Data Processing Addendum

Data Processing Addendum

This Data Processing Addendum forms part of the Terms of Service for Customer Personal Data processed on the customer’s behalf. It is effective for the customer upon valid acceptance of the Terms incorporating it or a separate written adoption. The parties are Baruch Holdings LLC and the individual or legal entity identified as the customer in the accepted account or order record (the “Customer”). References to numbered sections in this Part and its annexes refer to this Addendum unless stated otherwise.

The underlying agreement is the accepted EarnCommand Terms version and applicable order, or a separately signed service agreement expressly adopting this Addendum. Before covered processing begins, we must identify the customer and its authorized contact, provide the applicable Provider Disclosures, obtain the required authorizations, and satisfy any restricted-transfer conditions. An acceptance record identifies the agreement; it does not certify an undisclosed provider or an unexecuted transfer instrument.

1. Scope and definitions

“Customer Personal Data” means personal data that Customer or its authorized users submit to the Service and that Baruch Holdings LLC processes on Customer’s documented behalf, including authorized CRM and workspace records. It does not include information we legitimately process as an independent controller for our own account, billing, support, or security purposes; those activities must be identified and supported separately rather than excluded by label alone.

“Data Protection Law” means the privacy and personal-data laws that actually apply to the relevant processing, including the EU GDPR, UK GDPR, and applicable U.S. state privacy laws to the extent applicable. “Controller,” “processor,” “service provider,” “contractor,” “personal data,” and “personal data breach” have the meanings assigned by the applicable law. “Subprocessor” means a provider processing Customer Personal Data on our behalf.

This Addendum governs the processing described in Annex A and the customer’s lawful documented instructions. It does not authorize a prohibited data category, excluded feature, undisclosed subprocessor, or unlawful transfer. Where the customer acts as processor for another controller, it must have authority to appoint us and pass down the required instructions and obligations.

2. Role allocation and customer responsibilities

The customer determines the purposes for which its customer-controlled records are processed and acts as controller, or as an authorized processor where it documents that role and the relevant upstream authority. We act as processor, subprocessor, service provider, or contractor for the applicable activity. Each party remains responsible for duties that the law assigns directly to it.

Customer must have a lawful basis for collection and the documented processing instructions, provide required notices, secure permissions where necessary, honor applicable rights, and limit the data to what is appropriate. Customer must not instruct unlawful discrimination, intrusive profiling, unauthorized marketing, or collection of prohibited sensitive or children’s information.

We must not use a contractual customer-responsibility provision to avoid our own obligations. If an instruction appears to violate applicable data-protection requirements, we will promptly notify Customer and may suspend the affected processing while the issue is resolved, except where law requires otherwise. Suspension must be proportionate and must not be used to obstruct a lawful rights request.

3. Documented instructions and purpose limitation

Customer instructs us to process Customer Personal Data only to provide the contracted and enabled Service, perform the operations in Annex A, carry out authorized user selections, and follow further lawful documented instructions consistent with the agreement. An AI-generated suggestion, a vendor’s default setting, or a change to our public privacy notice is not an additional customer instruction.

We will not process Customer Personal Data for an independent incompatible purpose. If law requires processing outside Customer’s instructions, we will notify Customer in advance unless the relevant law prohibits notice. We will limit such processing to the legally required scope and maintain the applicable protections.

4. Confidentiality and authorized personnel

We will restrict access to personnel who need it for authorized tasks and are subject to appropriate confidentiality obligations or equivalent legal duties. Personnel must receive role-appropriate training and follow access-control and handling procedures. Access is revoked when no longer necessary.

We will not make private workspace data public merely because the customer uses community features. Publication or sharing must be based on a deliberate authorized instruction and appropriate controls. Customer must control access permissions for its own users; we remain responsible for implementing and maintaining the agreed access protections.

5. Security measures

We will implement and maintain the technical and organizational requirements in Annex C, appropriate to the data, purposes, risks, and applicable law, before the affected processing begins and throughout the processing term. Those requirements address confidentiality, integrity, availability, resilience, access control, secure development, incident handling, restoration, and ongoing evaluation.

We may improve or replace a measure with one providing materially equivalent or better protection, but will not materially reduce overall protection during the processing term. Annex C specifies contractual requirements, not a representation that an independent audit, certification, named encryption configuration, or geographic deployment has been verified. Any additional factual security representation must be identified in a separate accurate disclosure. Our responsibility for the agreed measures continues if infrastructure providers change.

