# Asterly Data Processing Addendum — draft template

Last updated: 25 October 2026

Draft: not yet reviewed by a lawyer.

Summary: This is an unsigned starting point for B2B processing, not an operative agreement. Complete the parties, schedules, safeguards and transfer terms with counsel and verify implementation before signing.

## 1. Parties and agreement

Customer/controller: [legal name, address, contact]. Processor: Asterly, operated by Yash Vardhan, India. Legal entity: [placeholder — not yet formed]. Postal address: [placeholder — needs Yash]. Main agreement: [identify]. Effective contract date: [agree]. Controller/processor include equivalent roles under applicable law where appropriate. Confirm governing law, precedence, liability and costs against the main agreement; mandatory duties cannot be waived.

## 2. Processing and instructions

Asterly shall process customer personal data only on documented lawful instructions to provide recording, screenshot storage, AI-assisted drafting, editing, export and customer-directed publication of guides. No use for training Asterly's own models or unrelated advertising. Asterly shall inform the customer if it believes an instruction infringes applicable data-protection law. Legally compelled processing/disclosure shall be notified beforehand unless prohibited.

Subject matter: customer workflow documentation. Nature: collection/receipt, storage, retrieval, editing, transmission to approved providers, publication on instruction and deletion. Duration: service term plus agreed deletion period. Subjects: customer personnel, end users and others in authorised content. Categories: screenshot pixels, visible names/emails, page paths, click/target metadata, guide text and author/reviewer notes. Special-category, payment-card, credential and children's data are excluded from the intended scope; customer must keep them out.

Customer shall establish lawful grounds and notices for recording and provide lawful instructions. Asterly remains separately responsible for processing where it determines its own account/security purposes; identify this boundary in Schedule 1.

## 3. Confidentiality and security

Asterly shall bind authorised people to confidentiality, limit access to need and implement the technical/organisational measures agreed in Schedule 2. Complete that schedule from verified controls; do not substitute generic assurances. Address transport/storage security, isolation, authentication, operator access, incident response, backup recovery, deletion and testing. Any proposed control not yet operational must be expressly identified and resolved before reliance.

## 4. Assistance and incidents

Taking account of the processing and information available, Asterly shall assist the customer with data-subject requests, security duties, impact assessments and regulator consultations required by applicable law. Send requests concerning customer-controlled content to the customer and act on its instructions unless law requires otherwise.

Asterly shall notify the customer without undue delay after becoming aware of a personal-data breach, share available nature/scope/impact/contact/mitigation information and provide updates as facts emerge. Proposed initial target: 24 hours [negotiate and validate capability]. Do not delay initial notice for complete information. Customer/regulatory duties and statutory clocks remain applicable; no unsupported regulatory notification promise is made.

## 5. Subprocessors

Attach approved legal entities, purposes, data and countries in Schedule 3. Proposed general authorisation: at least 30 days' advance notice of additions/replacements with a reasonable data-protection objection route, resolution process and termination option if unresolved [agree details]. Impose equivalent required obligations on subprocessors and allocate Asterly's responsibility for performance as required by law. The public draft register is not proof of executed contracts or live provider settings.

## 6. International transfers

Map transfers to India, Seoul/South Korea, US and all onward processing. Applicable adequacy reliance, EU SCC module(s), UK Addendum/IDTA, transfer assessments and supplementary measures: [confirm with counsel]. Execute and attach required instruments with exporter/importer details in Schedule 4. This template neither executes clauses nor establishes lawful transfers by itself.

## 7. Return and deletion

On termination or customer instruction, return or delete personal data at the customer's choice unless law requires specific retention. Proposed active-system removal within 30 days and backup expiry within 90 days [approve and implement]. Restrict retained data to its lawful purpose, prevent restoration of deleted data, propagate instructions to processors and provide a completion statement with exceptions. Account-wide export, backup deletion and retry handling are not yet verified capabilities. Public downloads, indexing and caches outside the parties' control cannot be recalled.

## 8. Demonstration and audits

Asterly shall provide reasonable compliance information and permit proportionate audits/inspections required by applicable law under agreed confidentiality, scope and notice. Do not obstruct regulator rights. Disclose material inability to follow instructions or meet agreed safeguards. Commercial costs, audit mechanics and main-agreement remedies: [agree with counsel].

## Schedules to complete before signature

1. Customer and processor contacts; main agreement; purpose; duration; data subjects and categories; detailed instructions; excluded data; controller/processor boundary.
2. Verified security measures; access, hashing, transport/storage encryption, isolation, incident response, backup recovery, testing, retention and deletion. Include unresolved gaps explicitly.
3. Approved subprocessor legal entities, purposes, data categories, processing/support/backup countries, onward routes, contractual safeguards and change/objection contacts.
4. Applicable executed transfer instruments, roles/modules, annexes, assessments and supplementary measures.

Customer signature: [name, authority, date].

Processor signature: [Yash Vardhan / verified contracting entity, authority, date].

Contact: hello@asterly.co [mailbox must be confirmed by Yash]. privacy@asterly.co is an unverified proposed alias.