of its data protection obligations.

Onset will update this page before authorizing any new Subprocessor or replacing an existing one, and Customer may object on reasonable data-protection grounds within 30 days of the update by contacting hello@onset.io. If the parties cannot resolve the objection, Customer’s sole remedy is to terminate the affected Service in accordance with the Agreement.

7. Assistance with Data Subject Requests

Taking into account the nature of the Processing, Onset will provide reasonable assistance to Customer, through appropriate technical and organizational measures, to help Customer fulfil its obligation to respond to requests from Data Subjects seeking to exercise their rights under Data Protection Laws (including access, rectification, erasure, restriction, portability, and objection). If Onset receives such a request directly from a Data Subject regarding Customer Personal Data, Onset will not respond to that request itself (other than to acknowledge receipt) and will promptly forward it to Customer, unless legally required to respond.

8. Personal Data Breach Notification

Onset will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, and will provide information reasonably available to Onset to assist Customer in meeting its own notification obligations under Data Protection Laws, including a description of the nature of the breach, likely consequences, and measures taken or proposed to address it.

9. Data Protection Impact Assessments

Onset will provide reasonable assistance to Customer, at Customer’s expense for anything beyond standard support, with any data protection impact assessments and prior consultations with Supervisory Authorities that Customer reasonably considers necessary, to the extent required by Data Protection Laws and taking into account the nature of Processing and information available to Onset.

10. International Transfers

Onset may Process Customer Personal Data in the United States and other countries in which Onset or its Subprocessors maintain facilities. Where such Processing involves a transfer of Personal Data originating in the EEA, UK, or Switzerland to a country not recognized as providing an adequate level of data protection, the transfer will be governed by the Standard Contractual Clauses (Module 2: Controller-to-Processor, and Module 3 where Customer acts as a Processor), which are incorporated into this DPA by reference, or such other valid transfer mechanism as Onset may make available.

11. Audits and Compliance Records

Onset will make available to Customer information reasonably necessary to demonstrate compliance with this DPA (such as summaries of relevant security certifications, audit reports, or completed questionnaires) and will allow for and contribute to audits, including inspections, conducted by Customer or an independent auditor mandated by Customer, no more than once per 12-month period absent a Personal Data Breach or Supervisory Authority requirement, subject to reasonable advance notice, confidentiality, and minimization of disruption to Onset’s business and other customers.

12. Return or Deletion of Customer Personal Data

Following termination or expiration of the Agreement, and consistent with the data export and deletion terms of the Agreement, Onset will, at Customer’s election, make available for export or delete Customer Personal Data, and will delete existing copies from active systems within a commercially reasonable period thereafter, except to the extent applicable law requires retention, or data is retained in encrypted backups pending routine deletion in the ordinary course.

13. Liability; Order of Precedence

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Agreement. In the event of any conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA will govern. In the event of a conflict between this DPA and the SCCs, the SCCs will govern.

Annex 1 — Details of Processing

Subject Matter

Onset’s provision of its hosted release notes, changelog, and public roadmap platform to Customer.

Duration

For the term of the Agreement, plus any period during which Onset retains Customer Personal Data in accordance with the Agreement and Section 12 of this DPA.

Nature and Purpose of Processing

• Hosting, storage, and transmission of Customer Data submitted to the Service.
• Sending release note, changelog, and roadmap update notifications to Customer’s subscribers on Customer’s behalf.
• Authenticating and managing access for Customer’s team members and, where applicable, Customer’s subscribers (e.g., password-protected or email-whitelisted pages).
• Providing product analytics, security monitoring, customer support, and AI-assisted writing/summary features.

Categories of Data Subjects

• Customer’s team members and other Users authorized to access the Service.
• Customer’s end customers, users, or subscribers who sign up to receive release notes, changelogs, or roadmap updates.
• Visitors to Customer’s public release notes, changelog, or roadmap pages.

Categories of Personal Data

• Contact and profile data: name, email address, role, and (where provided) physical address.
• Authentication data: hashed/salted passwords, SSO identifiers and tokens.
• Technical data: IP address, device/browser metadata, and usage/telemetry data.
• Content data: any Personal Data Customer or its Users include within release notes, roadmap items, support communications, or subscriber lists.

Special Categories of Data

None intentionally collected or Processed. Customer will not submit special category or other sensitive Personal Data to the Service absent a separate written agreement with Onset.

Annex 2 — Technical and Organizational Security Measures

• Encryption of Customer Personal Data in transit via TLS, and encryption of data at rest for primary data stores.
• Password hashing and salting; no storage of plaintext credentials.
• Role-based access control limiting production data access to authorized personnel on a need-to-know basis.
• Logical separation of Customer environments within Onset’s multi-tenant architecture.
• Vendor security review before onboarding new Subprocessors that will Process Customer Personal Data.
• Application error and security monitoring, with a documented incident response process and breach notification procedure.
• Routine, encrypted backups with defined retention periods.
• Payment card data handled exclusively by Onset’s PCI-compliant payment processor; Onset does not store full card numbers.

Annex 3 — Subprocessors

Onset uses the following Subprocessors to provide the Service. We’ll update this list before adding or replacing a Subprocessor and, where required, notify customers as described in Section 6 above.

Contact Information

Questions about this DPA, or requests to exercise rights under Section 6 (Subprocessors), can be sent to:

Email: hello@onset.io
Mailing Address: OneClick Lab, LLC (Onset), New York, NY, 10001, USA