Data Processing Addendum
Last updated: 1 June 2026. This DPA supplements the Aésmany Master Subscription Agreement.
1. Roles and scope
Customer acts as the data controller; Aésmany acts as the data processor for personal data processed on behalf of Customer through the platform.
2. Sub-processors
We maintain a public list of sub-processors at aesmany.studio/legal/sub-processors and provide 30 days' notice before adding a new one.
3. Security measures
Aésmany implements the technical and organisational measures described in the Security Exhibit, including encryption at rest, TLS 1.3 in transit, role-based access, and audit logging.
4. International transfers
For EU-origin data, we rely on Standard Contractual Clauses (SCCs) where applicable. Indian customers' data remains in our Mumbai region unless explicitly configured otherwise.
5. Data subject requests
Aésmany assists Customer in fulfilling data subject requests through in-product tools and a 48-hour response SLA for escalations.
6. Signing
Customers can request a counter-signed copy by emailing support@aesmany.studio.