Wefta Data Processing Addendum

Roles

The customer is the controller (business, under the CCPA) and decides the purposes and means of processing. Wefta is the processor (service provider) and acts only on the customer's documented instructions, which the Terms of Service and the configuration of the account express.

Wefta will tell the customer if an instruction appears to breach applicable data protection law, and may refuse to carry it out.

Wefta is an independent controller, not a processor, for the account, billing, security and support records described in the Privacy Policy. Those are not covered by this addendum.

What Wefta will never do with your data

This is the commitment the rest of the document exists to protect.

• No use of customer personal data for Wefta's own purposes, of any kind.
• No advertising, profiling, behavioural prediction or scoring.
• No sale, sharing or licensing of the data to anyone.
• No training of machine learning models, ours or a third party's, on prompts, workspace content or outputs. This obligation is carried down to every subprocessor.
• No combining customer data with data from another source, except where the customer instructs it.

Subject matter, duration, nature and purpose

Subject matter: the provision of the Wefta service. Duration: for as long as the customer's subscription is active, plus the deletion period below. Nature and purpose: hosting, storing, organising, retrieving and transmitting context to the AI systems the customer connects, plus the support and security activity needed to keep that running.

Categories of data and of data subjects

Categories of personal data: account and contact details, workspace content, support messages, usage and security records, and whatever personal data the customer chooses to place in the context it stores.

Categories of data subjects: the customer's users and staff, and the clients, contractors and business contacts the customer writes about in its workspace.

The customer decides what goes into the workspace. Wefta does not require, and asks the customer not to store, special category data (health, biometrics, political or religious belief, sexual orientation, trade union membership) or children's data, since the service is not designed to hold them.

Confidentiality

Access is limited to the people whose duties require it, each bound by a confidentiality obligation that survives the end of their engagement. Access is granted on the least privilege principle and reviewed when a role changes.

Security measures

Wefta maintains technical and organisational measures appropriate to the risk, which include at minimum:

• Encryption of data in transit, and of credentials at rest.
• Multi-factor authentication on administrative access, and least-privilege access control.
• Logical isolation between customers, with authorisation enforced at the level of each object, not only at login.
• Logging of administrative and security-relevant events.
• Daily backups, retained for 7 days, with restoration tested.
• Code review before release, and dependency and vulnerability monitoring.
• A documented incident response procedure.

Multi-tenant isolation

Wefta is multi-tenant: customers share infrastructure, with logical separation between their data. The characteristic risk of that design is one tenant reaching another tenant's data through a missing or wrong authorisation check — the class of defect known as broken object level authorisation, or insecure direct object reference.

We name it here because it is the failure that matters in this architecture, and because naming it is what makes it a requirement: every request that resolves a record checks that the record belongs to the tenant making the request, and that check is part of code review.

Subprocessors

The customer gives general authorisation for Wefta to engage subprocessors. The current list is published in the Privacy Policy.

Every subprocessor is bound by written terms that impose data protection obligations no weaker than those in this addendum, and Wefta remains fully liable to the customer for their performance.

Wefta gives the customer at least 30 days' notice before a new subprocessor starts processing their data. Within that period the customer may object on reasonable, documented data protection grounds. We will work to address the objection; if we cannot, the customer may terminate the affected part of the service without penalty and receive a refund of the unused period.

International transfers

Data crosses borders, because the infrastructure is global. Each transfer carries a safeguard.

Out of Brazil: an adequacy decision of the ANPD where one applies, and otherwise the Standard Contractual Clauses issued under Resolution CD/ANPD nº 19 of 23 August 2024, which are incorporated into this addendum.

Out of the European Economic Area and Switzerland: an adequacy decision where one applies, and otherwise the European Commission's Standard Contractual Clauses (Decision 2021/914), module two (controller to processor), incorporated into this addendum.

Out of the United Kingdom: the UK International Data Transfer Addendum to those clauses.

For onward transfers to a country without an adequacy decision, a transfer impact assessment is performed and supplementary measures applied where the assessment requires them.

Assisting the customer

Wefta assists the customer, taking into account the nature of the processing and the information available to it, with: responding to data subject requests it receives directly; carrying out data protection impact assessments and prior consultations; and demonstrating compliance with these obligations.

If a data subject contacts Wefta directly about data belonging to a customer's workspace, Wefta does not answer on the customer's behalf. We redirect the request to the customer and tell the data subject that we have done so, without undue delay.

Security incidents

Wefta notifies the customer without undue delay and in any event within 24 hours of confirming a personal data breach affecting their data. The notice describes what is known: the nature of the incident, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

That deadline exists so the controller keeps enough of its own 72-hour window under the GDPR, and the reasonable period under the LGPD, to make its report to the authority and to the people affected.

Wefta does not notify supervisory authorities or data subjects on the customer's behalf unless the customer asks in writing.

Audit

On request, and no more than once per year unless an incident or an authority requires otherwise, Wefta provides the information necessary to demonstrate compliance with this addendum.

Where an independent audit report or certification is available, it is provided in the first instance and satisfies the audit obligation. An on-site audit may be conducted by the customer or an independent auditor bound by confidentiality, with 30 days' notice, during business hours, without disrupting the service, and at the customer's cost.

Return and deletion

The customer can export its data at any time while the subscription is active. After termination, data remains available for export for 30 days.

After that period Wefta deletes the customer's personal data, including from backups as their 7-day cycle expires, unless a law requires it to be kept, in which case the data stays protected by this addendum and is processed for nothing but that legal purpose.

Liability

The limitation of liability in the Terms of Service applies to this addendum, including the higher separate cap for security incidents and data protection failures.

That said, a limit does not move responsibility. Under LGPD article 42 a processor answers jointly where it breaks the security rules or goes beyond lawful instructions, and this addendum does not attempt to contract around it.

Where a personal data exposure originates on the customer's side — shared or leaked credentials, access not revoked, an integration the customer authorised, a configuration the customer chose, or content the customer had no right to upload — the consequences are the customer's, not Wefta's.

Order of precedence

For matters of personal data, this addendum prevails over the Terms of Service. A signed agreement between Wefta and the customer prevails over both, to the extent it addresses the same matter.