Data Processing Addendum

1.1This Addendum applies where RelayHand LLC (“Processor”) processes Personal Information on behalf of Customer (“Controller”) in providing the Service. Terms not defined here have the meanings given in the Terms of Service or in Applicable Data Protection Law.

1.2“Personal Information” means information within Customer Data that identifies or could reasonably be linked to an individual. “Applicable Data Protection Law” means every privacy law applicable to the processing, including the California Consumer Privacy Act as amended by the CPRA, the Tennessee Information Protection Act, and comparable laws of other states.

1.3Controller decides; Processor executes. Customer determines the purposes and means of processing Personal Information within the Service. Processor processes it only on Customer's documented instructions, which comprise the Terms, this Addendum, the configuration Customer sets in the Service, and the actions Customer's Users and authorised clients take.

1.4Processor is the controller (and, under the CCPA, the business) with respect to Account Data — information about Customer and its Users — which is governed by the Privacy Policy rather than by this Addendum.

1.5Processor will tell Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may decline to act on it.

2.1Customer represents that it has a lawful basis for the collection and processing of Personal Information it puts into the Service, has given every notice and obtained every consent required — including consent to be contacted by SMS, email or telephone, and consent to call recording where applicable — and that its instructions comply with Applicable Data Protection Law.

2.2Customer is responsible for the accuracy and legality of Personal Information it uploads, for deciding what is retained and for how long within the controls the Service provides, and for responding to requests from the individuals concerned.

2.3Customer will not put into the Service any special category of data, protected health information subject to HIPAA, information subject to the Gramm-Leach-Bliley Act, payment card numbers, or government identifiers, other than the limited business identifiers the Service asks for. Processor has not contracted to handle those categories and has not designed the Service for them.

3.1Subject matter and duration. Provision of the RelayHand platform, for the term of the Terms plus the retention windows described there.

3.2Nature and purpose. Storing, organising, rendering, transmitting, analysing and deleting Personal Information in order to operate a customer relationship management platform: maintaining customer records; producing and delivering quotes, contracts, amendments and invoices; capturing electronic signatures; sending and receiving SMS and email; answering and transcribing telephone calls; initiating payments; scheduling work; and generating AI output the Customer requests.

3.3Categories of individual. Customer's own customers and prospects; property owners and occupiers; referral partners; and people who call or message Customer's business.

3.4Categories of Personal Information. Name; postal address; email address; telephone number; property details and photographs; job, quote and invoice records; message and call content, transcripts and metadata; electronic signature records including IP address and timestamp; payment references and card authorization records (not card numbers); and free-text notes entered by Customer.

4.1Processor is a service provider under the CCPA and a processor under the Tennessee Information Protection Act and comparable laws. Personal Information is disclosed to Processor only for the limited and specified business purposes set out in §3. Processor certifies that it understands these restrictions and will comply with them.

4.2Processor will not:

• Sell or share Personal Information, as “sell” and “share” are defined by the CCPA;
• Retain, use or disclose it for any purpose other than the business purposes specified in this Addendum, including for a commercial purpose of its own;
• Retain, use or disclose it outside the direct business relationship between the parties;
• Combine it with Personal Information received from another source, except as permitted for a service provider to detect security incidents or resist malicious or illegal activity;
• Use it to train or improve any machine learning model, its own or a third party's, or for cross-context behavioural advertising.

4.3Confidentiality. Processor limits access to personnel who need it to provide the Service, and binds them to confidentiality obligations that survive their engagement.

4.4Security. Processor maintains appropriate technical and organisational measures, described in §8, having regard to the nature of the processing and the risk to individuals.

4.5Cooperation. Processor grants Customer the right to take reasonable steps to ensure Personal Information is used consistently with Customer's obligations, and will notify Customer if it determines it can no longer meet its obligations under Applicable Data Protection Law. On such notice Customer may take reasonable steps to stop and remediate unauthorised use.

5.1Processor and its subprocessors process Personal Information in the United States. Customer instructs Processor to do so.