6. AI processing restrictions

AI processing is permitted only for enabled and authorized features, permitted data categories, identified providers and locations, disclosed retention, and the customer’s documented instructions under Annexes A and B. We will minimize context sent to a model and prevent disclosure of unrelated tenants’ records. Use of a standard AI feature does not authorize sending the entire workspace indiscriminately. If the provider-specific disclosure and authorization are absent, the affected AI feature must not receive Customer Personal Data.

Neither we nor an authorized AI subprocessor may use private Customer Personal Data to train or fine-tune generalized models for unrelated use under this addendum. We will procure the necessary provider restrictions and settings. There is no separate model-improvement consent in this addendum. A proposed different arrangement requires its own lawful basis, specific written agreement, notices, and permissions before processing.

Any provider retention or human review must be documented, necessary for a permitted service, security, or legal purpose, appropriately limited, and consistent with Customer’s instructions and Data Protection Law. “No training” must not be represented as “zero retention” or “no human access.” We remain responsible for an authorized subprocessor’s compliance with the obligations we pass down.

7. Subprocessor authorization and changes

The customer gives general written authorization for subprocessors adequately identified in the Provider Disclosures delivered and accepted with this Addendum, and for additions or replacements appointed under this section. Annex B governs the content and recording of those disclosures. No unnamed provider is authorized by a generic reference to hosting, email, support, analytics, or AI. We must assess a provider’s ability to meet the applicable requirements and bind it by a written contract imposing obligations no less protective in substance for the relevant processing.

We will give at least 30 days’ written notice before a new or replacement subprocessor receives Customer Personal Data. The notice will identify its legal entity, function, locations, relevant data, and material processing changes. Customer may object on reasonable documented data-protection grounds within 15 days of the notice. Silence cannot authorize a provider that was not adequately identified or whose processing is unlawful.

The parties will work in good faith on an appropriate alternative. If a reasonable unresolved objection prevents lawful use of the affected feature, Customer may terminate that affected feature before the proposed transfer and receive a proportionate refund of unused prepaid fees for it. We will not require Customer to accept an unlawful arrangement to continue unrelated features.

An urgent substitution does not waive a legally required prior authorization. Where the ordinary notice period cannot be met, we will obtain specific written authorization or pause the affected processing until a lawful arrangement is in place. We remain responsible for our subprocessors’ performance of their relevant obligations to the extent required by law and this agreement.

8. U.S. service-provider and contractor restrictions

Where applicable U.S. law treats us as Customer’s service provider or contractor, the business purposes are the specific contracted operations in Annex A. We will not sell or share Customer Personal Data, use it for cross-context behavioral advertising or targeted advertising, or retain, use, or disclose it outside the specified purposes and direct business relationship except as the applicable law permits.

We will not combine Customer Personal Data with information from unrelated customers or our own interactions for prohibited purposes. Any legally permitted combination must stay within a specifically allowed service purpose and the customer instructions. We certify that we understand and will comply with the applicable contractual restrictions and provide the same legally required level of privacy protection.

We will notify Customer if we determine that we can no longer meet these requirements. Customer may take reasonable and appropriate steps to verify consistent use and to stop and remediate unauthorized processing, including through the audit provisions. These rights are not conditioned on Customer first suffering damage. A provider that determines its own incompatible purposes must not be treated as a compliant processor merely because it signs a label.

9. Individual rights and customer assistance

Taking account of the nature of processing, we will assist Customer through appropriate measures with lawful access, correction, deletion, restriction, portability, objection, opt-out, and appeal requests that concern Customer Personal Data. We will not respond on Customer’s behalf except on instruction or as law requires, but will promptly direct the request to the appropriate contact and address our own responsibilities.

We will provide assistance sufficiently promptly for applicable legal deadlines. Proportionate verification must protect the requester and other individuals without becoming an obstruction. We will not charge an individual for exercising a right where prohibited. Additional customer assistance charges, if lawfully appropriate, must be disclosed and agreed and cannot condition assistance needed to remedy our own noncompliance.

10. Personal-data breaches

We will notify Customer without undue delay and in any event within 48 hours after becoming aware of a personal data breach affecting Customer Personal Data, or sooner where law or a controlling instrument requires. Awareness and notification must not be postponed until every fact or the complete root cause is known. An initial notice may be supplemented as reliable information becomes available.

