DATA PROCESSING ADDENDUM

Lathe Studio LLC

Last Updated: October 8, 2026

Preamble

The present Data Processing Addendum (the “DPA”) forms part of the Terms of Service published at https://lathe.studio/terms (the “Terms”) between Lathe Studio LLC, a Wyoming limited liability company, 1309 Coffeen Ave STE 1200, Sheridan, Wyoming 82801, United States (“Lathe Studio”), and the Customer that has accepted the Terms. It applies whenever Lathe Studio processes Customer Personal Data in providing the Service, and it takes effect automatically on the date the Customer accepts the Terms, without any further signature. Capitalized terms not defined in the DPA carry the meanings given in the Terms.

1. Definitions

1.1 “Applicable Data Protection Laws” means every law on the protection of personal data that applies to the processing of Customer Personal Data under the Terms, including, where applicable, the GDPR, the UK Data Protection Laws, and the US State Privacy Laws.

1.2 “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

1.3 “UK Data Protection Laws” means the UK GDPR, as defined in section 3(10) of the Data Protection Act 2018, together with that Act, each as amended from time to time.

1.4 “US State Privacy Laws” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, Cal. Civ. Code § 1798.100 et seq., together with its implementing regulations, and every other comprehensive consumer privacy statute of a state of the United States that applies to the processing of Customer Personal Data.

1.5 “Customer Personal Data” means personal data contained in Customer Content, and any other personal data that Lathe Studio processes on behalf of the Customer in providing the Service, as described in Annex I.

1.6 “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by Lathe Studio or its Sub-processors.

1.7 “Sub-processor” means any processor engaged by Lathe Studio that processes Customer Personal Data.

1.8 “EU SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

1.9 “UK Addendum” means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued under section 119A(1) of the Data Protection Act 2018 and in force from March 21, 2022, as revised under Section 18 of its Mandatory Clauses. Since September 30, 2026, references in that document to the Information Commissioner are to be treated, so far as appropriate, as references to the Information Commission, pursuant to section 119(2) of the Data (Use and Access) Act 2025.

1.10 The terms “controller,” “processor,” “data subject,” “personal data,” “processing,” and “supervisory authority” have the meanings given in the GDPR or, where the UK Data Protection Laws apply, in the UK GDPR, and the terms “business,” “service provider,” “consumer,” “sell,” and “share” have the meanings given in the US State Privacy Laws.

2. Scope and Roles of the Parties

2.1 Roles

As between the parties, the Customer acts as controller of Customer Personal Data, and Lathe Studio acts as its processor. Where the Customer itself processes Customer Personal Data as a processor on behalf of a third-party controller, the Customer warrants that its instructions, including the appointment of Lathe Studio as a further processor, have been authorized by that controller, and Lathe Studio acts as the Customer’s sub-processor.

2.2 Data Outside the Scope of the DPA

Personal data that Lathe Studio processes as an independent controller for its own business purposes, namely the administration of accounts and subscriptions, billing, support communications, inquiries received through the website contact form, website analytics, and the protection of its own systems against abuse, falls outside the DPA to the extent of those purposes and is governed by the Lathe Studio Privacy Policy at https://lathe.studio/privacy, even where the same data is also processed on behalf of the Customer under the DPA. Account Data of Users is processed in both capacities: as controller for the administration of accounts, as the Privacy Policy describes, and as processor insofar as it forms part of the Customer’s Organization records, such as memberships, roles, and audit-log entries.

2.3 Customer Responsibilities

The Customer is responsible for the lawfulness of the processing it instructs, for providing every notice and obtaining every consent or other legal basis that Applicable Data Protection Laws require for the collection of Customer Personal Data and its submission to the Service, and for the accuracy of that data. No instruction to process special categories of personal data, or data relating to criminal convictions and offenses, through the Service shall be given by the Customer.

3. Processing on Documented Instructions

3.1 Instructions

Lathe Studio shall process Customer Personal Data only on the documented instructions of the Customer, including with regard to transfers of personal data to a third country, unless required to do so by a law to which Lathe Studio is subject; in such a case, Lathe Studio shall inform the Customer of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest. The Terms, the DPA, the configuration choices the Customer makes within the Service, including the Integrations it connects, and the support requests it submits constitute the Customer’s complete documented instructions; additional instructions require prior written agreement. Support sessions, which Lathe Studio support personnel open in the manner described in Annex II, are carried out on those instructions when they serve a support request of the Customer or the investigation of a fault in the Service, both of which fall within the instruction, given in the Terms, to provide and support the Service; a session opened to meet a legal requirement falls under the exception in the first sentence of this Section 3.1, and a session opened to respond to a security incident forms part of the measures owed under Section 5.

