Data Processing Addendum

1Roles

The Customer is the controller (or, where it acts for another controller, a processor) of personal data in Customer Data. Coastal Carolina Tech is the Customer’s processor (or subprocessor). For account, billing and security information we collect to run our business, we act as an independent controller under our Privacy Policy.

2Scope of processing

• Subject matter and duration: providing the Service for the term of the agreement and the post-termination period in section 9.
• Nature and purpose: hosting, querying, summarizing, displaying, caching and auditing Customer Data to provide the Service.
• Data subjects: the Customer’s members, and individuals whose data appears in the Customer’s connected data sources (for example, employees or operators).
• Categories of data: contact and account details of members; and whatever personal data the Customer’s sources contain and return to queries.

3Instructions

We process personal data only on the Customer’s documented instructions — which include the Terms, this DPA and the Customer’s use and configuration of the Service — unless the law requires otherwise, in which case we will tell the Customer first where lawful. We will tell the Customer if we believe an instruction breaks data protection law.

4Confidentiality of personnel

Everyone we authorize to process personal data is bound by an obligation of confidentiality.

5Security measures

We implement the technical and organizational measures described on our Security page, which is incorporated into this DPA. We may update them, but not in a way that materially lowers the overall protection of personal data.

6Subprocessors

The Customer authorizes the subprocessors listed on Subprocessors. We impose data protection obligations on each that are no less protective than this DPA, and remain responsible for them. We will give at least 30 days’ notice before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds; if we cannot reasonably resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for the remaining period.

7Assistance

Taking into account the nature of the processing, we will help the Customer respond to requests from data subjects exercising their rights, and with security, breach notification, data protection impact assessments and consultation with regulators. If we receive a request directly from a data subject about Customer Data, we will refer it to the Customer.

8Personal data breach

We will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as then known, the nature of the breach, the data and data subjects affected, likely consequences, and the steps we have taken or propose. We will update it as more becomes known.

9Return and deletion

On termination, the Customer may request an export of Customer Data for 30 days. After that we delete Customer Data from the Service within 30 days, except where the law requires us to keep it; residual copies in backups expire on their normal cycle and remain protected by this DPA until they do.

10Information and audits

We will make available the information reasonably necessary to demonstrate compliance with this DPA, including by answering security questionnaires. Where that is not sufficient, or a regulator requires it, the Customer may conduct an audit on reasonable notice, at its own cost, no more than once a year, under confidentiality obligations and in a way that does not disrupt the Service or expose other customers’ data.

11International transfers

Personal data is processed in the United States and wherever our subprocessors operate. Where data protection law requires a transfer mechanism, the parties agree to the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), which we will complete and countersign on request.

12Liability and precedence

Each party’s liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms on the processing of personal data, this DPA controls.

13Contact