Data Processing Addendum

Roles and instructions

The Customer is the controller (a "business" under California law) and we are its processor (a "service provider"). We process personal data only on the Customer's documented instructions, which are the Terms, this Addendum, and the Customer's use of the Service, and tell the Customer if we think an instruction breaks the law.

Details of processing

• Subject matter and duration: providing the Service for as long as the account is open.
• Nature and purpose: hosting, storing, displaying and transforming data so the Customer can run its business, and securing and supporting the Service.
• Data subjects: the Customer's customers, leads, contacts, suppliers, employees and Authorized Users.
• Types of data: contact details, messages and notes, transaction and invoice records, inventory and scheduling records, and anything else the Customer enters.

Confidentiality and security

People who process personal data for us are bound by confidentiality. We maintain the technical and organizational measures described on our Security page and review them at least yearly.

Subprocessors

The Customer authorizes the subprocessors on our Subprocessors page. We bind them to data-protection terms no less protective than these, stay responsible for them, and give at least [30] days' notice of a new one so the Customer can object; if we cannot resolve an objection the Customer may end the Service.

Assisting the Customer

• We provide tools to export, correct and delete data so the Customer can answer requests from the people it concerns, and will help with any request we receive on its behalf.
• We will help with data protection impact assessments and regulator consultations where reasonably needed.

Personal data breaches

We notify the Customer without undue delay, and within [72] hours where possible, after becoming aware of a breach affecting its personal data, with the information we have to help it meet its own duties.

Return and deletion

At the Customer's choice we return (export) or delete personal data when the Service ends, and delete remaining copies, including from backups within [35] days, unless law requires us to keep it.

Audits

We make available information necessary to show compliance, including our security documentation, and allow reasonable audits no more than once a year on [30] days' notice, at the Customer's cost, during business hours and subject to confidentiality. [Counsel to confirm.]

International transfers

Where we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses (Module Two, controller to processor, and Module Three where applicable) are incorporated, with the details above as their annexes. [Counsel to attach.]

Contact

[privacy email address]. Mail: [Legal entity name, for example "BizzieBot LLC"], [Mailing address].