Data Processing Addendum

Draft for legal review · Last updated [date]

This addendum is between Clawvisor Inc. ("we", "us") and you, the developer, and is part of our Developer Terms. It covers the personal data Wakeshift handles for your app.

1. Who does what

• For your app's users, you decide and we act for you. When your app has Wakeshift deliver messages to people's agents, you are the controller of their personal data (under US state laws, the business), and we are your processor (the service provider). We handle it only to run Wakeshift for your app, on your instructions. These terms, your app's settings and your calls to the app API are your instructions.
• Some data is ours. We are an independent controller of: account data of developers and of people who sign in to Wakeshift; the records of who approved which app to wake which agent, and when it was withdrawn; and data we use to keep Wakeshift secure and to prevent abuse. Our Privacy Policy covers that data.

2. What we do with your users' data

• We use it only to store and deliver your app's messages, to run the approvals and limits Wakeshift applies, and to keep the service working and secure.
• We don't sell or share it, use it for advertising, combine it with other data except to run Wakeshift for you, or keep, use or disclose it for any other purpose.
• The people who work on Wakeshift are bound to keep it confidential.
• We tell you if we believe an instruction of yours breaks data protection law, or if we can no longer meet our obligations under this addendum.

3. Security

We protect your users' data with the measures in Schedule 3. If we become aware of a breach that affects it, we tell you without undue delay, and within 72 hours, with what we know and what we're doing about it.

4. Subprocessors

We use the subprocessors in Schedule 4. We tell you at least 30 days before adding or replacing one, by email and on this page. If you object on reasonable data protection grounds and we can't address the objection, you can end the Developer Terms. Each subprocessor is bound by data protection terms at least as protective as these, and we remain responsible for it.

5. Your users' requests

You answer your users' requests to see, correct or delete their data. The app API lets you find what Wakeshift holds for a user and delete all of it ("forget user"). If we receive a request about your app, we forward it to you within 5 business days and don't answer it ourselves, except to point the person to you.

6. Deletion

• We keep your users' data until you delete your app, or until you have us forget a user, as Schedule 2 says. We may delete it sooner.
• When you delete your app, or the Developer Terms end, we delete your users' data within 30 days. Backups are overwritten within a further 7 days.

7. Information and audits

• On request, we give you the information you reasonably need to show that we meet this addendum, such as a description of our security measures and our subprocessors.
• You may audit our compliance with this addendum, yourself or through an independent auditor bound to confidentiality, once a year on 30 days' written notice, and also after a breach that affects your users' data or when a regulator requires it. We may first offer a recent independent audit report or certification covering the same points, if it answers your questions. You pay for your own audit.
• If a regulator asks us about your app's data, we'll cooperate.

8. Transfers outside the EU and UK

We store data in the United States. Where data protection law requires safeguards for data sent there from the European Economic Area, the UK or Switzerland, the EU Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 are part of this addendum, as follows:

• Module 2 (controller to processor) applies, with you as the data exporter and us as the data importer.
• Clause 7 (the docking clause) applies.
• Clause 9: option 2, general written authorization, with the notice period in section 4.
• Clause 11: the optional wording doesn't apply.
• Clauses 17 and 18: the law of Ireland, and the courts of Ireland.
• Annex I: the parties are you and Clawvisor Inc., with the contacts in the Developer Terms; the processing is described in Schedule 1; the competent supervisory authority is the one for your establishment, or for your EU representative.
• Annex II is Schedule 3. Annex III is Schedule 4.

For data from the UK, the UK International Data Transfer Addendum applies, with Table 1 to 3 filled in as above and either party able to end it under its Section 19. For data from Switzerland, references to the GDPR include the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority.

9. Order of documents

Where this addendum conflicts with the rest of the Developer Terms on personal data, this addendum wins.

Schedule 1: The processing

Schedule 2: How long data is kept

We keep each kind of your users' data (messages, delivery records, their agents and conversations, and their approval records) until you delete your app or have us forget the user. Data from guest sign-in is kept until the game or link it belongs to is deleted or expires, where your app sets an expiry, and otherwise by the same rule. We may delete any of it sooner. Server logs, which hold no message content, are kept for 30 days. After deletion, everything goes within 30 days, and backups are overwritten within a further 7 days.

Schedule 3: Security measures

• Each team's and each app's data is kept separate in the database, and the service checks that separation on every request.
• Data is encrypted in transit and at rest.
• Apps sign in with their own keys, of which we keep only the public half. Tokens that connect agents expire, and can be revoked.
• Access to production systems is limited to the people who run Wakeshift, and logged.
• Logs never contain message content, tokens or keys.

Schedule 4: Subprocessors