Data processing addendum

This addendum forms part of a service agreement only where incorporated into that agreement or otherwise agreed in writing. It applies where the customer determines the purposes and means of processing and Centranet processes personal data on its behalf. It does not replace the Privacy Policy for Centranet’s separate controller activities.

The customer may be a controller or a processor acting for another organization. If it acts for another controller, it must have authority to appoint Centranet and pass on lawful instructions. A signed data-processing agreement with more specific requirements prevails to the extent stated in it.

The subject matter is provision of the contracted ISP administration, billing, portal, messaging, network and related support services for the service term and applicable return or retention period. Operations can include collection, storage, access, organization, transmission, correction, export and deletion needed for those services.

Data subjects may include the customer’s subscribers, prospects, staff and authorized contacts. Data may include identity and contact details, service-account information, subscription and payment references, device and network identifiers, session information, communications and operational records. Do not upload unnecessary special-category or highly sensitive data. Any additional category or purpose must be separately assessed and agreed.

Centranet will process on documented lawful instructions, including authorized settings and support requests, except where law requires otherwise. We will inform the customer where legally permitted if a legal requirement changes processing or an instruction appears to infringe applicable data-protection law.

The customer must establish a lawful basis, provide required notices, maintain data accuracy, configure appropriate staff access and respond to its subscribers’ rights requests. It is responsible for the lawfulness of its monitoring, marketing, retention choices and cross-border instructions.

The customer must not give Centranet instructions that exceed its authority or undermine another person’s rights. It should document its own controller/processor relationships, including those involving resellers and independent ISPs.

Access to customer personal data is limited to authorized persons and service providers with a relevant operational need and appropriate confidentiality obligations. Security measures must be appropriate to the processing risk and the contracted service.

Measures may include access controls, encrypted transport where supported, separation of workspace permissions, credential restrictions, operational logging and recovery arrangements. The Security & Reporting page describes the scope and limitations of the service; it is not a claim of independent certification or an unconditional guarantee against breaches. The customer remains responsible for its endpoints, local network and account administration.

Where authorized by the agreement, Centranet may use service providers to perform defined processing functions and must impose appropriate data-protection obligations. The Service Providers & Subprocessors register identifies principal platform dependencies; customer-selected integrations can have separate roles and terms.

Material new subprocessors will be notified as required by the agreement and applicable law, allowing the customer to raise a substantiated data-protection objection. The parties will discuss an appropriate alternative, mitigation or affected-service termination where an objection cannot reasonably be resolved. Specific notice and objection periods should be recorded in the service agreement.

International transfers must follow the applicable safeguards and legal requirements. Contact us for location and contractual details needed for your own assessment; do not infer transfer approval merely from the countries displayed on marketing pages.

Centranet will notify the customer of a confirmed personal-data breach affecting data processed for it without undue delay and within applicable statutory time limits. Information may be provided in stages as facts become available, including the known nature of the incident, affected records or persons, likely consequences, response measures and contact route.

The customer is responsible for its required regulatory or data-subject notifications, with reasonable assistance from Centranet. Do not wait for a final technical report where law requires earlier notification. A notification is not, by itself, an admission of liability.

Taking account of the nature of processing and information available, Centranet will reasonably assist with rights requests, impact assessments, regulator enquiries and security obligations. Direct requests concerning customer-controlled records are referred to the appropriate customer unless a legal obligation requires a direct response.

Centranet will make available information reasonably needed to demonstrate its relevant processing obligations and cooperate with proportionate agreed assessments. Audit scope, confidentiality, timing and cost should be agreed; an audit must not expose other tenants’ data or compromise the service. Mandatory regulatory inspection rights are unaffected.

On service exit or a lawful deletion instruction, the parties will arrange available data return or deletion, subject to legal retention and agreed technical constraints. Restricted backup copies and provider-held records may follow separate deletion cycles; applicable periods and restrictions should be confirmed for the specific service. Retained data remains protected and is not repurposed for unrelated use.

Use the legal/privacy contact on this page for processing instructions, subprocessor information, audit requests and incident coordination. Supply the relevant workspace and the authority of the requester. The service agreement’s liability provisions apply only to the extent permitted by law and do not remove rights granted directly to data subjects or regulators.