Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Self-Serve Terms of Use between Trailing Comma, Inc. (d/b/a Jsonify) ("Jsonify") and the customer accepting those Terms ("Customer"). It applies whenever Jsonify processes personal data on Customer's behalf through Customer-configured pipelines, including Provider-sourced Data (as defined in the Terms) obtained for Customer ("Customer Personal Data"). It does not apply to Jsonify's independent collection under Section 10 of the Terms, including raw content from open sources that Jsonify caches across pipelines, to account data, or to platform knowledge, for which Jsonify is a controller under its Privacy Policy.

1. Roles and Scope

Customer is the controller (or, where Customer acts for another controller, a processor) of Customer Personal Data; Jsonify is Customer's processor (or subprocessor). Jsonify will process Customer Personal Data only on Customer's documented instructions — as given through the configuration of pipelines, the Terms, and this DPA — unless required to do otherwise by law, in which case Jsonify will inform Customer unless the law prohibits it.

2. Details of Processing

• Subject matter and duration: the collection, structuring, checking, and delivery of data through pipelines Customer configures, for the duration of the Terms and until deletion under Section 13;
• Nature and purpose: automated extraction and processing of data from sources Customer confirms, and delivery of datasets to destinations Customer chooses;
• Categories of data: the data present on the sources Customer confirms and in files Customer uploads as sources, which may incidentally include personal data such as names, usernames, and user-generated content; and, where Customer connects an account to a source under Section 6 of the Terms, the content that account is entitled to see and the stored session for it; and Provider-sourced Data obtained at Customer's request, which may include professional profile information;
• Employee data: we also process data relating to Customer's employees when assisting them in using the Services or debugging, including their names, professional contact addresses, the content of our exchanges and, where relevant, technical data such as logs and events;
• Data subjects: individuals whose personal data appears on the confirmed sources or in Provider-sourced Data.

3. Data Controller Instructions

Source selection. Customer gives its instructions on the processing of Customer Personal Data by selecting and confirming the sources each pipeline reads, together with the schema and schedule of each pipeline. Customer alone decides which sources are read and which data is extracted from them. Jsonify does not collect from a source that Customer has not confirmed.

Proposals. A proposal by Jason — a suggested source, field, or schedule — is not an instruction until Customer accepts it.

Source removal. Jsonify may stop collecting from a source as described in the Terms; doing so is not a breach of Customer's instructions.

Removal requests. Customer instructs Jsonify, as a standing instruction, that Jsonify may exclude an individual's data from Customer's pipelines following a request from that individual, and will notify Customer. Customer may object within 30 days where it has a lawful basis to continue.

4. Customer Obligations

Customer is responsible for the lawfulness of the processing it configures: having a valid legal basis, providing any required notices, honouring data-subject rights it controls, and not instructing collection of special categories of personal data unless strictly lawful. Customer warrants that its instructions comply with applicable data protection laws.

5. Confidentiality and Personnel

Jsonify ensures that persons authorised to process Customer Personal Data are bound by confidentiality obligations.

6. Security

Jsonify implements appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art and the risks of the processing, including:

• Encryption in transit and at rest: connections to the Services and between production systems are encrypted with TLS; databases and backups holding customer data are encrypted at rest; access to encryption keys is restricted to authorised personnel with a business need.
• Access control and MFA: access to production systems is role-based and limited to what each role needs; accounts use unique credentials or authorised SSH keys; remote access to production requires multi-factor authentication; access is reviewed at least quarterly and revoked within defined timelines when personnel leave.
• Logging and monitoring: production systems and applications are monitored for availability and security events; security-relevant logs are collected in a log management tool; the production network runs automated intrusion detection; alerts are reviewed and acted on by engineering.
• Environment separation: development and testing run in environments logically separated from production; changes are tracked in version control and reviewed and approved before deployment; the production network is segmented to restrict access to customer data.
• Vulnerability management: source code and dependencies are scanned automatically; external-facing systems are scanned for vulnerabilities at least quarterly; an external firm performs a penetration test at least annually; findings are remediated under internal timelines by severity.
• Backup and recovery: customer data is backed up on a schedule under a documented backup and recovery policy; backups are encrypted, monitored for completion and failures, and accessible only to authorised personnel.
• Personnel confidentiality and training: personnel pass background checks at hire, sign confidentiality agreements, complete security awareness training at hire and at least annually, and are onboarded and offboarded under documented checklists.
• Subprocessor due diligence: subprocessors are assessed under a third-party management policy before engagement, bound by security and confidentiality commitments, listed in a vendor inventory and, where critical, reviewed at least annually.
• Incident response: a documented incident response plan, communicated to personnel, sets out how security incidents and personal data breaches are identified, reported, contained and notified (Section 7).

