Data Processing Addendum
How Konsull LLC processes customer work content on the customer's instructions.
Parties and scope
This Addendum forms part of the GroundBoot Terms of Service between Konsull LLC, a New York limited liability company, and the customer accepting those terms through an authorized representative. It applies when the customer is a controller or processor and Konsull processes personal data in work content on that customer's behalf. It applies to Free and paid use alike. It does not turn a Company member into the Company's contracting representative.
The customer determines the purposes of processing. Konsull acts as processor, or as subprocessor if the customer acts for another controller. The customer must have that controller's authorization. Konsull's separate account administration, billing, security and business-contact processing is described in the Privacy Policy. This Addendum prevails over conflicting general service terms on data protection; mandatory transfer terms prevail over this Addendum.
Processing details
The subject is hosted maintenance and work management. Processing includes receiving, organizing, storing, retrieving, displaying, transmitting, exporting and deleting work records and files, and generating Assistant proposals when requested. It lasts while the service is provided and until authorized retention and deletion are complete.
Data subjects can include the customer's staff, contractors, occupants, clients and contacts. Data can include names, work contact details, assignments, authorship, work times, notes, expenses, site information, photographs, documents and messages supplied through the service. Sensitive or special-category data, identity documents, payment-card details and data about children are not intended inputs; use requiring that processing needs a separately supported written arrangement.
Instructions and confidentiality
The customer's documented instructions consist of this agreement, authorized product actions and further written instructions agreed with Konsull. Konsull will process work content only on those instructions, including for transfers, unless applicable law requires otherwise. Where permitted, Konsull will notify the customer before legally required processing and will promptly inform it if an instruction appears to infringe applicable data-protection law.
The customer is responsible for lawful collection, necessary notices and the authority of its users. Konsull will restrict access to people who need it to deliver the service and who are bound by confidentiality obligations. Konsull will not sell work content, use it for cross-context advertising or train general-purpose models on it. Service-provider processing stays within the permitted business purposes and relationship; data is not combined for unrelated purposes.
Security measures
Konsull will maintain measures appropriate to the processing risk: authenticated tenant and Site access, restricted operator access, encrypted network transport, protected credentials, private cloud-file access, operational logging, backup and restore procedures, and testing of relevant access and recovery controls. Cloud objects use provider-managed encryption at rest. These measures do not claim that every hosting disk is application-encrypted or that Konsull holds a particular security certification.
Customers must secure user devices, control membership, use appropriate access levels and protect exports. Konsull may improve its measures without materially reducing their overall protection. It will periodically review relevant controls and address identified failures.
Subprocessors
The customer authorizes the providers listed in the linked register for their stated service roles. Before engaging a provider to process customer personal data, Konsull will put in place written obligations providing the protection required by applicable law, and remains responsible for that provider's performance of the processing obligations it delegates.
Konsull will notify affected customer administrators by email at least 30 days before adding or replacing a subprocessor that receives their personal data. The customer may object on reasonable data-protection grounds within that period by contacting us. We will work to resolve the objection or offer a reasonable alternative. If it cannot be resolved, the customer may stop the affected feature or terminate it without an additional termination charge and receive any prepaid unused fees for it. A public register update alone is not that notification.
Requests, incidents and assistance
Taking account of the processing and information available, Konsull will assist the customer with access, correction, deletion, portability, restriction and objection requests, security duties, impact assessments and regulator consultations. Requests concerning Company-controlled records will be promptly referred to its authorized contact unless the law requires a direct response. Privacy rights do not depend on a paid plan.
Konsull will notify the customer without undue delay after becoming aware of a personal-data breach affecting its work content. Notice will describe the known incident, affected data and people, likely consequences, response measures and a contact point; missing details will follow as they become available. Konsull will cooperate with investigation and mitigation. The customer remains responsible for its own legally required notifications.
Return, deletion and recovery copies
At the end of the service, the customer may choose return or deletion of its work content, subject to applicable law. Available export and deletion controls, and contact-based assistance for other requests, implement those instructions. Konsull will remove remaining active copies after the instruction is completed, except data legally required to be retained, which will be restricted to that purpose.
Restricted backups and provider recovery copies expire under their recovery schedules rather than instantaneously. Konsull will provide the relevant schedule on request, prevent ordinary use of retained copies, and reapply deletion instructions before restored data returns to service. Deleting an individual member's login alone is not an instruction to delete the Company's records.
Information and audit
Konsull will provide information needed to demonstrate its compliance with these processing obligations and allow and contribute to audits, including inspections, by the customer or its mandated independent auditor. The parties will arrange proportionate notice, confidentiality and safeguards for other customers' data. These arrangements will not obstruct a regulator or an urgent legally required inspection. Konsull will notify the customer if it can no longer meet an applicable service-provider obligation and cooperate with reasonable steps to stop and remediate unauthorized processing.
International transfers and contact
The service operates in the United States and uses the locations described in the provider register. Where a transfer requires an additional lawful mechanism, the parties must establish that mechanism before the affected transfer. This Addendum is not itself the EU Standard Contractual Clauses or the UK International Data Transfer Addendum, and accepting it does not establish an unverified adequacy or certification claim. Contact us to arrange applicable terms and information about safeguards.
Customer notices go to its current authorized account or Company contact. Send instructions, audit requests, objections or privacy questions to contact@konsull.com. Keep the customer contact current. These obligations continue for as long as Konsull retains customer personal data on its behalf.
Contact
For questions or requests, contact Konsull LLC at contact@konsull.com.