Data Processing Addendum

1. What this addendum is

1.1 Part of the Terms

This Data Processing Addendum (the “Addendum”) is part of the Terms of Service between your business (“you”) and JobsiteOn, LLC (“JobsiteOn”, “we”). You do not need to sign it. It applies automatically whenever we handle personal data for you as part of the services, and only to that.

1.2 Words used here

• Customer personal data is the personal data in your workspace that we process for you: for example the details of your customers, leads and team.
• Data protection laws are the privacy laws that apply to that processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, the privacy laws of United States states such as the California Consumer Privacy Act, and the privacy laws of Canada, Australia, New Zealand, Japan and South Korea where they apply.
• Controller, processor, data subject, personal data and processing have the meanings those laws give them. A controller is also a “business”, and a processor a “service provider”, where a law uses those words.

1.3 What it does not cover

The personal data we are responsible for ourselves, such as your account, billing and sign-in records, is covered by our Privacy Policy, not by this Addendum.

2. Roles and instructions

2.1 Who is who

For customer personal data you are the controller, or a processor acting for someone else, and we are your processor. Each of us follows the data protection laws that apply to its own role.

2.2 Your instructions

We process customer personal data only on your documented instructions, including for transfers to another country. The Terms, this Addendum, and the way you set up and use the services are your complete instructions. They include sending customer personal data to the subprocessors and countries in section 6 and section 7.

If we think an instruction breaks a data protection law, we will tell you immediately, and we may hold off acting on it until you confirm or change it. If a law that applies to us requires other processing, we will tell you first unless that law forbids it. Where the GDPR or the UK GDPR applies, only the law of the European Union, a member state or the United Kingdom counts for that.

2.3 Your side

You are responsible for:

• having a lawful reason to collect customer personal data and to have us process it, and giving the people it is about the notices the law requires;
• the consents the law requires, including for texts and emails to your customers and for recording the location of your team;
• the notices and consents the law requires for the open tracking in the emails you send, in particular to people in the European Economic Area and the United Kingdom;
• the accuracy of the data, what you choose to put into a workspace, and who you give access to;
• not putting into a workspace the kinds of data the Terms say do not belong there, such as health data and government ID numbers.

2.4 What we do as a controller

We also use limited information about how the services are used, including by your team, for our own purposes: to bill you, keep the services secure, find and fix faults, measure which features are used, make statistics that identify no person or business, and meet our legal duties. For that we act as a controller, the Privacy Policy applies, and we do not use the content of your workspace.

3. Details of the processing

4. What we commit to

4.1 Confidentiality

Everyone we authorize to process customer personal data is bound to keep it confidential, and we give access only to the people who need it to do their work.

4.2 Security

We protect customer personal data with technical and organizational measures that fit the risk, as Article 32 of the GDPR requires. They are described in the Privacy Policy and in our data encryption guide, and include encryption in transit and at rest, encryption of connection credentials, access controls, monitoring and an incident response process. We may change these measures as long as the overall level of protection does not go down.

4.3 Requests from the people the data is about

The services let you find, correct, export and delete customer personal data yourself. If a person asks us directly to use a right over data we hold for you, we will not answer for you. We will pass the request to you without undue delay and give you the help you reasonably need to answer it.

4.4 Security incidents

If we become aware of a breach of security that leads to the accidental or unlawful destruction, loss, alteration or disclosure of, or access to, customer personal data, we will tell you without undue delay. We will tell you what we know about what happened, the data and the people affected, and what we are doing about it, and we will keep you informed as we learn more. Telling you about an incident is not an admission of fault.

4.5 Help with your own obligations

Taking into account what we do and the information we have, we will give you reasonable help with a data protection impact assessment, with a consultation with a regulator where the law requires one for your use of the services, and with your own duties on security and on breach notices to regulators and to the people affected.

5. United States privacy laws

This section applies where a United States state privacy law, such as the California Consumer Privacy Act, applies to customer personal data. Under those laws we act as your service provider or processor, and we confirm that we understand and will follow these rules:

• We process customer personal data only for the specific business purposes listed under “Nature and purpose” in section 3. You disclose it to us only for those limited and specified purposes.
• We do not sell customer personal data.
• We do not share it for cross-context behavioral advertising or targeted advertising.
• We do not keep, use or disclose it for any purpose other than those purposes, or outside our direct business relationship with you, unless the law allows a service provider to, for example to keep the services secure and to improve them.
• We do not combine it with personal data we get from another source or collect ourselves, unless the law allows it.
• We follow the parts of those laws that apply to us and give customer personal data the level of privacy protection they require.
• We will tell you within five business days if we decide that we can no longer meet these obligations.
• You may take reasonable and appropriate steps to make sure we use customer personal data in line with your own obligations. On notice, you may take reasonable and appropriate steps to stop and fix any unauthorized use. Section 8 does not limit that right.
• We give you the help you reasonably need for a cybersecurity audit or a risk assessment that California law requires of you.
• We help you answer requests from consumers, as section 4 describes.

6. Subprocessors

6.1 Your general permission

You give us general permission to use other companies (“subprocessors”) to process customer personal data. The current ones are listed in the Privacy Policy and in the help center.

