Last updated 22 April 2026
Who this applies to
This Data Processing Addendum forms part of the Revclust agreement between ASTROSCEND LIMITED and the organization using Revclust where ASTROSCEND LIMITED processes customer personal data as processor on that organization's behalf.
This addendum does not apply to data that ASTROSCEND LIMITED handles as controller, including public site data, sign-in and session checks, workspace access records, and support or feedback records. Those activities are described in our Privacy and Cookie Policy.
Scope
This addendum applies only to customer personal data contained in incident packs and related hosted handoff content that an organization asks Revclust to host, retrieve, render, deliver, or delete on its behalf.
The organization using Revclust remains responsible for deciding what personal data it submits through the service and for making sure it has a valid legal basis to collect and disclose that data to Revclust.
Processing on instructions
Revclust will process customer personal data only on the organization's documented instructions, unless applicable law requires otherwise.
If applicable law requires Revclust to process customer personal data otherwise than on the organization's instructions, Revclust will notify the organization before that processing unless the law prohibits that notice.
Revclust will immediately inform the organization if, in Revclust's opinion, an instruction infringes applicable data protection law.
The organization instructs Revclust to host, validate, store, retrieve, render, secure, support, offboard, return, and delete customer personal data as needed to provide the service.
Confidentiality and security
Revclust will ensure that people authorized to process customer personal data are subject to an appropriate duty of confidentiality.
Revclust will implement and maintain appropriate technical and organizational measures designed to protect customer personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or unauthorized access.
Sub-processors
The organization gives Revclust general authorization to use sub-processors for customer personal data, provided Revclust imposes data protection obligations on them that are no less protective than those in this addendum, to the extent relevant to their services.
Revclust remains responsible for the performance of its sub-processors to the extent required by applicable law.
The current live sub-processors for customer personal data are Supabase for database and storage, Resend for transactional email delivery where customer personal data is included in those emails, and Vercel for hosting and runtime delivery.
Revclust will give written notice of intended new or replacement sub-processors through the customer contact on record, or another written channel reasonably likely to reach the organization, and will allow a reasonable opportunity to raise a good-faith objection on data protection grounds before the change takes effect.
Rights, breaches, and incidents
Taking into account the nature of the processing, Revclust will provide reasonable assistance to help the organization respond to data subject rights requests relating to customer personal data.
Revclust will notify the organization without undue delay after becoming aware of a personal data breach affecting customer personal data.
Revclust will also provide reasonable assistance with security incident response, data protection impact assessments, and regulator consultations where applicable law requires that help and the relevant information is available to Revclust.
Return and deletion
When the relevant service relationship ends, or earlier on the organization's written instruction, Revclust will return or delete customer personal data, at the organization's choice, unless applicable law requires continued storage.
Revclust does not currently provide a dedicated bulk export flow. Where return is requested first, Revclust may complete that return through the then-current reasonable retrieval or handoff method available in the service.
Return and deletion will be carried out using the retrieval, deletion, and offboarding steps reasonably available in Revclust at the time, including manual operator handling where the service does not provide a dedicated automated workflow.
Revclust may retain limited data only where continued retention is required for legal obligations, security investigations, unresolved disputes, or technically unavoidable backup and restore cycles.
International transfers
Where Revclust or its sub-processors process customer personal data outside the UK, Revclust will ensure that the transfer is subject to a lawful transfer mechanism, such as standard contractual clauses, the UK addendum, or another transfer safeguard recognized by applicable law.
Information and audit rights
Revclust will make available the information reasonably necessary to demonstrate compliance with this addendum.
Where that information is not reasonably sufficient, Revclust will permit reasonable audits or inspections by the organization, or an auditor it appoints, subject to reasonable prior written notice, appropriate confidentiality protections, remote or documentary review first where that is sufficient, no unnecessary disruption to Revclust or other customers, and no more than one audit in any 12-month period unless required by law or triggered by a material security incident affecting customer personal data.
The organization will bear its own audit costs unless applicable law requires otherwise.
Processing details
Subject matter: the hosted storage, validation, retrieval, rendering, review, and handoff of incident packs and related hosted handoff content through Revclust.
Duration: for the duration of the services involving customer personal data, plus any return or deletion period and any limited continued retention permitted under this addendum.
Categories of data subjects and personal data: any individuals referenced in customer-submitted incident packs or related hosted handoff content, and any personal data the organization chooses to include in that content.
Contact
Questions about this addendum: support@revclust.com.