Data Processing Addendum

1. Scope and roles

This DPA applies to personal data that we process on your behalf when providing the Service ("Customer Personal Data") — for example the names, profile photos and texts of people who review your business, and photos and content you upload. For Customer Personal Data, you are the controller (or "business" under U.S. state laws) and we are your processor (or "service provider" / "processor"). Personal data that we process for our own purposes, such as account and billing data, is covered by our Privacy Policy, where we act as controller.

"Data Protection Laws" means all privacy and data protection laws that apply to the processing, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"), and the comprehensive privacy laws of other U.S. states.

2. Processing on instructions

• We process Customer Personal Data only on your documented instructions, which are the Agreement, this DPA and the settings and actions you choose in the Service (for example connecting a location, approving a reply or switching on automatic publishing), unless the law requires otherwise; in that case we will tell you first unless the law forbids it.
• We will tell you if we believe an instruction breaches Data Protection Laws.
• You are responsible for having a lawful basis and giving any notices needed for the Customer Personal Data you bring into the Service, and for your instructions complying with Data Protection Laws.

3. U.S. state privacy laws (CCPA and others)

When we process Customer Personal Data as your service provider or processor under U.S. state privacy laws, we:

• process it only for the limited and specified business purposes of providing, securing and supporting the Service as described in the Agreement and Annex 1;
• do not sell it or share it for cross-context behavioral advertising;
• do not retain, use or disclose it for any purpose other than those business purposes, or outside our direct business relationship with you;
• do not combine it with personal information we receive from other sources or collect from our own interactions with individuals, except as Data Protection Laws allow for service providers;
• comply with the applicable obligations of those laws and provide the same level of privacy protection they require;
• notify you if we determine that we can no longer meet our obligations under them;
• allow you to take reasonable and appropriate steps to stop and remediate any unauthorized use of the data, and to verify our compliance as described in section 10.

We certify that we understand these restrictions and will comply with them.

4. Confidentiality of personnel

We ensure that everyone we authorize to process Customer Personal Data is bound by confidentiality obligations, and we give access only to those who need it to provide, secure or support the Service.

5. Security

We implement and maintain appropriate technical and organizational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, taking into account the state of the art, the costs, and the nature and risks of the processing. Annex 2 describes them. We may update them, as long as the overall level of protection does not decrease.

6. Sub-processors

• You give us general authorization to engage the sub-processors listed in Annex 3.
• Before we add or replace a sub-processor, we will update Annex 3 and notify workspace owners by email at least 14 days in advance. You may object on reasonable data protection grounds within that period; if we cannot reasonably accommodate the objection, you may terminate the affected Service and receive a refund of prepaid fees for the remaining period.
• We impose data protection obligations on each sub-processor that are no less protective than this DPA, and we remain responsible for their performance.

7. Assistance with requests and assessments

• Taking into account the nature of the processing, we will help you respond to requests from individuals exercising their rights. If we receive such a request directly for Customer Personal Data, we will forward it to you and not respond ourselves, except to tell the individual that we did so.
• We will give you reasonable assistance with data protection impact assessments and consultations with supervisory authorities, to the extent the information is available to us.

8. Personal data breaches

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as we know, the nature of the breach, the data and individuals concerned, the likely consequences and the measures taken or proposed. We will take reasonable steps to contain and remedy the breach and cooperate with you so you can meet your notification obligations. A notice is not an acknowledgement of fault.

9. International transfers

Customer Personal Data may be processed in the countries where we and our sub-processors operate, including the United States. Where the GDPR, UK GDPR or Swiss law requires a transfer mechanism for a transfer to a country without an adequacy decision, the parties agree to the European Commission's Standard Contractual Clauses (Module Two where you are a controller, Module Three where you are a processor), which are incorporated by reference, with the UK International Data Transfer Addendum and the Swiss adjustments where applicable. For the clauses: the governing law and forum are those of Ireland, the docking clause and option 2 of clause 9 (general authorization, with the notice period in section 6) apply, and Annexes 1 to 3 of this DPA complete their annexes.

10. Information and audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA. Where that is not sufficient, or a supervisory authority requires it, you may audit our compliance once a year, on at least 30 days' written notice, during business hours, at your cost, and subject to confidentiality. Audits are carried out by you or an independent auditor who is not our competitor, and must not unreasonably disrupt our operations or compromise other customers' data.

11. Return and deletion

During the subscription you can export your workspace data in the Service. When a workspace is deleted, or within 30 days after the Agreement ends, we delete Customer Personal Data from our production systems, and from backups within a further 30 days, unless the law requires us to keep it. Data that Google holds in your Business Profile is not affected.

12. Liability, precedence and term

• Each party's liability under this DPA is subject to the limitations of liability in the Agreement, to the extent permitted by Data Protection Laws.
• If this DPA conflicts with the Agreement on the processing of personal data, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the clauses prevail.
• This DPA lasts for as long as we process Customer Personal Data. We may update it to reflect changes in law or in the Service; material changes are notified as described in the Terms.

13. Annex 1: Details of processing

14. Annex 2: Security measures

• Encryption in transit: all connections to the Service, to Google and to our other providers use TLS (HTTPS).
• Access control: role-based access within workspaces (owner, admin, editor, viewer); every request is checked against the user's workspace and role; staff access to production data is limited to named personnel who need it, through a separate, audited admin sign-in.
• Authentication: passwords stored only as salted bcrypt hashes; email ownership verified before an account can sign in; sessions in secure, HTTP-only cookies.
• Least privilege with Google: only the Business Profile permission the features need; access tokens deleted when a location is disconnected; revoked access detected and the location marked for reconnection.
• Secrets and links: email action tokens stored only as one-way hashes; signature checks on payment (Paddle) and Google notification webhooks.
• Uploads: images accepted only when their decoded format matches the declared type, re-encoded, and stripped of metadata such as location data.
• Application security: rate limiting, input validation, security headers, and a restrictive content security policy for uploaded media; outbound fetches of user-supplied URLs blocked from reaching private networks.
• Data minimization and retention: retention periods as described in the Privacy Policy, including automatic deletion of email assistant data.
• Incident response: monitoring of errors and failed jobs, and a process for investigating and notifying breaches as described in section 8.

15. Annex 3: Sub-processors

Paddle.com Market Limited sells subscriptions to the Customer as merchant of record and processes payment data as an independent controller; it is not a sub-processor of Customer Personal Data.