Data processing addendum

Data Protection Law means every law applicable to the processing under this addendum, including Regulation (EU) 2016/679 (GDPR), the UK GDPR and the Data Protection Act 2018, the Swiss Federal Act on Data Protection, the Digital Personal Data Protection Act, 2023 and the rules under it, the Information Technology Act, 2000 and the SPDI Rules, 2011, and the California Consumer Privacy Act as amended.

Controller, processor, subprocessor, data subject, personal data, processing and personal data breach have the meanings given in the GDPR. Data Fiduciary, Data Processor and Data Principal have the meanings given in the DPDP Act, and correspond to controller, processor and data subject respectively.

SCCs means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

Customer Personal Data means personal data contained in customer content that we process on your behalf.

You are the controller of Customer Personal Data and we are your processor. Where you are yourself a processor for another controller, we are a subprocessor and this addendum applies as though references to controller were to that other controller, with you responsible for having the authority to appoint us.

You warrant that you have a lawful basis for the processing you instruct, that you have given every required notice and obtained every required consent, and that your instructions comply with Data Protection Law. You are responsible for the accuracy, quality and legality of Customer Personal Data and for how you obtained it.

We will process Customer Personal Data only on your documented instructions, including on transfers to a third country, unless required to do otherwise by law to which we are subject, in which case we will tell you of that requirement before processing unless the law prohibits it on important grounds of public interest.

Your instructions are: the terms of service, this addendum, and the configuration choices and actions you take in the product. Providing the service in accordance with them is the full scope of processing you have authorised.

We will tell you if, in our opinion, an instruction infringes Data Protection Law. We may suspend the affected processing until the instruction is corrected or withdrawn, and doing so is not a breach of the terms.

We do not sell Customer Personal Data, do not share it for cross-context behavioural advertising, do not use it for our own purposes, and do not use it to train machine learning models.

We limit access to Customer Personal Data to personnel who need it to provide the service or to comply with the law. Everyone with access is bound by a written confidentiality obligation that survives the end of their engagement, and is trained on their obligations. Access is logged and reviewed, and is revoked when no longer required.

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing. Those measures are set out in Annex II at clause 17, and described in operational detail on the security page.

We may update the measures as technology develops, provided the updates do not materially reduce the overall level of protection.

You give us general written authorisation to appoint subprocessors, subject to the conditions in this clause. The current list is at subprocessors.

1. We will give you at least 30 days' notice of any intended addition or replacement, by email to workspace owners and by updating the subprocessor page.
2. You may object on reasonable data protection grounds within that period. We will work with you in good faith to address the objection.
3. If we cannot resolve it, you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees for the unused period.
4. We impose on every subprocessor, by written contract, data protection obligations no less protective than those in this addendum.
5. We remain fully liable to you for the performance of each subprocessor's obligations.

The product gives you direct control over Customer Personal Data. You can view, correct, export and delete documents, recipients, contacts and field values yourself, which will usually be the fastest way to answer a request.

Where a request cannot be answered through the product, we will provide reasonable assistance by appropriate technical and organisational measures, insofar as possible, taking into account the nature of the processing.

If a data subject contacts us directly about Customer Personal Data, we will not respond to the substance ourselves. We will forward the request to you without undue delay and tell the individual to contact you, unless you have instructed us otherwise or the law requires us to respond.

Taking into account the nature of the processing and the information available to us, we will assist you in ensuring compliance with your obligations on security, breach notification, data protection impact assessments and prior consultation.

Breach notification.

We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point. Where we cannot provide everything at once we will provide it in phases as it becomes available. Notifying you is not an admission of fault.

Impact assessments.

We will provide the information reasonably needed for a data protection impact assessment or a transfer impact assessment. The security page and the subprocessor list are written to answer most of it without a call.

You may export Customer Personal Data at any time during the term, and for 30 days after termination, using the export tools in the product.