The notice will provide, to the extent known, the nature of the breach; affected systems, data categories, and approximate scope; likely consequences; mitigation and containment steps; and a contact for follow-up. We will investigate, take reasonable containment and remediation measures, preserve appropriate evidence, and cooperate with Customer’s required notifications and response.

Customer decides its own notifications where it is the responsible controller, subject to any direct duties we have. We will not make a public statement naming Customer without a lawful basis and appropriate coordination where permitted. Notification is not by itself an admission of liability. The agreement’s enhanced liability provisions apply only to the extent lawful and do not restrict authorities or individuals’ non-waivable rights.

11. Assessments, regulator requests, and audits

We will provide reasonable information and assistance for Customer’s data-protection impact assessments, transfer assessments, and prior consultations where applicable, taking account of the nature of processing and information available to us. Customer remains responsible for its own assessment and lawful instructions.

We will provide information necessary to demonstrate compliance and permit appropriate audits, including inspections by Customer or a qualified independent auditor. Existing reports and documentation may be used first where sufficient; they are not an absolute substitute when law or a substantiated concern requires further examination.

Ordinary audits may occur on reasonable notice, during normal operations, with confidentiality and security protections that do not expose other customers’ data. A normal annual cadence does not restrict audits required by law, a regulator, a serious incident, or a credible material noncompliance concern. Reasonable cost arrangements must not defeat statutory audit rights, and we bear reasonable remediation-related verification costs caused by our established material noncompliance.

12. International transfers

We will not initiate a restricted international transfer of Customer Personal Data until an applicable lawful mechanism, necessary assessments, and supplementary measures are in place. Annex E governs the transfer-specific record, the identification of the actual parties and locations, and adoption of any required instrument. This Addendum does not itself supply a completed transfer instrument.

Where appropriate, the parties may execute applicable EU Standard Contractual Clauses, together with the required module choices and annexes; a UK transfer may require the applicable UK IDTA or UK Addendum rather than unmodified EU clauses alone. The correct mechanism depends on the actual legal scope and data flow. No certification or adequacy arrangement is assumed by this addendum.

A reference to standard clauses does not complete missing parties, transfer details, security measures, or mandatory selections. Until the relevant mechanism and instrument are validly established, this Addendum cannot be relied on to authorize the restricted transfer. Onward transfers must meet the controlling obligations. Mandatory instrument terms prevail over inconsistent commercial terms.

13. Return and deletion

On termination or Customer’s lawful instruction, we will return or delete Customer Personal Data as Customer elects, subject to narrowly applicable legal retention. Following ordinary termination, Customer may use a 30-day retrieval window unless it requests earlier deletion or a legal deadline requires earlier action. We will not withhold statutory access solely to obtain another subscription payment.

Absent a contrary lawful instruction, active-system copies will be deleted within 30 days after the retrieval window ends. If a valid deletion instruction applies earlier, active copies will be deleted within 30 days after verification of that instruction or any shorter mandatory period. Backup copies will expire within 90 days after active-system deletion, remain protected and unavailable for ordinary use pending expiry, and have deletion instructions reapplied on restoration. A shorter legally required period controls.

We will instruct relevant subprocessors consistently and provide written confirmation of completion on request, identifying any lawfully retained exceptions. Customer Personal Data retained because law requires it is isolated and used only for that obligation. Controller-held transaction records necessary for our own legal duties are identified separately; they do not justify retaining unrelated CRM content.

14. Term, responsibility, and priority

This addendum continues while we process covered Customer Personal Data, including lawful post-termination retention. Changes require a valid agreement or an expressly permitted update mechanism consistent with Data Protection Law; a privacy-notice revision does not unilaterally broaden instructions.

The underlying agreement’s lawful liability allocation applies, including its enhanced confidentiality and data-protection cap, except where a mandatory transfer instrument, law, or a separate signed agreement overrides it. No cap limits a data subject’s non-waivable right to compensation or a regulator’s powers. There is no double recovery for the same loss, but separate legally available remedies are preserved.

If this addendum conflicts with the ordinary Terms on covered processing, this addendum prevails. A mandatory international-transfer instrument prevails for its subject matter. The ordinary Georgia forum does not displace mandatory transfer-instrument courts or independent privacy remedies.

