Data Processing Addendum

1. Definitions

Terms defined in the Terms of Service carry the same meaning here. In addition:

• Applicable Privacy Laws. The privacy and data protection laws that apply to the Client Personal Information, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Oregon, Texas, Montana, Delaware and other states as they take effect.
• Client Personal Information. Personal information about the Client's own customers, prospects and contacts that we process on the Client's behalf through the Services. It does not include information about the Client itself, which is covered by the Privacy Policy.
• Processing. Any operation performed on personal information, including collecting, storing, using, disclosing, transmitting and deleting it.
• Security Incident. A confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to Client Personal Information.
• Sub-processor. A third party we engage to process Client Personal Information in order to deliver the Services. The current list is in section 5.

2. Roles and Scope of Processing

The Client is the Business and Controller of Client Personal Information. We are the Service Provider and Processor. The Client decides what is collected, from whom, and why. We process it only to deliver the Services.

This Addendum forms part of the Terms of Service and applies whenever we process Client Personal Information. Where it conflicts with the Terms, this Addendum governs for that processing.

The details of the processing are as follows.

3. Processing Instructions and Restrictions

We process Client Personal Information only on the Client's documented instructions, which are the Terms of Service, this Addendum, the configuration of the Client's account, and any further written instruction the Client gives us.

We will not do any of the following.

• Sell Client Personal Information, or share it for cross-context behavioural advertising.
• Retain, use or disclose it for any purpose other than delivering the Services, or as otherwise permitted by Applicable Privacy Laws.
• Retain, use or disclose it outside the direct business relationship between us and the Client.
• Combine it with personal information from another source, except where Applicable Privacy Laws permit it for a service provider.
• Use it to build or improve our own products or models, or to train any general-purpose system.
• Use it to market our own services to the Client's customers.

We will tell the Client if we determine that an instruction is likely to breach Applicable Privacy Laws, and we may decline to act on it.

We certify that we understand these restrictions and will comply with them, as Applicable Privacy Laws require of a service provider.

The Client is responsible for the lawfulness of the information it loads, for the consents behind the messages it sends, and for the privacy notice it gives its own customers.

4. Confidentiality and Personnel

We limit access to Client Personal Information to the people who need it to deliver the Services or to support the Client.

Everyone with access is bound by a written confidentiality obligation that survives the end of their engagement with us, and is trained on handling personal information in proportion to what their role touches.

Access is removed promptly when someone no longer needs it, including on the day an engagement ends.

5. Sub-processors

The Client gives general authorisation for us to engage the Sub-processors listed below. Each is bound by written terms no less protective than this Addendum, and we remain responsible to the Client for their performance.

We will give the Client at least 30 days' written notice before engaging a new Sub-processor or materially changing what an existing one does. The Client may object on reasonable data protection grounds within that period, and we will work in good faith to resolve it, which may include not making the change or offering the Client the ability to terminate without penalty.

Notice is given to the email address on the Client's account. Clients who want to be told at a different address should tell us.

6. Security

We maintain technical and organisational measures appropriate to the risk, including the following.

• Encryption in transit for data moving between systems, and encryption at rest for stored data.
• Access controls limiting access to what a role requires, with multi-factor authentication on accounts that can reach Client Personal Information.
• Logging of administrative access, so it is possible to establish who did what.
• Separation of Client accounts, so one Client cannot reach another's data.
• Review of Sub-processors before engagement and periodically afterwards.
• Backups, and a documented route to restore from them.
• Prompt removal of access when someone leaves or changes role.

We review these measures at least annually and may change them, provided the level of protection is not reduced.

7. Security Incidents

We will notify the Client of a Security Incident affecting their Client Personal Information without undue delay, and in any event within 72 hours of becoming aware of it.

The notification will include, as far as we know it at the time:

1. What happened, and when we became aware of it.
2. The categories and approximate volume of information affected.
3. The likely consequences.
4. What we are doing about it, and what we suggest the Client does.
5. A contact who can answer further questions.

We will not delay the initial notification in order to complete an investigation. Where we do not yet have the full picture we will say so and follow up as we learn more.

We will assist the Client with any notification the Client must make to a regulator or to affected individuals. Deciding whether such a notification is required is the Client's call, because the Client is the Controller.

A notification under this section is not an admission of fault or liability.

8. Consumer Requests and Assistance

If one of the Client's customers contacts us directly to exercise a privacy right, we will not action it ourselves. We will pass it to the Client without undue delay and tell the person we have done so, unless the law requires otherwise. The Client controls the data and decides.

We will give the Client reasonable assistance in meeting its obligations, including locating, exporting, correcting or deleting a person's information within the Services, and providing information the Client needs for a data protection assessment.

Where the Client can do it themselves in their account, that is usually faster than asking us.

9. Data Retention and Deletion

We retain Client Personal Information only as long as we need it to deliver the Services, or as the law requires.

On termination the Client has 30 days to export their data, as the Terms of Service provide. After that we will delete it, or return it and then delete it if the Client asks in writing during that window.

We may keep information where the law requires it, such as billing and tax records, or where it is subject to a legal hold. Anything kept on that basis stays protected by this Addendum for as long as we hold it, and is not used for any other purpose.

Backups are overwritten on their own cycle, so deleted information may persist in a backup briefly after deletion. It is not restored except to recover from a failure.

10. Audits

On reasonable written request, and no more than once in any 12-month period unless a Security Incident or a regulator gives cause, we will provide the information reasonably needed to show we are meeting this Addendum.

Where that is not sufficient, the Client may audit on site, on at least 30 days' written notice, during normal business hours, without unreasonable disruption, and subject to confidentiality. The Client bears its own costs and ours where an audit is repeated within the same period.

An audit may not extend to another Client's data, to our own confidential commercial information, or to anything that would put us in breach of an obligation to a third party.

If we obtain an independent audit report or certification, providing it will satisfy a request under this section.

11. International Transfers

We process Client Personal Information in the United States, and our Sub-processors process it there. The Services are not currently offered to Clients in the United Kingdom or the European Economic Area, and this Addendum does not incorporate Standard Contractual Clauses.

If we begin offering the Services in those regions, this Addendum will be updated with an appropriate transfer mechanism before we take on a Client there.

Where a transfer outside the United States becomes necessary to deliver the Services, we will put appropriate safeguards in place first and tell the Client.

12. Liability

Liability under this Addendum is subject to the exclusions and the cap in the Terms of Service, except where Applicable Privacy Laws do not permit that.

Nothing in this Addendum relieves either of us of an obligation imposed directly on us by Applicable Privacy Laws.

13. Term and Changes

This Addendum takes effect when the Client first accepts the Terms of Service and continues for as long as we process Client Personal Information. The obligations that by their nature should outlast it do so, including confidentiality, deletion and liability.

We may update this Addendum to reflect a change in law, in our Sub-processors or in how the Services work. Where a change materially reduces the Client's protection we will give at least 30 days' written notice before it takes effect.

This Addendum is incorporated into the Terms of Service and takes effect without a separate signature. A Client who needs a countersigned copy can ask for one.

14. Contact

Questions about this Addendum, sub-processor objections and audit requests all go to the same place.

• Company. Cayden Chern, a sole proprietor doing business as Volt
• Email. support@mail.voltagencyio.com
• Web. voltagencyio.com