Data Storage and Security

1. Purpose

This statement describes how Darling MGMT stores, protects and manages data processed through the Darling platform.

2. Where data is stored

Darling uses cloud-based infrastructure for storing and processing platform data. Data is stored by default on server infrastructure in the USA. Personal data may therefore be transferred to and processed in the USA or other countries where sub-processors operate. Relevant technical, organizational and legal security measures are applied for international processing.

3. Types of data that may be stored

Account details: name, email, phone number, authentication information, business information and profile information.

Business data: customers, leads, assignments, campaigns, collaborations, contracts, tasks, calendar information, invoices and payment status.

Documents and user content: documents, contracts, text, images and other content the user chooses to store.

Technical data: IP addresses, login logs, system logs, device information, browser information, security events and service usage information.

4. Storage and encryption

Data in transit is protected through encrypted communication. Stored data is protected with encryption and access controls. The platform's underlying cloud infrastructure uses secure access management and technical security mechanisms to reduce the risk of unauthorized access.

5. Access to data

Access to user data is restricted and granted when necessary to deliver the service, maintain the system, handle technical issues, maintain security, provide customer support or fulfill legal obligations.

6. AI and processing of user data

Darling offers AI-based features that can process information the user enters into the platform, such as contracts, assignment information, customer data, tasks and text. AI processing takes place to deliver the relevant feature. Darling does not sell user data to third parties.

7. Data processors and sub-processors

Darling may use technology providers for cloud hosting, database and data storage, server operations, email, analytics, logging, security, payment processing and AI/API services. The providers shall maintain confidentiality, security and privacy.

8. Backups

Darling may use backups to protect against technical errors, system failures, accidental deletion, data loss and security incidents. Backups may retain deleted data for a limited period before being overwritten or deleted.

9. Retention periods

Darling follows the principle that personal data shall not be kept longer than necessary.

10. Deletion

Users may request deletion of personal data by contacting Darling. Data is deleted or anonymized within a reasonable time, unless retention is necessary due to legal requirements, accounting or tax rules, security purposes, legal claims, ongoing disputes or other legitimate documented needs. Deletion from backups may occur later.

11. International data processing

For users covered by GDPR, transfers to third countries shall be carried out in accordance with the requirements for international data transfers, including through adequacy decisions, Standard Contractual Clauses or other approved mechanisms where necessary.

12. Data security

Security measures may include encryption, secure authentication, access control, role-based access, logging, security monitoring, automated security controls, backup and procedures for handling security incidents.

13. Security incidents and data breaches

If Darling becomes aware of a security breach that poses a risk to personal data, the incident is handled in accordance with applicable law and internal procedures, including assessment, mitigation, documentation and any notification.

14. User responsibility

The user is responsible for protecting login credentials, only entering personal data the user has a legal basis to process, reviewing information before sharing it and ensuring the information is relevant and necessary. The user may be the data controller for personal data about their own customers and partners.

15. Changes

This document may be updated if Darling changes technical infrastructure, providers, security procedures or storage practices.

16. Contact

TailorHeaven AS

Kvernelandsvegen 327

4355 Kverneland

Norway

Email: gunn@darlingmgmt.ai

Overview of retention periods