Data Processing Addendum
Last updated October 26, 2026
Draft: this document hasn't been reviewed by counsel yet and isn't in force. It describes how the service works today; the final version will replace it.
This addendum is part of the Terms of Service when an organization uses Underpass and we process personal data on its behalf. The organization is the controller; Sukses360 Ltd is the processor.
1. Scope
It covers personal data in the customer's workspace: its members' account details, data about their devices, and the workspace's audit and network logs. It applies under the GDPR, the UK GDPR, the CCPA and similar laws, as far as they apply.
2. Processing on instructions
- We process the data only to provide the service, on the customer's documented instructions: the Terms, the dashboard settings it chooses, and requests it makes in writing.
- We tell the customer if we think an instruction breaks the law.
- We don't sell the data or use it for our own purposes beyond running, securing and supporting the service.
3. Details of processing
| Subjects | The customer's members, invitees and the people who use its devices |
| Data | Names, emails, IP addresses, device names and metadata, connection and audit records |
| Purpose | Providing the private network service and its dashboard |
| Duration | For the term of the agreement, then deletion as in section 9 |
4. Our people
Everyone at Sukses360 Ltd who can access the data is bound by confidentiality and gets access only as their role needs.
5. Security
We keep appropriate technical and organizational measures, including encryption in transit (TLS, WireGuard), encrypted backups, access to production systems limited to the people who need it, and isolation between workspaces. They're described on our Security & Disclosure page.
6. Subprocessors
The customer authorizes the subprocessors on our Subprocessors page. We give at least 30 days' notice of new ones there; the customer may object on reasonable data-protection grounds, and if we can't address the objection, it may end the affected service. We bind each subprocessor to terms at least as protective as these and remain responsible for it.
7. International transfers
Where data leaves the EEA, the UK or Switzerland for a country without an adequacy decision, the European Commission's Standard Contractual Clauses (Module 2 or 3, as fits) and the UK Addendum apply and are incorporated by reference.
8. Assistance and breaches
- We help the customer answer data subjects' requests, and with impact assessments and consultations where needed.
- We notify the customer without undue delay, and within 72 hours of becoming aware, of a personal data breach affecting its data, with the information we have.
9. Deletion and return
When the agreement ends, or on request, we delete the customer's data within 30 days, except where the law requires us to keep it. Encrypted backups expire within a further 30 days. The customer can export its data before then through the dashboard and API.
10. Audits
We answer reasonable written security questionnaires once a year. Where that isn't enough to show compliance, the customer may audit us with 30 days' notice, at its cost, during business hours and under confidentiality.
11. Contact
To sign a copy of this addendum, or for questions: privacy@getunderpass.com.
Underpass is operated by Sukses360 Ltd · [Registered address]