3.2 Unlawful Instructions

Lathe Studio shall immediately inform the Customer if, in its opinion, an instruction infringes the GDPR, the UK Data Protection Laws, or other Union, Member State, or United Kingdom data protection provisions.

3.3 Description of Processing

The subject matter, duration, nature, and purpose of the processing, the types of Customer Personal Data, and the categories of data subjects are set out in Annex I.

4. Confidentiality

Lathe Studio shall ensure that every person it authorizes to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality. Access to Customer Content by Lathe Studio personnel is limited as described in Annex II.

5. Security of Processing

5.1 Measures

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Lathe Studio shall implement and maintain the technical and organizational measures described in Annex II, which are designed to ensure a level of security appropriate to the risk, as Article 32 of the GDPR requires.

5.2 Updates

Lathe Studio may update the measures in Annex II from time to time, provided that no update materially reduces the overall level of protection afforded to Customer Personal Data.

5.3 Customer Measures

The Customer remains responsible for the security measures within its own control, including the management of Users, roles, API Keys, and Integration credentials, as the Terms describe.

6. Sub-processors

6.1 General Authorization

The Customer grants Lathe Studio a general authorization to engage Sub-processors. Annex III lists the Sub-processors engaged on the date of the DPA, and the Customer approves them.

6.2 Changes

Lathe Studio shall inform the Customer of any intended addition or replacement of a Sub-processor by email to the Admins of the Customer’s Organization at least thirty (30) days before the new Sub-processor begins processing Customer Personal Data, thereby giving the Customer the opportunity to object.

6.3 Objection

The Customer may object to a new Sub-processor on reasonable data protection grounds by writing to privacy@lathe.studio within the notice period. Both parties shall then discuss the objection in good faith. If no resolution is reached before the end of the notice period, the Customer may terminate its subscription with immediate effect by written notice to privacy@lathe.studio, in which case Lathe Studio shall refund the fees prepaid for the unused portion of the Subscription Period in progress, as Section 8.2 of the Terms provides, and shall, at the Customer’s choice, provide an export of the Organization’s data or delete it without waiting for the periods in Section 10.2.

6.4 Flow-Down and Liability

Lathe Studio shall impose on each Sub-processor, by written contract, data protection obligations that provide at least the same level of protection as the DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. Full liability to the Customer for the performance of each Sub-processor’s obligations remains with Lathe Studio.

6.5 Customer-Selected Services

Third-Party Services that the Customer connects through Integrations, including Jira, Azure DevOps, Slack, Microsoft Teams, Bitbucket, GitHub, GitLab, and Jenkins, are selected and controlled by the Customer, are governed by the Customer’s own agreements with their providers, and are not Sub-processors of Lathe Studio.

7. Assistance With Data Subject Requests

7.1 Notification

If Lathe Studio receives a request from a data subject concerning Customer Personal Data, it shall promptly forward the request to the Customer and shall not respond to it directly, except to confirm that the request has been passed on or where Applicable Data Protection Laws require otherwise. Requests concerning Account Data in Lathe Studio’s capacity as controller are handled by Lathe Studio under its Privacy Policy.

7.2 Assistance

Taking into account the nature of the processing, Lathe Studio shall assist the Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling the Customer’s obligation to respond to requests for the exercise of data subjects’ rights. The self-service functions of the Service, including the export of all Organization data as a ZIP archive and the editing and deletion of Customer Content, form part of that assistance.

8. Personal Data Breaches

8.1 Notification

Lathe Studio shall notify the Customer without undue delay after becoming aware of a Personal Data Breach, and in any event within seventy-two (72) hours, by email to the Admins of the affected Organization.

8.2 Content of the Notice

The notice shall describe, to the extent then known, the nature of the Personal Data Breach, including the categories and approximate number of data subjects and records concerned; the name and contact details of the person from whom more information can be obtained; the likely consequences of the breach; and the measures taken or proposed to address it and to mitigate its possible adverse effects. Where the information cannot be provided at the same time, it may be provided in phases without undue further delay.

8.3 Cooperation

Lathe Studio shall take reasonable steps to contain and remedy the Personal Data Breach and shall cooperate with the Customer in meeting its obligations under Articles 33 and 34 of the GDPR and the corresponding provisions of other Applicable Data Protection Laws. Notification by Lathe Studio does not constitute an acknowledgment of fault or liability.

