Data Processing Addendum

1. Roles of the Parties

For the purposes of applicable data protection laws, Customer acts as the controller of personal data submitted through the Services, and Provider acts as the processor. Provider may engage sub-processors to support the Services as described below.

2. Processor Obligations

• Process personal data solely on documented instructions from Customer, including with respect to transfers.
• Ensure personnel authorized to process personal data are subject to confidentiality obligations.
• Implement appropriate technical and organizational measures to protect personal data.
• Notify Customer without undue delay after becoming aware of a personal data breach.

3. Sub-processors

Customer authorizes Provider to engage sub-processors to support the Services. Provider will maintain an up-to-date list of sub-processors and provide notice of material changes. Customer may object to a new sub-processor on reasonable grounds by contacting [email protected].

4. Data Subject Requests

Taking into account the nature of processing, Provider will assist Customer in fulfilling requests from data subjects to access, correct, delete, or restrict their personal data. Customer is responsible for responding to such requests and may use the tools within the Services or contact Provider for additional assistance.

5. Security and Audits

Provider maintains industry-standard security measures, including encryption in transit, role-based access controls, and regular vulnerability scanning. Upon written request and subject to confidentiality obligations, Provider will make available information necessary to demonstrate compliance with this DPA and applicable law.

6. International Transfers

Where personal data originates from the European Economic Area, United Kingdom, or Switzerland and is processed outside those regions, Provider will ensure appropriate transfer mechanisms are in place, such as the EU Standard Contractual Clauses or other approved safeguards.

7. Data Return or Deletion

Upon termination of the Services, Provider will delete or return personal data to Customer, unless retention is required by law. Customer may export calculator data and leads at any time during the subscription term.

8. Liability

The parties’ liability arising from or related to this DPA is subject to the limitations of liability set forth in the Terms of Service.

Contact

Questions about this DPA can be sent to [email protected].