We act as a processor for client‑supplied personal data. We follow documented instructions, apply appropriate technical and organizational measures, assist with data subject requests, notify of incidents without undue delay, and use sub‑processors only with notice. Upon termination, we delete or return personal data.