9. Impact Assessments and Prior Consultation

Taking into account the nature of the processing and the information available to it, Lathe Studio shall provide reasonable assistance to the Customer with any data protection impact assessment and any prior consultation with a supervisory authority that the Customer is required to carry out under Articles 35 and 36 of the GDPR, or under equivalent provisions of other Applicable Data Protection Laws, in relation to the processing of Customer Personal Data by Lathe Studio.

10. Return and Deletion

10.1 Return

The Customer exercises its choice of return by exporting the data of its Organization. While the Organization is active, including throughout the Preview, any Admin may export all of its data as a ZIP archive at any time, and the reminder sent on day eighty-nine (89) of the Preview allows that choice to be made before the Organization is Locked. After cancellation, an Admin may request from support up to three (3) full exports before the deletion date, as the Terms provide.

10.2 Deletion

At the end of the provision of services, Lathe Studio shall delete Customer Personal Data in accordance with the schedule set out in the Terms: seven (7) days after the end of an unpaid Preview; seven (7) days after the creation of a further Organization from a company email domain within twelve (12) months after that domain’s Preview began, once that Preview has ended, unless it subscribes; or sixty (60) days after the Organization becomes Locked at the end of a canceled subscription, that date being, for a subscription the payment processor cancels after failed payment attempts, the date of that cancellation, unless the Customer subscribes again before then. Copies of deleted data held in database backups are erased as those backups expire, no later than seven (7) days after deletion from the live database. Audit-log entries are kept for twelve (12) months from each entry and are pseudonymized when a User or an Organization is deleted. Retention beyond those periods occurs only where the law of the Union, of a Member State, of the United Kingdom, or of the United States requires storage, in which case Lathe Studio shall keep the data confidential and process it only for the purpose for which the law requires its retention.

11. Information and Audits

11.1 Information

Lathe Studio shall make available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Article 28 of the GDPR and in the DPA, including written answers to reasonable security and privacy questionnaires, no more than once in any twelve-month period unless a Personal Data Breach or a request from a supervisory authority justifies more frequent requests.

11.2 Audits

Where the information provided under Section 11.1 does not reasonably demonstrate compliance, Lathe Studio shall allow for and contribute to audits, including inspections, conducted by the Customer or by an independent auditor mandated by the Customer and bound by confidentiality. The Customer shall give at least thirty (30) days’ written notice, shall conduct the audit during normal business hours without unreasonable disruption, and shall bear its own costs. An audit may be conducted no more than once in any twelve-month period, subject to the same exceptions as Section 11.1. Audits shall respect the confidentiality of other Customers’ data and the security of the Service, and shall not extend to the facilities of Sub-processors except as their own audit terms permit.

12. International Transfers

12.1 Location of Processing

Customer Personal Data is hosted in the United States, in a single region used for every Customer. The Customer acknowledges that Lathe Studio and its Sub-processors process Customer Personal Data in the United States and may access it from other countries where their personnel are located, subject to the safeguards in this Section 12.

12.2 Transfers Subject to the GDPR

To the extent that the processing of Customer Personal Data under the Terms involves a transfer of personal data to a third country that is subject to Chapter V of the GDPR, the parties hereby enter into the EU SCCs, which are incorporated into the DPA by reference, with the Customer as data exporter and Lathe Studio as data importer, completed as follows.

(a) Modules. Module Two (transfer controller to processor) applies where the Customer acts as controller, and Module Three (transfer processor to processor) applies where the Customer acts as processor on behalf of a third-party controller.

(b) Clause 7. The optional docking clause applies.

(c) Clause 9(a). Option 2 (general written authorization) applies, and the time period for prior notice of intended changes to the list of Sub-processors is thirty (30) days, the notice being given in the manner described in Section 6.2. Under Module Three, the Customer is responsible for relaying that notice to, and any objection from, the controller on whose behalf it acts.

(d) Clause 11(a). The optional language permitting complaints to an independent dispute resolution body does not apply.

(e) Clause 13(a). The competent supervisory authority is determined in accordance with Annex I.C.

(f) Clause 17. Option 1 applies, and the EU SCCs are governed by the law of Ireland.

(g) Clause 18(b). Disputes arising from the EU SCCs shall be resolved by the courts of Ireland.

(h) Annexes. Annexes I, II, and III of the EU SCCs are completed by Annexes I, II, and III of the DPA respectively.