15. Acceptance and contacts

The customer adopts this Addendum through the legally sufficient affirmative acceptance of the Terms incorporating Part L, or a separate written agreement. Baruch Holdings LLC agrees to it by offering and supplying the Service on those accepted terms. General website browsing is not acceptance, and no handwritten signature is supplied or implied by this document.

The customer’s legal identity, address where applicable, authorized representative, contact information, accepted version, and acceptance date are the details recorded with the account, order, or separate adoption. We will provide a copy of the applicable acceptance information on request, subject to lawful verification. Where those details are needed but have not been recorded, the affected processing must not begin until they are established.

The customer’s privacy and incident contact is the designated contact recorded in its account or written instructions, or, absent a separate designation, its verified account-owner email. The customer may update that contact in writing. Our privacy and incident contact is baruchstk@gmail.com; postal notices may be sent to Baruch Holdings LLC, 1078 Citizens Pkwy, Morrow, GA 30260, United States. We must monitor the designated channel and maintain escalation arrangements sufficient to meet our notification commitments.

Annex A. Processing description

This Annex describes the permitted processing framework. The actual scope is limited by the accepted plan, enabled features, customer instructions, and the provider and transfer authorizations required by this Addendum. A listed category does not authorize collection unrelated to the customer’s requested function.

A1. Subject matter and duration

The subject matter is processing permitted adult business-contact and workspace information to supply EarnCommand OS. Processing continues for the relevant service term and the controlled retrieval and deletion periods in Section 13 and Annex D, plus only a specifically applicable legal-retention exception.

A2. Operations and purposes

Permitted operations are receiving authorized customer submissions; storing, organizing, retrieving, correcting, and restricting records; performing requested calculations and matching; generating requested AI output only where separately authorized; carrying out expressly approved transmissions; providing support and export; and returning or deleting data. Only the operations relevant to the enabled feature and instruction may be performed.

Purposes are CRM organization, project and planning workflows, customer-selected records and reporting, and requested AI drafting or research within the disclosed scope. Unrelated advertising, sale of data, generalized model training, and autonomous external actions are not permitted purposes.

A3. Data subjects and permitted data

Data subjects are adult customer users and authorized representatives, adult business contacts, suppliers, contractors, and other adults whose permitted information the customer lawfully submits. Data types are names, business contact details, company information, authorized business notes, pipeline stages, business-interaction history, project and planning records, and user-entered transaction amounts and categories.

AI requests may include only the permitted prompt and context identified for the requested feature. A general permission to organize CRM records does not independently authorize transmitting them to a model or integration. The provider-specific disclosure must identify which fields and categories are included.

A4. Exclusions

Excluded information includes identifying information about minors; special-category or similarly restricted sensitive data; government identity records; payment-card numbers; banking credentials; medical and criminal-offense records; precise-location histories; and biometric identifiers. Standard account authentication is handled under the separate account-security role, not by placing credentials in CRM records or prompts. An exceptional category requires a separate lawful written agreement and appropriate safeguards before collection.

A5. Customer-specific instructions

The customer’s identity and contact are determined under Section 15. Its role is controller unless it documents a lawful upstream processor relationship and its authority to appoint us. Enabled features, permitted integration destinations, and changes of instruction are the customer’s recorded selections and lawful written directions. Actual processing volume and frequency follow those selections and the plan’s limits; no minimum quantity of third-party records is required.

Storage and remote-access countries must be identified in the applicable Provider Disclosures before the relevant processing is authorized. Section 13 and Annex D supply the default retention instructions. An agreed variation must be documented, cannot reduce mandatory rights, and cannot authorize an excluded data category or otherwise unlawful processing.

Annex B. Provider disclosure and authorization

B1. Initial authorization

Before Customer Personal Data is disclosed to a subprocessor, we must deliver a dated Provider Disclosure identifying each relevant legal entity and the information specified below. The disclosure may be supplied as a versioned register, order attachment, or durable electronic notice. It forms the provider-specific schedule to this Addendum only when adequately identified and validly authorized under Section 7.

No hosting, database, authentication, email, support, diagnostic, or AI entity is authorized merely because its service category is mentioned in this agreement. Where the required disclosure or authorization is missing, the affected processing must remain inactive. This rule is not a representation that the technical platform has already been inspected or that earlier processing has been regularized.

