1. Roles and instructions
The customer is controller and Conforvia is processor for customer personal data, except where each party independently controls account, billing, security, or legal-compliance data. Conforvia will process customer personal data only to provide, secure, support, and improve the contracted service; follow documented customer instructions; and meet applicable law.
2. Processing details
| Subject | Furniture product compliance, supplier evidence, technical files, controlled reviews, and Digital Product Passports. |
|---|---|
| Duration | The service term plus controlled return, deletion, backup, audit, and legal-retention periods. |
| People | Customer users, supplier and facility contacts, reviewers, authorized recipients, and public-passport correspondents. |
| Data | Identity and contact details, organization role, product-linked professional information, correspondence, uploaded evidence, access records, and review decisions. |
| Purpose | Hosting, organizing, reviewing, securing, backing up, disclosing, and supporting the customer's governed compliance workflow. |
3. Confidentiality and security
People authorized to process customer personal data are bound by confidentiality. Conforvia maintains measures appropriate to the service, including access control, encrypted transport, private storage, integrity verification, operational monitoring, backups, and incident governance. Additional detail appears on the Security page.
4. Subprocessors and transfers
The customer authorizes the providers listed at /subprocessors. Conforvia remains responsible for their processing under this addendum and will use an appropriate transfer mechanism when personal data is transferred internationally. A customer may object to a new subprocessor on reasonable data-protection grounds by contacting us promptly after notice.
5. Assistance and incidents
Taking into account the nature of processing and available information, Conforvia will reasonably assist with data-subject requests, security, breach assessment, impact assessments, and regulator consultations. We will notify the customer without undue delay after confirming a personal data breach affecting its customer data and provide available material information as investigation progresses.
6. Return, deletion, and audit information
At the end of service, the customer may request an available export and deletion, subject to legal retention, immutable audit facts, and the controlled removal of eligible recovery copies. We will provide information reasonably necessary to demonstrate compliance with this addendum. Any inspection must protect other customers, security, and confidential systems.
7. Priority and execution
This addendum controls over conflicting data-processing language in the general Terms. A signed order form may identify the parties, governing law, approved transfer terms, and additional measures. To request an executable copy, email the verified contact published when self-service terms activate.