(i) Signature. Acceptance of the Terms by the Customer constitutes the signature of each party to the EU SCCs, including Annex I.A, with effect from the date of that acceptance.

Should Lathe Studio’s processing of Customer Personal Data itself be subject to the GDPR, the parties shall rely on the EU SCCs to the fullest extent available until the European Commission adopts standard contractual clauses designed for importers whose processing is directly subject to the GDPR, and Lathe Studio shall then offer such clauses through an update of the DPA under Section 15.4.

12.3 Transfers Subject to the UK Data Protection Laws

To the extent that the processing of Customer Personal Data involves a restricted transfer under the UK Data Protection Laws, the parties hereby enter into the UK Addendum, which is incorporated into the DPA by reference and completed as follows. In Table 1, the parties, their details, and their key contacts are those set out in Annex I.A, and the start date is the date on which the DPA takes effect. Table 2 identifies, as the Addendum EU SCCs, the EU SCCs incorporated by Section 12.2, with the modules and optional clauses selected there. For Table 3, the Appendix Information is set out in Annexes I.A, I.B, II, and III of the DPA. Under Table 4, the Importer may end the UK Addendum as set out in its Section 19. Part 2 of the UK Addendum consists of the Mandatory Clauses of the Approved Addendum, being template Addendum B1.0 issued under section 119A of the Data Protection Act 2018, as revised under Section 18 of those Mandatory Clauses. Acceptance of the Terms by the Customer constitutes the signature of each party to the UK Addendum.

12.4 Precedence

In the event of any conflict between the DPA or the Terms and the EU SCCs or the UK Addendum, the EU SCCs or the UK Addendum, as the case may be, shall prevail.

12.5 Onward Transfers

Lathe Studio shall ensure that any transfer of Customer Personal Data to a Sub-processor located in a third country is subject to a transfer mechanism recognized by Applicable Data Protection Laws.

13. US State Privacy Laws

13.1 Service Provider Commitments

Where Customer Personal Data constitutes personal information under the California Consumer Privacy Act and the Customer is a business under that statute, Lathe Studio acts as the Customer’s service provider within the meaning of Cal. Civ. Code § 1798.140(ag). In that capacity, and consistent with Cal. Civ. Code § 1798.100(d) and section 7051(a) of title 11 of the California Code of Regulations, the Customer discloses Customer Personal Data to Lathe Studio only for the limited and specified business purposes set out in Annex I.B. Lathe Studio shall not sell or share Customer Personal Data; shall not retain, use, or disclose it for any purpose other than the specific business purposes set out in Annex I.B, including for any commercial purpose other than those business purposes, except as the statute and its regulations otherwise permit; shall not retain, use, or disclose it outside the direct business relationship between Lathe Studio and the Customer; and shall not combine it with personal information received from or on behalf of another person, or collected from its own interaction with a consumer, except as the regulations permit for a business purpose.

13.2 Compliance and Assistance

Lathe Studio shall comply with the obligations that the statute and its regulations impose on service providers and shall provide the same level of privacy protection as they require, including by implementing the security measures in Annex II and by providing reasonable assistance to the Customer in responding to verifiable consumer requests and, where applicable to the Customer, in meeting its obligations concerning cybersecurity audits, risk assessments, and automated decision-making technology under the regulations. The Customer shall inform Lathe Studio of any consumer request with which Lathe Studio must comply, to the extent the self-service functions of the Service do not allow the Customer to comply directly.

13.3 Customer Rights

The Customer may take reasonable and appropriate steps to help ensure that Lathe Studio uses Customer Personal Data in a manner consistent with the Customer’s obligations, including through the information and audits provided under Section 11, at least once every twelve (12) months if the Customer so requests. Lathe Studio shall notify the Customer if it determines that it can no longer meet its obligations under the statute, and the Customer may then, upon notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

13.4 Sub-processors

Lathe Studio engages Sub-processors for Customer Personal Data only under written contracts that bind them to the requirements of this Section 13, and the notice given under Section 6 constitutes notice of each such engagement.

13.5 Other US State Privacy Laws

Where another US State Privacy Law applies to Customer Personal Data, Lathe Studio acts as the Customer’s processor under that law and performs the obligations that such law imposes on processors through the commitments in Sections 3 through 11.