B2. Information required for each subprocessor

Each entry must identify the legal entity and service; its role and specific purpose; the Customer Personal Data categories it will receive; countries of storage and remote access; retention and deletion conditions; the applicable written data-protection obligations; material safeguards; any required transfer mechanism; and the effective authorization date. Security-sensitive material may be supplied confidentially, but lawful authorization cannot be based on withholding information needed to evaluate the proposed processing.

B3. Additional AI information

For a model or routing provider, the disclosure must identify the service route, prompt and context categories, restriction against generalized model training, permitted human-review circumstances, abuse-monitoring retention, relevant account or contractual settings, storage and access countries, material downstream recipients, and deletion behavior. “No training” is not a promise of zero retention or absence of all human access.

B4. Independent recipients and customer-selected providers

Paddle’s applicable entity is identified in the purchase transaction. Its independent reseller, payment, tax, and fraud-prevention activities are not automatically subprocessing on our behalf. A customer-selected integration may also act independently under its own agreement; its role must follow the actual purpose and control, not its label.

Google Search Console concerns the public website’s technical health and search visibility; it is not authorized by this Addendum to receive private Customer Personal Data. A support-email channel is not an exemption from processor duties: where support providers process Customer Personal Data on our behalf, the same disclosure, contract, access, retention, and authorization requirements apply.

B5. Changes and notice records

New or replacement subprocessors follow the 30-day notice, objection, alternative, and urgent-change rules in Section 7. Notices go to the customer contact identified under Section 15. We will retain the version supplied, delivery record, applicable authorization, objections, and resolution. One customer’s approval does not authorize a provider for a different customer who has not received the required notice.

Annex C. Contractual security requirements

These requirements state what Baruch Holdings LLC must implement and maintain for covered processing. They are not an independent assessment or certification of a current deployment. We must not commence an affected processing operation without safeguards appropriate to its risks and these obligations.

C1. Identity and access

Restrict access to authorized persons with a business need, use individual privileged credentials, protect privileged access with appropriate multifactor authentication, review access periodically, and revoke access when the role or authorization ends. Keep secrets and service credentials outside public code and ordinary customer-content fields. Require personnel confidentiality and role-appropriate training.

C2. Separation and authorization

Enforce workspace and tenant separation through server-side authorization for records, files, exports, and AI context. Do not rely solely on a hidden interface element to protect another customer’s data. Assess changes that could expose data across workspaces and remediate identified access-control weaknesses before affected release or access continues.

C3. Transmission and storage protection

Protect Customer Personal Data in transit using appropriate current encrypted connections. Apply storage encryption or equivalent risk-appropriate safeguards, manage keys and secrets separately from ordinary data access, and restrict administrative access to storage and logs. Do not advertise a specific algorithm, encryption-at-rest configuration, data-residency location, or audit certification unless separately supported by actual evidence.

C4. Development and operational security

Use controlled changes, appropriate review and testing, dependency and vulnerability management, and protected operational logging. Prioritize remediation in proportion to severity and exposure. Minimize personal data in diagnostics; do not create unrestricted logging of complete private workspaces, credentials, or AI prompts.

C5. AI and provider controls

Limit model context to the authorized feature purpose; prevent unrelated customer records from entering a request; implement the no-training restriction through appropriate provider contracts and settings; and restrict any permitted human review, retention, and onward access. A provider change must not bypass Annex B or the international-transfer conditions.

C6. Continuity, backups, and restoration

Maintain risk-appropriate recovery procedures and protected backup arrangements for the contracted processing. Restrict backup access, assess restoration capability periodically, and reapply deletion and access restrictions when restoring records. Backup retention and expiry must comply with Section 13 and Annex D. No uninterrupted-operation percentage, recovery-time guarantee, or independently tested recovery certification is granted by this Annex.

C7. Incidents and escalation

Maintain procedures to detect, triage, contain, investigate, and document suspected incidents; preserve relevant evidence; designate responsible escalation contacts; and notify customers and authorities as required. Organize staffing and provider reporting so the without-undue-delay obligation and 48-hour outer limit in Section 10 can be met. An incomplete root-cause analysis does not delay an initial required notice.

C8. Rights, exports, and deletion

Provide proportionate identity verification and access restrictions for rights requests. Protect exported files, minimize temporary copies, apply deletion to relevant active stores and providers, and follow the backup and legal-hold rules in Annex D. Verify that removal from the user interface is not incorrectly treated as deletion from every underlying system.