At the end of that 30-day window we will delete Customer Personal Data, unless a law to which we are subject requires us to keep it, in which case we will keep only what is required, for only as long as required, and will continue to protect it under this addendum.

We will make available the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate.

• In the first instance we will answer a reasonable security questionnaire and provide our documentation, including the security page, which is written to serve as Annex II.
• Where that is genuinely insufficient, you may conduct an audit no more than once in any twelve-month period, on at least 30 days' written notice, during business hours, without unreasonably disrupting the service, and subject to confidentiality.
• You may audit more frequently following a personal data breach affecting your data, or where a supervisory authority requires it.
• You bear your own audit costs. We bear ours, unless the audit reveals a material breach by us, in which case we bear both.
• An auditor you mandate must not be a competitor of ours, and must sign a confidentiality undertaking.

Where this addendum involves transferring personal data out of the EEA, the UK or Switzerland to a country without an adequacy decision, including to India, the following apply and are incorporated by reference:

• EEA. The SCCs. Where you are a controller and we are a processor, Module Two applies. Where you are a processor and we are a subprocessor, Module Three applies. Clause 7 (docking) applies. Under Clause 9, Option 2 (general written authorisation) applies with the 30-day notice period in clause 6 above. Under Clause 11, the optional independent dispute resolution body is not used. Under Clause 17, the SCCs are governed by the law of Ireland. Under Clause 18(b), disputes go to the courts of Ireland. Annex I and Annex II are at clauses 16 and 17 below, and Annex III is the subprocessor list.
• United Kingdom. The International Data Transfer Addendum issued by the Information Commissioner under section 119A of the Data Protection Act 2018, appended to the SCCs. Tables 1 to 3 are completed by the corresponding parts of this addendum, and in Table 4 neither party may end the Addendum as set out in Section 19.
• Switzerland. The SCCs as amended so that references to the GDPR are read as references to the Swiss Federal Act on Data Protection, the competent authority is the Federal Data Protection and Information Commissioner, and the term data subject includes legal entities where Swiss law so provides.

If the SCCs are replaced or invalidated, the parties will implement the replacement mechanism without undue delay. Where there is a conflict between the SCCs and the rest of this addendum, the SCCs prevail.

For processing subject to the Digital Personal Data Protection Act, 2023, you are the Data Fiduciary and we are a Data Processor engaged under a valid contract as section 8(2) requires. We will process Customer Personal Data only under that contract, will implement reasonable security safeguards under section 8(5), and will assist you in meeting your obligations to Data Principals under sections 11 to 14 and in notifying the Data Protection Board and affected Data Principals of a breach under section 8(6).

We also observe Rule 8 of the SPDI Rules, 2011 in relation to sensitive personal data or information.

For personal information subject to the CCPA, you are the business and we are a service provider. We certify that we understand and will comply with the following restrictions:

• We will not sell or share personal information.
• We will not retain, use or disclose personal information for any purpose other than performing the services specified in the terms, or as otherwise permitted by the CCPA.
• We will not retain, use or disclose personal information outside the direct business relationship between us.
• We will not combine personal information received from you with personal information received from another source, except as the CCPA permits.
• We will notify you if we determine we can no longer meet these obligations, and you may take reasonable steps to stop and remediate unauthorised use.

Each party's liability under this addendum is subject to the limitation of liability in the terms of service, except where Data Protection Law does not permit that limitation, including as between the parties under the SCCs.

In case of conflict, the order of precedence is: the SCCs, then this addendum, then the terms of service.

This addendum takes effect when you accept the terms of service and continues for as long as we process Customer Personal Data.

This addendum applies without signature. If your organisation's process requires a countersigned copy, email legal@dropthedoc.xyz from your account address with your full legal entity name, registered address, the name and title of your signatory, and the Annex I details in clause 16 completed for your use. We will return an executed copy. Naturally, you can sign it through DropTheDoc.

The measures below are summarised here for contractual purposes and described in full on the security page, which forms part of this Annex.