Last updated: [date of publication]
This addendum forms part of the Terms of Service and applies when we process personal data in Customer Data on your behalf. [Counsel to review and align with the GDPR, UK GDPR and the CCPA/CPRA service-provider requirements.]
You are the controller (or a processor for your own customer); we are the processor (or sub-processor). We process personal data only on your documented instructions: the Terms, your use of the product, and your settings.
Nature and purpose: hosting and processing tickets, messages and attachments to provide the help desk. Duration: while your account is open plus the deletion period. Data subjects: your customers, contacts and agents. Categories: names, email addresses, message content and any data your customers choose to send.
People who access the data are bound by confidentiality. We keep appropriate technical and organizational measures: encryption in transit, hashed passwords, per-organization data separation in the database, least-privilege access, audit logging of administrative actions, and backups.
You authorize the subprocessors listed on the subprocessors page. We will give at least 30 days' notice of additions by email; you may object on reasonable grounds and, if we cannot resolve it, end the service.
We will help you respond to data-subject requests and to meet your security, breach-notification and impact-assessment obligations, taking into account the nature of processing.
We will notify you without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting Customer Data.
You can export Customer Data while your account is open. On closure we delete it as described in the Terms, unless the law requires us to keep it.
On request and no more than once a year, we will provide information needed to show compliance, such as our security summary. [Counsel to define audit rights.]
Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the Standard Contractual Clauses (module 2 or 3) and the UK Addendum are incorporated by reference. [Counsel to complete the annexes.]
We process personal information only to provide the service, do not sell or share it, and do not combine it with other data except as the CCPA permits for a service provider.