These controls are audited under SOC 2 Type II; the current report is available to Customer on request under Section 12. Jsonify will assist Customer, taking into account the nature of the processing, in meeting Customer's own security, breach-notification, and data-protection-impact-assessment obligations.

7. Personal Data Breaches

Jsonify will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably required for Customer to meet its own notification obligations.

8. Subprocessors

Customer authorises Jsonify to engage the subprocessors listed on the subprocessors page. Jsonify will update that page and notify Customer by email at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds within 30 days of that notice; if the objection cannot be resolved, Customer may terminate the affected pipelines. Jsonify imposes data-protection obligations on subprocessors no less protective than this DPA and remains responsible for their performance. Where a third-party fetch provider collects personal data for a Customer request, it acts as Jsonify's subprocessor and this Section 8 applies to it. Where a provider supplies data it collected independently before the request, it acts as an independent controller for that collection, and Section 5 of the Terms governs the steps Jsonify takes in relation to it.

9. Data Subject Requests

Taking into account the nature of the processing, Jsonify will assist Customer with appropriate technical and organisational measures to respond to data-subject requests. If a data subject contacts Jsonify directly about processing under Customer's control, Jsonify will refer the request to Customer where it can identify them.

10. International Transfers

Where the processing involves a transfer of personal data from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree that the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914, Module Two: controller to processor, or Module Three where Customer is a processor) are incorporated into this DPA by reference, with Customer as data exporter and Jsonify as data importer, completed with the details in Section 2 and the security measures in Section 6. For UK transfers, the ICO's International Data Transfer Addendum applies to the Clauses.

For the Clauses, Clause 7 applies. Under Clause 9(a), Option 2 applies, with the notice period set out in Section 8. The optional wording in Clause 11(a) does not apply. The competent supervisory authority is determined under Clause 13(a). Under Clause 17, Option 2 applies and, where the law of the Member State of the data exporter does not allow for third-party beneficiary rights, the law of Portugal applies. Under Clause 18(b), disputes are resolved by the courts of Portugal.

11. CCPA and US State Laws

Where US state privacy laws such as the California Consumer Privacy Act apply, Jsonify acts as Customer's "service provider": it will not sell or share Customer Personal Data, will not retain, use, or disclose it other than to provide the Services or as permitted by law, and certifies that it understands these restrictions.

12. Audit and Information

Jsonify will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of third-party security documentation, and will respond to a written audit questionnaire no more than once per year. Where that information is not sufficient to demonstrate compliance, where a supervisory authority requires it, or following a personal data breach affecting Customer, Customer or an independent auditor it mandates may carry out an audit, including an on-site inspection. Audits take place no more than once per year, except where a supervisory authority requires otherwise or after such a breach. They take place on at least 30 days' written notice, during business hours and without disrupting the Services. The auditor must be bound by confidentiality obligations. Customer bears the cost of the audit, unless it reveals a material breach of this DPA by Jsonify.

13. Return and Deletion

During the Terms, Customer can export its datasets through the Services. After the Terms end, Jsonify will delete Customer Personal Data after the export window described in the Terms, unless law requires longer retention, in which case it remains protected under this DPA until deleted. Copies held in backups are deleted in the ordinary backup cycle and remain protected under this DPA until then.

14. Precedence

If this DPA conflicts with the Terms, this DPA governs for the processing of Customer Personal Data. If the Standard Contractual Clauses conflict with this DPA, the Clauses govern.

15. Contact

Questions about this DPA: paul@jsonify.com.