Draft for review — to be finalized with legal counsel before launch.

Data processing

• For the data your organization keeps in Apirel, your organization is the controller and Apirel is the processor.
• Your data is hosted in Japan.
• Our data processing agreement and the list of sub-processors are available on request. We give 30 days' notice before adding a new sub-processor.
• We report personal data breaches to you within 48 hours of confirmation.