Data Processing Addendum

1. Draft notice

This Data Processing Addendum (“DPA”) is published as a draft scaffold. It supplements our Terms of Service and Privacy Policy, and will apply to Personal Data processed by PapelSoftware LLC on behalf of Customer. We will sign a finalised version with any customer that asks, after legal review. If you need a signed DPA before this page is finalised, email [email protected] and we will send one.

2. Definitions

• Applicable Data Protection Law means laws that apply to the processing of Personal Data, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act as amended (“CCPA/CPRA”) and other equivalent US state privacy laws.
• Customer Personal Data means Personal Data processed by PapelSoftware LLC on behalf of Customer under the Terms of Service.
• Processor, Controller, Processing, Data Subject have the meanings given in GDPR.
• Subprocessor means a third party engaged by PapelSoftware LLC to process Customer Personal Data.

3. Roles of the parties

Customer is the Controller (or Processor acting for a third-party Controller) of Customer Personal Data. PapelSoftware LLC is the Processor (or Sub-Processor) and processes Customer Personal Data only on documented instructions from Customer, as set out in the Terms of Service, the order form and this DPA.

4. Scope and purpose

PapelSoftware LLC processes Customer Personal Data to provide, maintain, secure and support the Services, including (as applicable) development, hosting, monitoring, support, account administration, billing and the obligations in these legal documents. The nature, purpose, duration, categories of Data Subjects and types of Personal Data processed are set out in Annex 1.

5. Processor obligations

• process Customer Personal Data only on documented instructions from Customer;
• ensure that personnel authorised to process Customer Personal Data are bound by appropriate confidentiality obligations;
• implement the technical and organisational measures described in Annex 2;
• assist Customer, to the extent reasonably possible, in responding to Data Subject requests and in meeting its own obligations under Applicable Data Protection Law;
• make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including summaries of our security and privacy practices;
• delete or return Customer Personal Data at the end of the Services, as described in the Terms.

6. Subprocessors

Customer gives general authorisation to PapelSoftware LLC to engage the Subprocessors listed on our Subprocessors page. We will notify Customer at least 30 days before adding or replacing a Subprocessor. Customer may object on reasonable data protection grounds; if we cannot address the objection, Customer may terminate the affected Services for the unused portion of the term.

7. International transfers

Where Customer Personal Data is transferred from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, the Standard Contractual Clauses issued by the European Commission (Decision 2021/914) and the UK Addendum apply and are incorporated into this DPA by reference. PapelSoftware LLC will implement additional safeguards where required.

8. Security incidents

PapelSoftware LLC will notify Customer without undue delay, and in any event within 72 hours of confirming a Personal Data Breach affecting Customer Personal Data, with the information required by Article 33(3) GDPR as it becomes available. We will take reasonable steps to contain, investigate and remediate the incident.

9. Audits

On request and no more than once per year, PapelSoftware LLC will respond to a reasonable written security questionnaire and share available third-party assessments. Where Applicable Data Protection Law requires an on-site audit, the parties will agree the scope and timing in good faith.

10. CCPA/CPRA

For Personal Information covered by the CCPA/CPRA, PapelSoftware LLC acts as a “Service Provider” and will not sell or share Personal Information, retain, use or disclose it outside the direct business relationship, or combine it with Personal Information received from other sources, except as permitted by the CCPA/CPRA.

11. Annexes

Annex 1 (Details of processing). Categories of Data Subjects: Customer users and the individuals represented in Customer content. Categories of Personal Data: account identifiers, contact information, support correspondence and any Personal Data contained in Customer content submitted to the Services. Duration: the Services term, plus statutory retention periods described in our Privacy Policy.

Annex 2 (Security measures). See our Security page, which describes access controls, encryption in transit and at rest, change management, logging, backups, vulnerability management and personnel policies.

Annex 3 (Subprocessors). See our Subprocessors page.

12. Contact us

If you have questions about this document, contact us using the details below.

Support hours: Monday to Friday, 9:00 a.m. to 6:00 p.m. Central Time.