Data Processing Addendum

This DPA is between Fold33, LLC ("Fold33", "we"), and the Customer named in the Agreement. It is incorporated into the Terms of Service by reference and needs no separate signature.

If this DPA conflicts with the rest of the Agreement on the processing of Customer Personal Data, this DPA prevails. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail.

The Customer is the controller of Customer Personal Data, and we are its processor. Where the Customer is itself a processor for someone else, we are its subprocessor, and the Customer confirms that its instructions are authorised by its controller.

We are an independent controller for our own business data: our Customers' business contacts and billing, and the security of our own systems. Our Privacy Policy covers that data, not this DPA.

The Customer's Microsoft 365 or Google Workspace, where its Documents, Markup and people list are kept, is the Customer's own provider under the Customer's own agreement. It is not our Subprocessor.

The Customer is responsible for having a lawful basis for the processing, for the notices it gives its Authorised Users, and for the lawfulness of its instructions.

We process Customer Personal Data only on the Customer's documented instructions, unless the law requires otherwise. If it does, we will tell the Customer before processing, unless the law forbids that.

The Agreement, and the Customer's use and configuration of the Service (including its Settings and Protections), are the Customer's complete instructions. Further instructions must be agreed in writing.

We will tell the Customer if we believe an instruction breaks Data Protection Law. We will not follow that instruction unless the concern is resolved lawfully. The Customer must not instruct us to process data unlawfully.

The details of processing are in Annex 1.

We implement and maintain the technical and organisational measures in Annex 2, taking into account the state of the art, the cost, and the nature, scope, context and purposes of the processing, and the risks to data subjects.

We may update those measures, provided that the update does not materially lower the overall protection of Customer Personal Data.

The Customer is responsible for the security measures in its own control: its Customer Storage, its identity provider, its Settings and Protections, the accounts of its Admins and Authorised Users, and the devices they use.

The Customer gives general authorisation for us to engage Subprocessors. Our current Subprocessors are listed on our Subprocessors page.

We give each Subprocessor data protection obligations that are no less protective than this DPA, and we remain responsible to the Customer for its performance.

We will give at least 30 days' notice before adding or replacing a Subprocessor, by updating the Subprocessors page and emailing the Customer's Admins or notice contact.

The Customer may object on reasonable data protection grounds within that notice period. We will then work in good faith to address the objection. If we cannot, the Customer may end the affected part of the Service by written notice, and we will refund Fees paid in advance for the period after it ends.

If help under this section goes beyond what the Service provides and is more than minimal, we may charge for it at reasonable rates agreed in advance.

We will notify the Customer of a Personal Data Breach without undue delay after becoming aware of it, using the Admin or notice contact on file. We do not wait for a completed investigation before giving the initial notice.

The notice will describe, as far as we then know, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed. Where we cannot give everything at once, we will give it in phases as we learn it.

We will take reasonable steps to contain the breach and reduce its effects, and cooperate with the Customer's investigation. Notifying a breach is not an admission of fault.

When the Agreement ends, we remove the Customer's active portal data within 30 days: its Activity Log, session, suspension and trial seat records, Settings (including direct access grants and email hashes), and logo. The Customer may request return or deletion of Customer Personal Data in our control, subject to section 10.3. Documents, notes and the people list already remain in Customer Storage.

There is little to return, because Documents, Markup and the people list stay in the Customer Storage throughout. Before the end date, Admins can export the Activity Log as a CSV file.

Residual copies may remain in protected backups for approximately 37 days under the standard 30-day retention and 7-day soft-delete settings, restricted to recovery and security purposes and removed through the backup cycle. We may retain records where the law requires, confidentially and only for that purpose. Our Azure operational-log retention is up to 30 days; other provider logs follow their documented policies. Business and billing records handled as an independent controller follow our Privacy Policy.

We will make available to the Customer the information reasonably needed to show that we meet this DPA. We do this first through written answers to reasonable security and privacy questionnaires, and through documentation of our measures.

If that information is insufficient to meet the Customer's obligations under Data Protection Law, the Customer or an independent auditor bound by confidentiality may audit relevant processing. Routine audits are limited to once a year, with 30 days' notice, during business hours and without unnecessary disruption. Extra or faster audits are allowed where required by law, an authority or a relevant Personal Data Breach. We agree reasonable safeguards for other customers' information. The Customer normally pays its audit costs; this does not restrict legally required cooperation or a supervisory authority's access.

We process Customer Personal Data in the United States, and our Subprocessors process it in the locations on the Subprocessors page. The data we store is kept in the Microsoft Azure region of our deployment: Central US (Iowa) unless the Order says otherwise.

Before processing that requires a restricted-transfer safeguard for EEA, UK, Swiss or other protected data, the Customer must notify us and the parties must put the required arrangement in place. Where Standard Contractual Clauses are needed, they must be separately agreed and completed with the correct modules, annexes and any UK or Swiss provisions. This DPA does not by itself execute or complete them. Do not enable that processing until the arrangement is in place. If we cannot establish a lawful arrangement, we will not undertake the affected processing.

We will use a lawful safeguard for Subprocessor onward transfers where Data Protection Law requires one. We do not claim our own Data Privacy Framework certification. If an applicable safeguard is no longer valid, we will work with the Customer on an alternative or stop the affected processing.

Where the CCPA or a similar US state law applies, we are the Customer's service provider or processor. We process Customer Personal Data only for the business purposes in the Agreement.

We will not sell or share Customer Personal Data (as those laws define the words), retain, use or disclose it outside our direct business relationship with the Customer or for any purpose other than the Agreement, or combine it with personal data we receive from others, except as those laws allow.

We will tell the Customer if we can no longer meet these obligations, and the Customer may take reasonable steps to stop and remedy unauthorised processing. We certify that we understand these restrictions and will comply with them.

Each party's liability under this DPA is subject to the limits and exclusions in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow it.

This DPA lasts for as long as we process Customer Personal Data, and ends when that data is deleted.