C9. Assurance and review

Maintain records sufficient to demonstrate these obligations, review their effectiveness periodically and after material changes or incidents, assess relevant suppliers, and permit the compliance information and audits described in Section 11. Specific certifications or independent reports may be described only when they exist and their scope is accurately stated.

Annex D. Retention, return, and deletion

D1. Active service and minimization

Retain Customer Personal Data during the active contracted service only for authorized purposes and instructions. A customer may issue an earlier lawful deletion instruction. Support copies, temporary exports, logs, and diagnostic copies must not be retained longer merely because they are stored outside the principal database.

D2. Ordinary termination

Following ordinary termination, provide a 30-day retrieval window unless the customer requests earlier deletion or a legal requirement necessitates earlier action. Absent a contrary lawful instruction, delete active-system copies within 30 days after that retrieval window ends. These periods do not extend a shorter statutory deadline or authorize a charge for exercising a statutory access right.

D3. Earlier deletion instructions

Where a valid deletion instruction applies before the ordinary termination schedule, delete active-system copies within 30 days after proportionate verification, or within any shorter mandatory period. Verification must not be used to create an artificial delay. Promptly clarify a genuinely ambiguous instruction and preserve unaffected lawful rights.

D4. Backups and restoration

Backup copies must expire no later than 90 days after active-system deletion, subject to any shorter legally required period. Pending expiry they remain protected and unavailable for ordinary use. If a backup is restored, reapply deletion instructions and access restrictions before the restored data is used for ordinary service operations.

D5. Covered systems and providers

Apply these instructions to relevant CRM and project records, uploaded files, AI prompts and outputs, application logs containing Customer Personal Data, support copies, temporary exports, and search or vector indexes where actually used. Instruct the authorized subprocessors consistently. A system is not exempt because the customer cannot see it in the interface.

D6. Narrow legal exceptions and confirmation

Where a specific law requires retention, identify the affected fields, legal obligation, restricted purpose, and applicable expiry. Keep the retained data isolated from unrelated service, advertising, or model-development uses. A general statement of business convenience is not a blanket exception. Our independently controlled transaction records do not justify retaining unrelated CRM content.

Provide written confirmation of completed return or deletion on request, describing any lawful exception and remaining protected backup-expiry period accurately. Do not report final destruction while accessible copies remain. Maintain records of the applicable deletion trigger, responsible process, provider instructions, and completion evidence.

Annex E. Restricted international transfers

E1. No automatic transfer authorization

This Addendum is a processing agreement, not a completed set of EU Standard Contractual Clauses, a UK International Data Transfer Agreement, or a UK Addendum. It does not establish a certification or an adequacy entitlement. Acceptance of the Terms cannot cure a transfer that otherwise lacks a lawful mechanism.

E2. Transfer-specific information

Before a restricted transfer begins, identify the actual exporter and importer, their legal roles and applicable legal scope, countries of storage and remote access, data subjects and categories, purposes, frequency and duration, onward recipients, and the security measures relevant to that transfer. Match this information to the Provider Disclosures and customer instructions.

E3. Mechanism and supporting measures

Establish the lawful mechanism appropriate to the actual transfer. Where standard contractual instruments are used, validly complete and adopt the required parties, module and options, applicable authority, governing law and courts, transfer description, security annex, and subprocessor information. For a covered UK transfer, adopt the applicable UK instrument rather than assuming unmodified EU clauses alone are sufficient.

Complete the required transfer assessment and supplementary protections before relying on the mechanism. Where reliance is placed on an adequacy arrangement or certification, verify its scope, validity, and coverage of the actual importer and processing. Reassess material changes, invalidation, onward transfers, and relevant government-access risks.

E4. Availability of documents and order of priority

Supply the customer with the applicable completed instrument or the information and copy required by law, using only permitted redactions. The parties’ valid adoption and the controlling instrument—not a reference in this Annex—determine the transfer obligations. Mandatory transfer terms prevail over inconsistent commercial caps, forums, or other terms to the extent required.

E5. Processing restriction

Until the necessary mechanism, information, and safeguards are in place, the affected restricted transfer must not begin. If a required mechanism later becomes unavailable or an obligation cannot be met, suspend the affected transfer and follow the controlling instrument and law concerning notice, remediation, return, or deletion. This restriction preserves duties and remedies concerning any earlier processing; it does not retrospectively approve it.