Data Processing Addendum

2026-09-20 · This addendum is incorporated into the Terms of Service and applies where MadeToOrder OS processes personal data on a customer's behalf. It implements GDPR Article 28; the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two — controller to processor) are incorporated by reference and prevail over conflicting terms.

1. Roles and instructions

Customer is controller; MadeToOrder OS (Erkan Bircan (Selvola)) is processor. Processing occurs only on the customer's documented instructions through the product's features (this agreement is itself such an instruction).

2. Subject matter, duration, categories

Job/proof/production management for the customer's business; for the subscription term plus retention periods; categories: end-customer contact data, personalization content, uploaded design files, order and production records, and the customer's staff account data.

3. Confidentiality and security

Personnel are bound by confidentiality. Measures include TLS in transit, tenant isolation via PostgreSQL row-level security with deny-by-default policies, least-privilege roles, append-only audit ledgers, hashed credentials and tokens, rate limiting, CSRF protection, checksummed encrypted backups with restore drills, and 90-day backup rotation.

4. Sub-processors

The current list is at /subprocessors. Customers are notified at least 30 days before a new sub-processor is added (the page's update date is the notice); objection right follows the SCCs.

5. Data-subject requests and assistance

The product provides export and deletion tooling to the customer, who answers data-subject requests directly; we assist where the customer cannot reasonably act alone.

6. Breaches

We notify affected customers without undue delay (target 72 hours) with what we know of the nature, scope and likely consequences.

7. Return and deletion

On termination the customer may export; thereafter deletion follows the published retention policy, with legally-retained commercial records kept in restricted form.

8. Audits

Customers may request evidence of compliance (documentation of the measures above); on-site audits are subject to the SCCs.