Data Processing Addendum

Effective August 23, 2026

This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Pellwood (“Processor”) and the customer (“Controller”) and applies whenever Pellwood processes personal data on the customer’s behalf.

1. Scope and roles

The customer is the controller of personal data in its workspace. Pellwood processes it only on documented instructions, which are the Terms, this DPA and the customer’s use of the service.

2. Security

Pellwood maintains the technical and organizational measures described on our Security page, including encryption in transit and at rest, access control and logging.

3. Subprocessors

The customer authorizes the subprocessors listed at pellwood.io/legal/subprocessors. We give at least 30 days’ notice of new subprocessors, and the customer may object on reasonable grounds.

4. International transfers

Transfers of personal data from the EEA, Switzerland or the UK are governed by the Standard Contractual Clauses (Module 2 and, where relevant, Module 3) and the UK International Data Transfer Addendum, which are incorporated by reference. EU data residency is available on Scale.

5. Breach notification

Pellwood notifies the customer without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting the customer’s data.

6. Assistance, audits and deletion

Pellwood assists with data subject requests and impact assessments, and deletes or returns customer data within 30 days of the end of the subscription.