Data Processing Agreement

Words defined in the Terms have the same meaning here. If this DPA conflicts with the Terms on personal data in Customer Content, this DPA prevails; the Standard Contractual Clauses in clause 10 prevail over both for the personal data they cover.

Customer Content may include personal data about people who appear on the pages you monitor: a name on an order confirmation, an address in a checkout form, an email address a workflow enters. For that personal data you are the controller (or, under United States state privacy laws, the business) and we are your processor (or service provider). We are the controller of the personal data we collect about you and your team as users of the Service; our Privacy Policy describes that data, and this DPA does not cover it.

We process personal data in Customer Content only to provide the Service as you configure it, as the Terms and this DPA describe, and as you otherwise instruct us in writing. Your monitor configuration is your instruction. We will tell you if we believe an instruction breaks data protection law. We do not sell personal data in Customer Content, share it for cross-context behavioural advertising, retain, use or disclose it for any purpose other than providing the Service, or combine it with personal data we hold for other customers, except as the law permits.

We keep Customer Content confidential and make sure that anyone we authorise to process it is bound by confidentiality. We apply the security measures described in our Privacy Policy and will not materially reduce them during your subscription.

You authorise us to use the subprocessors listed in our Privacy Policy. We will give you at least 30 days' notice by email before a new subprocessor starts processing Customer Content. If you object on reasonable data protection grounds and we cannot address the objection, you may end your subscription, and we will refund any prepaid fees for the period after it ends. We are responsible for our subprocessors' performance of this DPA.

Taking into account the nature of the Service, we will help you respond to requests from individuals exercising their rights over personal data in Customer Content, and with your obligations concerning security, breach notification, data protection impact assessments and prior consultation with a supervisory authority, where you cannot meet them through the Service yourself. Assistance beyond what the Service provides is charged at $350 per hour.

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data in Customer Content, we will notify you without undue delay, and in any event within 72 hours of becoming aware of it, and give you the information we have to help you meet your own notification duties.

Screenshots and page text are kept only for the period stated in our Privacy Policy, currently 7 days, and are then deleted. When you delete a monitor, its remaining captures are deleted on that schedule. When you delete your workspace, section 11 of the Terms applies. On request within 30 days after your subscription ends, we will provide a copy of the Customer Content we still hold and then delete it, except for records we must keep by law.

We will make available the information reasonably necessary to show that we meet this DPA, and will answer a reasonable written security questionnaire no more than once a year. Where an audit is required by law or by a supervisory authority, or a questionnaire cannot reasonably resolve a concern, we will cooperate with an audit by an independent auditor you appoint, at your cost, on at least 30 days' notice, during business hours, without disrupting the Service, and subject to confidentiality.

We process and store Customer Content in the United States. Where the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to Customer Content, you transfer that personal data to us in the United States, and the following apply to the transfer:

• the Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914, Module Two (controller to processor), are incorporated into this DPA and form part of it, with these selections: Clause 7, the docking clause, is not included; under Clause 9, option 2 (general written authorisation) applies, with the notice period in clause 5 of this DPA; the optional language in Clause 11 is not included; under Clause 13 and Annex I.C, the competent supervisory authority is that of the Member State in which you are established; under Clause 17, the clauses are governed by the law of Ireland; and under Clause 18, disputes are resolved by the courts of Ireland. Annex I is completed by clause 11 of this DPA, the parties' details in the Terms and your account, and your monitor configuration; Annex II by the security measures in our Privacy Policy; and Annex III by the subprocessor list in our Privacy Policy;
• for transfers subject to the UK GDPR, the International Data Transfer Addendum to the Standard Contractual Clauses issued by the Information Commissioner's Office, with its tables completed by the same details; and
• for transfers subject to Swiss law, the Standard Contractual Clauses as adapted for Switzerland, with references to the GDPR read as references to the Swiss Federal Act on Data Protection and the Federal Data Protection and Information Commissioner as the competent authority.

If any of those clauses conflicts with this DPA or the Terms, the clauses prevail for the personal data they cover.

This clause describes the processing for every customer and completes Annex I of the Standard Contractual Clauses.

This DPA takes effect when you accept the Terms and lasts for as long as we hold Customer Content. We may update it as section 15 of the Terms describes; the effective date at the top of this page identifies the version in force. Questions about this DPA: [email protected], or by post to Simrix Technologies LLC, 495 Route 70 #1035, Brick, NJ 08723, United States.