Data processing addendum

This Data Processing Addendum (DPA) is part of the Vuely Terms of Use (the Terms) between Vuely, Inc. (Vuely) and the Customer. It applies automatically, with no signature needed. If you would like a countersigned copy, email support@vuely.co. Words defined in the Terms have the same meaning here.

1. Definitions

• Data Protection Laws means all privacy and data protection laws that apply to the processing of Customer Personal Data under the Terms, including the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act.
• Customer Personal Data means personal data in Customer Content that Vuely processes for Customer.
• Subprocessor means a third party that Vuely engages to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• SCCs means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914. UK Addendum means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner, version B1.0.
• Controller, processor, data subject, personal data, and processing have the meanings given in the GDPR. Under U.S. state laws, processor includes service provider.

2. Roles

Customer is the controller of Customer Personal Data, or a processor acting for its own clients. Vuely is Customer's processor, or subprocessor. Annex 1 describes the processing. Customer is responsible for having a lawful basis for the processing and for giving data subjects any notices the law requires.

3. Vuely's obligations

• Vuely processes Customer Personal Data only on Customer's documented instructions. The Terms, this DPA, and Customer's use of the Services are those instructions. They include improving the Services as section 3 of the Terms describes. Vuely will tell Customer if it believes an instruction breaks Data Protection Laws.
• Vuely will not sell or share Customer Personal Data, as those terms are defined in U.S. state privacy laws. It will not retain, use, or disclose Customer Personal Data outside its direct business relationship with Customer, or combine it with personal data from other sources, except as Data Protection Laws allow a service provider to.
• Vuely requires everyone who processes Customer Personal Data for it to keep it confidential.
• Vuely maintains the security measures in Annex 2. It may update them as long as the overall level of protection does not decrease.
• Taking into account the nature of the processing, Vuely will help Customer respond to data subject requests, carry out data protection impact assessments, and consult supervisory authorities. If Vuely receives a request directly from a data subject about Customer Personal Data, it will send the request to Customer and will not respond to it except as Customer instructs.

4. Subprocessors

Customer authorizes Vuely to use the Subprocessors listed on the subprocessors page. Vuely will update that page at least 30 days before a new Subprocessor starts processing Customer Personal Data, and will email Customer if Customer has asked to be notified. If urgent action is needed to keep the Services running or secure, Vuely may make a change sooner and give notice as soon as it can.

Customer may object to a new Subprocessor on reasonable data protection grounds within that notice period. Both parties will try in good faith to resolve the objection. If they cannot, Customer may terminate the affected Services and receive a refund of prepaid fees for the remainder of the term.

Vuely binds each Subprocessor to written data protection terms at least as protective as this DPA and remains responsible for its Subprocessors' performance.

5. Security incidents

Vuely will notify Customer without undue delay, and no later than 48 hours after becoming aware of a Security Incident. The notice will describe the incident, the data affected, and the steps Vuely is taking, as far as that information is available. Vuely will take reasonable steps to contain the incident and limit its effects. Notifying Customer is not an admission of fault.

6. Deletion and return

After the Services end, Vuely keeps Customer Personal Data for 12 months and then deletes it, as section 10 of the Terms describes. At Customer's request, Vuely will return or delete it sooner, within 30 days, unless the law requires Vuely to keep it.

7. Audits

Vuely will make available the information reasonably needed to show that it complies with this DPA, including written answers to a reasonable security questionnaire once a year. If that information is not enough, or a supervisory authority requires it, Customer may audit Vuely's compliance at Customer's expense, on at least 30 days' notice, during business hours, and under confidentiality obligations.

8. International transfers

Vuely processes Customer Personal Data in the United States and in the other countries listed on the subprocessors page. For transfers of personal data protected by the GDPR, the SCCs are incorporated into this DPA as follows:

• Module Two applies where Customer is a controller, and Module Three where Customer is a processor.
• The docking clause in Clause 7 applies.
• In Clause 9, Option 2 applies, with the notice period in section 4 of this DPA.
• The optional wording in Clause 11 does not apply.
• In Clause 13, the supervisory authority is the one that the SCCs make competent based on Customer's establishment or representative.
• In Clauses 17 and 18, the law and courts of Ireland apply.
• Annex I is completed by Annex 1 of this DPA, Annex II by Annex 2, and Annex III by the subprocessors page.

For transfers protected by the UK GDPR, the UK Addendum applies. Its Tables 1 to 3 are completed with the information in this DPA, and either party may end it as Section 19 of the UK Addendum allows. For transfers protected by Swiss law, the SCCs apply with these changes: the Swiss Federal Data Protection and Information Commissioner is the supervisory authority, references to member states include Switzerland, and references to the GDPR include the Swiss Federal Act on Data Protection.

9. Liability and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the SCCs do not allow it. If documents conflict, the SCCs and UK Addendum come first, then this DPA, then the Terms.

Annex 1. Description of processing

• Data exporter. Customer, a user of the Services. Contact details are in Customer's account.
• Data importer. Vuely, Inc., a provider of software for sign companies. Contact: support@vuely.co.
• Data subjects. Customer's users; Customer's clients and their staff; people who receive site-survey links; and people who appear in photos Customer uploads.
• Personal data. Names, email addresses, phone numbers, job titles, business and site addresses, photos of sites and buildings (which can incidentally show people, vehicles, or license plates), messages, and usage data from opening links sent through Vuely.
• Sensitive data. None intended. Customer should not upload special categories of personal data.
• Frequency. Continuous, while Customer uses the Services.
• Nature and purpose. Hosting and storage; generating mockups, measurements, sign code research, and proposals, including with AI providers; sending emails and links on Customer's behalf; support; security; and improving the Services.
• Duration. The term of the Terms, plus the 12-month retention period in section 10 of the Terms.
• Subprocessors. The same subject matter, nature, and duration, as listed on the subprocessors page.

Annex 2. Security measures

• Encryption. TLS for data in transit. Our database and file storage providers encrypt data at rest.
• Separation. Every customer record belongs to one organization, and the app checks that organization on every request.
• Access control. Customer sign-in through Clerk. Staff access to production systems is limited to people who need it, each with an individual account.
• Links. Site-survey links are scoped to a single assignment by a signed token. Images kept for mockup review are in private storage.
• Providers. Hosting, database, sign-in, and payment providers that hold SOC 2 or PCI DSS certifications.
• Resilience. Database backups with point-in-time restore.
• Monitoring. Error tracking, logging, and rate limiting on public endpoints.
• Development. Code review before release, secrets kept out of source code, and regular dependency updates.
• Incident response. A process to investigate, contain, and report Security Incidents as section 5 describes.
• Subprocessors. Each is reviewed for security and data protection before Vuely uses it.