BUSINESS MANAGEMENT SYSTEM — DATA PROCESSING ADDENDUM
Version: 2026-09-22-v4
Operator: CHRISTOVEMPIRE LTD

Where the Customer is controller and BMS is processor, this DPA forms part of the BMS Terms.

PROCESSING INSTRUCTIONS
BMS will process Customer Personal Data only to provide, secure, localize, back up, recover and support the service and on documented Customer instructions, unless applicable law requires otherwise.

SECURITY AND CONFIDENTIALITY
BMS will apply appropriate technical and organizational safeguards, including tenant/role/branch access controls, authenticated sessions, browser/edge protections, rate limiting, protected backups and recovery controls. Persons authorized to process Customer Personal Data must be subject to confidentiality obligations.

DATA-SUBJECT AND SECURITY ASSISTANCE
BMS will reasonably assist the Customer with applicable data-subject requests, security obligations, breach response and information reasonably needed to demonstrate processor commitments. Relevant personal-data breaches will be communicated without undue delay as required by applicable law and the parties' roles.

SUBPROCESSORS AND INTERNATIONAL TRANSFERS
The Customer authorizes the subprocessors published by BMS, subject to appropriate data-protection obligations. Where cross-border transfer laws require safeguards, BMS will use legally recognized transfer mechanisms as applicable.

END OF SERVICE
BMS will delete or return Customer Personal Data at the end of services subject to legal retention, verified Customer instructions, dispute/security needs and normal protected-backup expiry.

CUSTOMER RESPONSIBILITIES
The Customer remains responsible for lawful instructions, legal bases, notices, user permissions, employee/customer privacy obligations and the accuracy of the data it places in BMS.