14. Liability

Each party’s liability arising out of or in connection with the DPA is subject to the limitations and exclusions of liability set out in the Terms. Nothing in the DPA or the Terms limits the rights of data subjects, or the liability of either party toward data subjects, under the EU SCCs or the UK Addendum, nor any liability that cannot be limited under Applicable Data Protection Laws.

15. Duration, Precedence, and Governing Law

15.1 Duration

The DPA remains in force for as long as Lathe Studio processes Customer Personal Data, including during the retention periods described in Section 10, and terminates automatically once that processing ends.

15.2 Precedence

In the event of conflict on a matter concerning personal data, the DPA prevails over the Terms, subject to Section 12.4.

15.3 Governing Law

The DPA is governed by the law that governs the Terms, except that the EU SCCs are governed by the law designated in Section 12.2 and the UK Addendum by the laws of England and Wales, as its Mandatory Clauses provide.

15.4 Updates

Lathe Studio may amend the DPA where required by a change in Applicable Data Protection Laws, by a decision of a competent supervisory authority or court, or by the adoption of new or amended standard contractual clauses, and shall notify Customers of material amendments in accordance with the Terms.

Annex I: Description of the Processing and the Transfer

A. List of Parties

Data exporter. The Customer, with the name, address, and contact details provided at registration or in the billing settings of the Service. Its contact person is the Admin designated by the Customer. Activities relevant to the data transferred: use of the Lathe Studio hosted test management platform under the Terms. Role: controller under Module Two or, where the Customer acts for a third-party controller, processor under Module Three. Signature and date: by acceptance of the Terms, on the date of acceptance.

Data importer. Lathe Studio LLC, 1309 Coffeen Ave STE 1200, Sheridan, Wyoming 82801, United States. Contact for data protection matters: privacy@lathe.studio. Activities relevant to the data transferred: provision of the hosted test management platform and related support under the Terms. Role: processor or, under Module Three, sub-processor. Signature and date: by acceptance of the Terms by the Customer, on the date of acceptance.

B. Description of Transfer

Categories of data subjects. Users authorized by the Customer, including its employees, contractors, and agents; individuals whose personal data the Customer includes in Customer Content, such as members of its staff, its own customers or end users, and other persons referenced in test cases, test data, comments, or attachments; recipients of messages that the Service sends on the Customer’s behalf; and senders and recipients of messages delivered to test email inboxes that the Customer uses within the Service.

Categories of personal data. Names, email addresses, profile pictures, roles, and Organization memberships of Users, as reflected in the Customer’s Organization records; Customer Content, including test cases, test runs, results, comments, attachments, avatars, and exports, together with any personal data the Customer places in them; data exchanged with Integrations that the Customer connects; addresses and content of transactional messages such as invitations, reports, and alerts; addresses and content of messages received in test email inboxes; audit-log records of the actions taken within the Organization, including support sessions; API usage records consisting of the API Key identifier, the endpoint called, and the time of the call; error reports and application logs, redacted within the Service before transmission; and IP addresses and request details of Users.

Sensitive data. No special categories of personal data, and no data relating to criminal convictions or offenses, are intended to be transferred, and the Customer undertakes not to submit such data under Section 2.3. Should any be submitted in breach of that undertaking, it is protected by the measures in Annex II, including encryption, access limited by Organization, project, and role, and the restrictions on access by Lathe Studio personnel.

Frequency of the transfer. Continuous, for the duration of the Terms.

Nature of the processing. Collection through the Service, recording, organization, structuring, storage, retrieval, consultation, display, transmission to Integrations configured by the Customer, export, pseudonymization of audit-log entries, and erasure.

Purposes of the transfer and further processing. Hosting and storing Customer Content and making it available to the Customer’s Users; executing the test management functions the Users invoke; exchanging data with the Integrations the Customer connects; sending invitations, reports, alerts, and other messages the Service generates; maintaining the audit log and API usage records of the Organization; enforcing rate limits and preventing abuse; diagnosing and correcting faults; exporting data at the Customer’s request; and providing support through time-limited support sessions opened by Lathe Studio support personnel for the reasons, and with the safeguards, described in Annex II.

Retention period. Customer Content is deleted as Section 10.2 provides; audit-log entries are kept for twelve (12) months from each entry and are pseudonymized upon deletion of the User or Organization; API usage logs and integration event logs are kept for ninety (90) days; error reports and application logs held by the error-monitoring Sub-processor, for ninety (90) days; outgoing webhook delivery records, request logs held by the hosting Sub-processor, and delivery logs of transactional email, for thirty (30) days; API retry keys, for forty-eight (48) hours; and test email inboxes provided within the Service, with their events, for thirty (30) days.

