Data Processing Addendum

For personal data processed to deliver Employer of Record services, the client is the data controller and AppTuring acts as processor, except where local employment law makes AppTuring a controller of employee data as the legal employer.

AppTuring processes personal data only on documented instructions from the client and as required to provide the services and comply with applicable law.

We maintain technical and organizational measures appropriate to the risk, including encryption in transit, access controls on a need-to-know basis, and regular review of our security practices.

We engage vetted sub-processors (for example, payroll, email, form handling, and analytics providers) under written terms that impose data-protection obligations no less protective than this addendum. A current list is available on request.

Where personal data is transferred between the United States, Vietnam, or other jurisdictions, we apply appropriate safeguards, including standard contractual clauses where required.

We assist the client in responding to data-subject requests and notify the client without undue delay after becoming aware of a personal-data breach affecting their data.

On termination, we return or delete personal data processed on the client’s behalf, except where retention is required by law.

To receive the full, signable DPA, email legal@appturing.com.