5.2Where the GDPR or UK GDPR applies to a transfer, the parties agree that the European Commission's Standard Contractual Clauses (Decision 2021/914), module two (controller-to-processor), are incorporated into this Addendum by reference and completed as follows: Customer is data exporter, Processor is data importer; clause 7 (docking) does not apply; clause 9 option 2 (general written authorisation) applies with the notice period in §6.3; clause 11 optional independent dispute resolution does not apply; clause 17 is governed by Irish law; clause 18(b) venue is Ireland. Annexes I, II and III are populated by §3, §8 and the subprocessor list respectively. The UK Addendum (version B1.0) applies to UK transfers.

5.3Processor will notify Customer if it receives a legally binding request from a public authority for Personal Information, unless prohibited from doing so, and will challenge a request it considers unlawful.

6.1Customer gives general authorisation for Processor to engage subprocessors to provide the Service. The current list, with the role and location of each, is published at relayhand.com/subprocessors and forms part of this Addendum.

6.2Processor imposes on each subprocessor data protection obligations no less protective than those in this Addendum, and remains liable to Customer for a subprocessor's performance as if it were its own.

6.3Notice and objection. Processor will give at least 30 days' notice before adding or replacing a subprocessor, by email to the account address and by updating the published list. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid unused fees. An emergency replacement needed to maintain the Service may be made with such notice as is practicable.

7.1If Processor receives a request from an individual to access, correct, delete or port Personal Information held for Customer, Processor will not respond on the merits except to confirm receipt and direct them to Customer, and will pass the request to Customer without undue delay — unless a law requires Processor to respond directly.

7.2Processor will provide reasonable assistance, taking into account the nature of the processing, with Customer's own obligations to respond to individual requests, to conduct data protection assessments, and to consult a regulator where required. The Service's own export and deletion tools are the primary means of that assistance; assistance beyond them may be charged at Processor's reasonable rates.

7.3Deletion is not always available. Certain records are retained despite a deletion request because deleting them would defeat their purpose or breach a legal obligation: signed-document archives, suppression-list entries recording that a person must not be contacted, legal-acceptance records, and financial records required for tax. §9 of the Privacy Policy lists these.

8.1Processor's measures include, at a minimum: encryption of Personal Information in transit and at rest; tenant isolation enforced in the database through row-level security independently of application code; role-based access control; column-level restriction of the most sensitive credentials; private object storage served only through expiring links; append-only audit logging of automated actions and of signed-document archives; segregation of payment card handling to a PCI-compliant processor so that card numbers never reach Processor's systems; verification of inbound webhook signatures; least-privilege access for personnel; and logging and monitoring of access.

8.2Measures may be updated as the Service evolves, provided the overall level of protection is not reduced.

9.1Processor will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer's Personal Information, with the information then available: the nature of the incident, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed.

9.2Processor will provide reasonable assistance with Customer's own notification obligations. Notification is not an admission of fault or liability by either party.

9.3Customer is responsible for notifying its own customers and any regulator where the law places that duty on the controller.

10.1On reasonable written request, no more than once in any twelve-month period unless required by a regulator or following a Personal Data Breach, Processor will make available the information reasonably necessary to demonstrate compliance with this Addendum. Processor may satisfy this by providing a summary of its security measures, responses to a reasonable security questionnaire, and any third-party report it holds.

10.2An on-site inspection may be conducted only where a regulator requires it, on 30 days' notice, during business hours, subject to confidentiality, without access to other customers' data or to Processor's infrastructure providers, and at Customer's expense.

11.1On termination, Processor will make Personal Information available for export for the period stated in the Terms and will then delete or de-identify it, save for copies retained as permitted by §7.3 and by law, and for backups which expire on their own cycle.

12.1This Addendum is subject to the Terms of Service, including its limitations of liability, which apply to the parties' obligations under this Addendum in aggregate and not separately. Nothing here limits a liability that cannot be limited by law.

12.2If a provision conflicts with the Terms of Service as to the handling of Personal Information, this Addendum controls. If a provision is held invalid, the rest remains in effect.

12.3Processor may amend this Addendum where required by a change in Applicable Data Protection Law, on notice as described in the Terms.