1. Scope and Roles
1.1 This Addendum applies to Block Aero's processing of personal data contained in Customer Data ("Customer Personal Data") in providing the Services.
1.2 The Customer is the controller (or a processor acting for another controller, in which case it warrants its instructions are authorized); Block Aero is the processor. Block Aero processes Customer Personal Data only on the Customer's documented instructions — this Agreement, the Order Form, and the Customer's configuration and use of the Services — unless Applicable Laws require otherwise, in which case Block Aero informs the Customer unless legally prohibited.
1.3 Applicable data protection laws include, as relevant to the Customer: the Hong Kong PDPO, the Thailand PDPA, and the EU/UK GDPR ("Data Protection Laws").
2. Details of Processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Block Aero platform: digital asset passports, records management, data packages, registries, integrations, AI Services. |
| Duration | The Subscription Term plus the retention/disposal period in Clause 8 of this Addendum. |
| Nature and purpose | Hosting, storage, organization, structuring, retrieval, disclosure per Customer instruction, and deletion (off-chain) of Customer Data to deliver the Services. |
| Categories of data subjects | Customer's and its counterparties' personnel appearing in business records: Authorized Users; signatories and certifying staff named on aviation documents (e.g., release certificates); business contacts. |
| Categories of personal data | Business contact data (names, work emails, phone, role); account and authentication data; names/titles/signatures on aviation documentation; usage and log data. No special categories are required by the Services; the Customer shall not upload them. |
3. Confidentiality and Personnel
3.1 Block Aero ensures persons authorized to process Customer Personal Data are bound by confidentiality obligations, have accepted the ISMS policy suite, and receive security training, per the Human Resource Security Policy.
4. Security
4.1 Block Aero implements and maintains the technical and organizational measures in Annex II, anchored in its ISMS certified to ISO/IEC 27001:2022 (current certificate available via the Trust Center) and its Data Management Policy, under which Customer Data is classified "Confidential" — the highest protection class.
5. Subprocessors
5.1 The Customer generally authorizes the subprocessors in Annex III. Block Aero shall: impose data protection obligations materially equivalent to this Addendum on each subprocessor; remain liable for their performance; and give at least thirty (30) days' notice of intended additions or replacements (via the Trust Center or email), during which the Customer may object on reasonable data-protection grounds. If the objection cannot be resolved, the Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for them.
6. International Transfers
6.1 Hosting regions. The default hosting region is Japan. The Customer may select another available hosting region in the Order Form — currently the United States, Europe, the United Kingdom, the United Arab Emirates, and Singapore — and content delivery for the Hong Kong and China regions is provided through the CDN subprocessor listed in Annex III. Customer Personal Data may also be processed in the locations of the subprocessors in Annex III.
6.2 Transfer mechanisms. Where a transfer is subject to GDPR Chapter V or equivalent, the Parties rely on: (a) the EU Standard Contractual Clauses (Module 2), incorporated by reference and deemed executed on execution of the Order Form, with the UK Addendum where applicable; and (b) for other regimes, the safeguards those Data Protection Laws require.
7. Assistance
7.1 Taking into account the nature of processing, Block Aero shall reasonably assist the Customer with: data subject requests it receives (forwarded without undue delay; requests may be sent to support@block.aero); security of processing; breach notifications to authorities or data subjects; and data protection impact assessments — the Customer bearing Block Aero's reasonable costs for non-standard assistance.
8. Deletion, Return and the Ledger
8.1 Off-chain data. On termination, Clause 3.5 of the Agreement applies: return of the latest back-up on timely request, then secure disposal per the Data Management Policy, retaining only what documented retention rules or Applicable Laws require. PII is deleted or de-identified when it no longer has a business use.
8.2 On-chain data. Data recorded on the Blockchain Network cannot be deleted or altered (Agreement Clause 16.3). The Parties agree the appropriate safeguards are the preventive controls in Agreement Clauses 16.1–16.2: personal data belongs in Private Data; on-chain use is minimized, hashed, or encrypted. The Customer instructs Block Aero to operate the ledger accordingly and acknowledges deletion obligations are discharged for on-chain data by these measures to the extent permitted by Data Protection Laws.
9. Personal Data Breach
9.1 Block Aero shall notify the Customer without undue delay, and in any event within seventy-two (72) hours of confirming a personal data breach affecting Customer Personal Data, providing the information reasonably available (nature, categories, approximate volumes, likely consequences, measures taken), supplemented as investigation proceeds, per Block Aero's documented incident response process.
10. Audit
10.1 Block Aero demonstrates compliance through: its ISO/IEC 27001:2022 certificate; summaries of penetration tests and audit reports; and Trust Center documentation. Where Data Protection Laws entitle the Customer to more, Block Aero shall respond to a written audit questionnaire once per year; on-site audits are available only for SL IV Customers per the Order Form, on thirty (30) days' notice, during business hours, under confidentiality, at the Customer's cost.
11. Liability and Precedence
11.1 The liability regime in Agreement Clause 26 applies to this Addendum. If this Addendum conflicts with the Agreement on data protection matters, this Addendum prevails; mandatory SCC terms prevail over both.
Annex I — Processing Details
As set out in Section 2 of this Addendum.
Annex II — Technical and Organizational Measures
Anchored in the ISO/IEC 27001:2022-certified ISMS and the published policy suite (Trust Center):
| Domain | Measures |
|---|---|
| Governance | Executive-owned ISMS; annual internal audit, management review, and legal/regulatory register review; Statement of Applicability; corrective action tracking. |
| Access control | Role-based, least-privilege access; need-to-know for Confidential class; no unauthenticated access to confidential systems; joiner/mover/ leaver reviews; strong authentication controls for administrative access. |
| Encryption | Customer Data encrypted in transit over public networks and at rest; encrypted backups; key management per Cryptography Policy. |
| Environment segregation | Sandbox, production, and private channels segregated; Customer Data not used or stored in non-production environments (Data Management Policy). |
| Ledger integrity | Permissioned distributed ledger; endorsement policies restrict write access to verified organizations; signed, timestamped writes. |
| Devices and media | Device encryption, screen-lock, no confidential data on personal devices or removable media; secure wipe or destruction before disposal. |
| Resilience | Business continuity and disaster recovery plans exercised; encrypted backups; annual penetration testing. |
| Suppliers | Tiered vendor security assessment; DPAs with subprocessors handling Customer Data (Third-Party Management Policy). |
| Incident response | Documented incident response plan with root-cause analysis and corrective actions; customer notification per Section 9. |
| Personnel | Confidentiality undertakings; ISMS policy acceptance by all personnel; security awareness training. |
Annex III — Authorized Subprocessors
| Subprocessor | Service | Location / region |
|---|---|---|
| Amazon Web Services | Cloud hosting of platform, nodes, and storage (default provider) | Default region: Japan. Available on request: United States, Europe, United Kingdom, United Arab Emirates, Singapore |
| Google Cloud | Cloud hosting of platform, nodes, and storage (supported alternative) | Default region options, where offered |
| Notey Inc. | Content delivery network (CDN) | Hong Kong and China regions |
| Block Aero Technologies (Thailand) Ltd | Development and operations (wholly-owned subsidiary) | Thailand |
The current subprocessor list is maintained at the Trust Center; changes are notified per Section 5.
← Back to the General Terms Agreement