This Security Addendum (“Addendum”) forms part of the agreement between TechForge Media (“Company”) and its customers (“Customer”) regarding the provision of services by the Company. The purpose of this Addendum is to outline the security commitments and obligations of the Company in relation to the protection and safeguarding of Customer data. This Addendum applies to all services provided by the Company.

1. Scope and Purpose

TechForge Media is committed to maintaining robust security practices that protect Customer data. This Addendum outlines the following key security responsibilities:

• Data Protection and Privacy
• Access Controls
• Incident Response
• Monitoring and Logging
• Sub-Processor Management
• Vulnerability Management
• Data Retention and Deletion

The Company will ensure compliance with applicable privacy regulations, including the General Data Protection Regulation (GDPR).

2. Security Responsibilities

TechForge Media implements the following security controls and practices:

• Data Protection: Customer data is encrypted both at rest and in transit using industry-standard encryption protocols (e.g., AES-256, TLS 1.2 or higher). Data is stored securely and handled in accordance with applicable privacy regulations.
• Access Controls: The Company uses multi-factor authentication (MFA) and role-based access control to restrict access to Customer data to authorized personnel only. All access to systems is governed by the principle of least privilege.
• Monitoring and Logging: The Company actively monitors its systems for potential security incidents, using logging and auditing mechanisms to track access and other security-related events.
• Physical Security: If applicable, physical access to data centers or hardware is restricted to authorized personnel, and the Company follows industry best practices for physical security.

3. Incident Management

In the event of a security incident, TechForge Media will:

• Notify the Customer of any confirmed breaches involving Customer data within 24 hours of discovering the breach.
• Follow a predefined incident response plan to mitigate, respond to, and report on security incidents.
• Cooperate with the Customer during incident investigations and provide timely updates, as well as a post-incident report detailing the scope and impact of the incident.

4. Sub-Processors

TechForge Media does not engage third-party sub-processors in the processing of Customer data. Should the need arise in the future, Customers will be informed in advance, and any sub-processors will be subject to strict security vetting.

5. Data Retention and Deletion

The Company will retain Customer data only for as long as necessary to fulfill the purposes outlined in the service agreement or as required by law. Upon termination of the contract or at the Customer’s request, the Company will securely delete or anonymize all Customer data within 30 days, except where legal obligations require otherwise.

6. Data Subject Rights

In compliance with applicable data protection laws, TechForge Media will:

• Provide data subjects with access to their personal data upon request.
• Fulfill such requests within 30 days, or within a shorter timeframe if required by local law (e.g., 15 days under the CCPA).
• Data subject requests for access, rectification, or erasure can be submitted via email at [query@techforge.pub]. The Company will verify the identity of the requester to ensure privacy before providing any personal data.

7. Changes to Security Practices

If TechForge Media makes any material changes to its security practices, it will notify Customers by email within 24 hours of the changes. The notification will detail the nature of the changes and their potential impact on Customer data.

8. Jurisdiction and Governing Law

This Security Addendum and any disputes arising out of or in connection with it will be governed by and construed in accordance with the laws of England and Wales. The courts of London, United Kingdom, shall have exclusive jurisdiction over any disputes related to this Addendum.

This Addendum is effective as of the date it is incorporated into the applicable service agreement between TechForge Media and the Customer.