Transfers to Sub-processors. Each Sub-processor listed in Annex III processes Customer Personal Data for the subject matter and with the nature described in that Annex, for as long as the DPA remains in force or until Lathe Studio ceases to engage it.

C. Competent Supervisory Authority

Where the Customer is established in a Member State of the European Union, the competent supervisory authority is the authority responsible for ensuring the Customer’s compliance with the GDPR as regards the transfer. If the Customer is not established in the European Union but falls within the territorial scope of the GDPR under its Article 3(2) and has appointed a representative under Article 27(1), the competent supervisory authority is that of the Member State in which the representative is established. For a Customer that is not established in the European Union, falls within Article 3(2), and is not required to appoint a representative under Article 27(2), the competent supervisory authority is that of the Member State, among those in which the data subjects concerned are located, that the Customer identifies to Lathe Studio upon request. As regards transfers subject to the UK Data Protection Laws, the competent authority is the Information Commission.

Annex II: Technical and Organizational Measures

Encryption. All data is encrypted in transit using Transport Layer Security and is encrypted at rest by the database and file-storage platform. Integration credentials, namely OAuth tokens for Jira and Azure DevOps and webhook URLs for Slack and Microsoft Teams, receive a second, application-level layer of encryption using AES-256-GCM.

Authorization and logical separation. Every request to the application is checked within the application code against the Organization, the project, and the role of the requesting User, so that Users can reach only the data of the Organizations and projects to which they belong. All Customers share a single hosting region, and the separation between Organizations is enforced by those authorization checks.

Authentication. Users authenticate through a dedicated identity provider by email or through social sign-on with Google or another sign-on provider that Lathe Studio offers. Sessions rely on short-lived session tokens that are renewed automatically, and API access requires API Keys created and revocable by the Customer.

Access by Lathe Studio personnel. Customers cannot currently grant or revoke support access through the Service. Personnel of Lathe Studio reach Customer Content only through support sessions, which they may open for four reasons only: to resolve a support request, to investigate a fault, to comply with a legal obligation, or to respond to a security incident. Each session starts with a reason recorded by the support staff member, ends automatically no later than thirty (30) minutes after it starts, and cannot be revoked by the Customer while it runs. Every session is entered in the Customer’s audit log under the label “Lathe support,” without naming the individual staff member. Personnel authorized to process Customer Personal Data are bound by confidentiality obligations.

Logging and accountability. An audit log and an admin audit log record who performed which action and when, and API usage logs record the API Key identifier, endpoint, and time of each call, each retained as stated in Annex I.B.

Error monitoring with data scrubbing. Scrubbing is performed within the application before any error report or application log is sent to the error-monitoring Sub-processor: IP addresses, cookies, and request headers are never attached, and email addresses, names, and other sensitive fields are redacted.

Abuse prevention and availability. Rate limits are enforced through short-lived counters, keyed by API Key identifier for calls to the API and kept for a few minutes, protecting the Service against abuse and overload. The database is backed up daily, so that the Service can be restored after a fault or a loss of the live system, and each backup expires as Section 10.2 provides.

Data minimization in bug reporting. Screenshots and screen recordings captured on a tester’s device to file a defect are uploaded directly from that device to the Customer’s own issue tracker and are never stored by Lathe Studio.

Retention and deletion. Deletion periods for Customer Content and for each category of log are enforced by automated jobs in accordance with Section 10 and Annex I.B. Audit-log entries of deleted Users and Organizations are pseudonymized by replacing the identity with a keyed hash and redacting email addresses.

Data portability. While the Organization is active, Admins can export all Organization data as a ZIP archive at any time.

Sub-processor management. Sub-processors are engaged only under written contracts that impose data protection obligations consistent with the DPA, as Section 6.4 requires. Physical security of data centers is provided by the infrastructure providers listed in Annex III under their own security programs.

Incident management. Personal Data Breaches are handled and notified in accordance with Section 8.

Annex III: List of Sub-processors

The Customer authorizes the engagement of the following Sub-processors. Vendors that process only personal data for which Lathe Studio acts as an independent controller, such as the payment processor and the website analytics provider, are described in the Privacy Policy and are not Sub-processors under the DPA; the same applies to the provider of rate-limit counters, whose counters, keyed by API Key identifier or, for the website contact form, by IP address, and kept for a few minutes, serve the protection of Lathe Studio’s own systems against abuse under Section 2.2.