6.2 Our responsibility for them

We put each subprocessor under a written contract with data protection duties that protect customer personal data to the standard this Addendum requires, and we remain responsible to you for what a subprocessor does with it.

The Privacy Policy also names a few lookup services for maps, addresses and weather. They receive one address or location at a time, with nothing that says which workspace or person it belongs to, under their own published terms and not under a contract of that kind.

6.3 New subprocessors

We will tell you at least 14 days before a new subprocessor starts processing customer personal data, by email to the owner of your workspace, and we update the list at the same time. You may object in writing to privacy@jobsiteon.com within those 14 days if you have reasonable data protection grounds. We will then work with you in good faith on a way forward, such as a setting that avoids the new subprocessor. If we cannot find one, you may stop using the affected feature or cancel your plan as the Terms describe.

If we have to replace a subprocessor urgently to keep the services secure or running, we tell you as soon as we can, and you can object in the same way.

7. International transfers

7.1 Where the data is processed

We process customer personal data in the United States and in the other countries where our subprocessors operate.

7.2 Transfers from the European Economic Area

Where the GDPR applies to you and customer personal data is transferred to us in a country that the European Commission has not found to give adequate protection, the Standard Contractual Clauses in the Annex to Commission Implementing Decision (EU) 2021/914 (the “SCCs”) are part of this Addendum, as follows:

• Module Two (controller to processor) applies where you are a controller. Module Three (processor to processor) applies where you are a processor.
• You are the data exporter, with the details in your account. We are the data importer: JobsiteOn, LLC, 4848 Lemmon Ave STE 420, Dallas, TX 75219, United States, privacy@jobsiteon.com.
• By accepting the Terms, each of us is treated as having signed the SCCs and their annexes on that date.
• Clause 7, the optional docking clause, does not apply.
• In Clause 9, Option 2 (general written authorization) applies, with the notice period in section 6.
• The optional wording in Clause 11 does not apply.
• In Clause 17, Option 1 applies and the SCCs are governed by the law of Ireland. Under Clause 18(b), disputes go to the courts of Ireland.
• Annex I is completed with the details in section 3, the parties’ details above, and the supervisory authority that Clause 13 points to. Our subprocessors process the data for the same subject matter and for as long as we do, each for the task shown in the list.
• Annex II is completed with the measures in section 4 and in the data encryption guide, as they stood when you accepted. We may improve them but not weaken them. Annex III is not needed, because Option 2 applies.

7.3 Transfers from the United Kingdom

Where the UK GDPR applies, the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner (version B1.0, or the version that replaces it) is part of this Addendum. Its tables are completed with the information in 7.2, and for Table 4 neither party may end it under its section 19.

7.4 Transfers from Switzerland

Where the Swiss Federal Act on Data Protection applies, the SCCs apply with these changes: references to the GDPR are read as references to that Act, the supervisory authority is the Federal Data Protection and Information Commissioner, and “Member State” is not read in a way that stops people in Switzerland from using their rights where they live.

7.5 If the rules change

If one of these transfer tools is replaced or stops being valid, we will put a valid one in its place. If the SCCs and the rest of this Addendum or the Terms conflict, the SCCs apply.

7.6 Other countries

Where the law of another country, such as Japan, South Korea, Canada, Australia or New Zealand, requires you to have a contract with a company that processes personal data for you, this Addendum is that contract.

8. Information and audits

8.1 Information

On written request we will give you the information needed to show that we meet this Addendum, including answers to a reasonable security questionnaire. We may limit routine requests to one a year. That limit does not apply after a security incident that affected your data, or when a regulator asks.

8.2 Audits

You may audit how we process customer personal data, yourself or through an independent auditor you choose who is bound to confidentiality and is not our competitor. We will first offer the information in 8.1. Give us at least 30 days’ written notice, or less if a regulator or a security incident requires it. An audit takes place during business hours, no more than once a year unless a regulator requires it or there has been an incident, without exposing other customers’ data, and at your cost.

9. When the services end

You can export customer personal data while your plan is active and for 90 days after it ends, as the Terms describe. We will give you a copy in that time if you ask, even if your account was closed for a breach, unless the law forbids it.

When you ask us in writing to delete customer personal data, we delete it from our active systems within 30 days, and it leaves our backups when they expire. After the 90 days we may also delete it without being asked. We confirm the deletion in writing if you ask. If a law that applies to us requires us to keep some of it, we keep it confidential and process it only for that purpose.

10. General terms

10.1 Which document applies

For anything about customer personal data, the SCCs (where they apply) come first, then this Addendum, then the Terms. Everything else in the Terms stays as it is, including the governing law and how disputes are resolved, except where the SCCs say otherwise.

10.2 Liability

The limits of liability in the Terms apply to this Addendum, as far as the law allows. Nothing in this Addendum limits the rights that the SCCs or a data protection law give directly to the people the data is about.

10.3 Changes

We may update this Addendum when the law, a regulator or a change in the services requires it. An update that reduces the protection of customer personal data follows the notice rules for material changes in the Terms.

10.4 Contact

For anything about this Addendum, or to ask for a signed copy for your records, write to privacy@jobsiteon.com.