Data Processing Addendum

This Data Processing Addendum (the “DPA”) is part of the Terms of Service between you (the “Customer”) and Slickup LLC, doing business as Kapiway (“Kapiway”). It applies when Kapiway processes personal data on your behalf while providing the Service. By accepting the Terms you accept this DPA; you do not need to sign anything else. If the Terms and this DPA conflict on the processing of Customer Personal Data, this DPA wins.

A countersigned copy is available on request at support@kapiway.com.

1. Definitions

• Data Protection Law means the laws that apply to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended (“CCPA”).
• Customer Personal Data means personal data that Kapiway processes on the Customer’s behalf in providing the Service, as described in Section 2.
• “Controller”, “processor”, “data subject”, “personal data”, “processing” and “personal data breach” have the meanings given in the GDPR. Under the CCPA, Kapiway is a “service provider” for Customer Personal Data.

2. Roles and scope

For Customer Personal Data, the Customer is the controller and Kapiway is the processor. Kapiway is a separate controller for the account, billing, security and marketing data it collects about its own users, as described in the Privacy Policy; this DPA does not cover that data.

3. Kapiway’s obligations as processor

Kapiway will:

• process Customer Personal Data only on the Customer’s documented instructions, which are the Terms, this DPA and the Customer’s use of the Service, unless the law requires otherwise, in which case Kapiway will tell the Customer first unless the law forbids it;
• tell the Customer if it believes an instruction breaks Data Protection Law;
• make sure everyone it authorises to process Customer Personal Data is bound by confidentiality;
• keep the security measures in Section 5;
• use subprocessors only as set out in Section 4;
• help the Customer answer data subject requests, as set out in Section 7;
• help the Customer with security, breach notification, data protection impact assessments and prior consultation with a regulator, taking into account the nature of the processing and the information available to Kapiway;
• delete or return Customer Personal Data at the end of the Service, as set out in Section 9; and
• make available the information needed to show compliance with this DPA and allow audits, as set out in Section 10.

Under the CCPA, Kapiway processes Customer Personal Data only for these business purposes: providing and supporting the Service the Customer uses, keeping it secure, fixing errors, and the other purposes set out in Section 2. Kapiway will:

• not sell or share Customer Personal Data;
• not retain, use or disclose it for any purpose other than those business purposes, or outside the direct business relationship with the Customer;
• not combine it with personal data it receives from others or collects itself, except as the CCPA allows;
• not try to re-identify any de-identified data it makes from it;
• comply with the CCPA and give Customer Personal Data the same level of privacy protection the CCPA requires of the Customer;
• tell the Customer if it can no longer meet its obligations under the CCPA; and
• let the Customer take reasonable and appropriate steps to stop and fix any use of Customer Personal Data that the Customer has not authorized.

4. Subprocessors

The Customer gives Kapiway general authorisation to use subprocessors. The current list, with what each one does and where, is in Section 9 of the Privacy Policy. Kapiway binds each subprocessor to data protection terms that protect Customer Personal Data at least as well as this DPA, and remains responsible to the Customer for each subprocessor’s performance.

Notice of a new subprocessor. At least 14 days before a new subprocessor starts processing Customer Personal Data, Kapiway adds it to that list, marked “Coming on” with the date it starts, and emails everyone who has asked to be told. To be told, use the form below, or, if you have an account, turn on “New services that handle your data” in Settings. You can also email support@kapiway.com.

Emergency replacement. If Kapiway must replace a subprocessor at once to keep the Service secure or running, it may do so without the 14 days’ notice, and will update the list and notify the customers who asked to be told right after.

Objections. The Customer may object to a new subprocessor on reasonable data protection grounds by writing to support@kapiway.com before it starts (or, after an emergency replacement, within 14 days of the notice). Kapiway will then try to avoid using that subprocessor for the Customer’s data. If it cannot, the Customer may cancel the affected subscription without penalty, and Kapiway will refund the unused part of that month.

5. Security

Kapiway keeps technical and organisational measures that include:

• hosting on Amazon Web Services in the United States (N. Virginia region);
• encryption with TLS 1.2 or later for data in transit between your browser and our servers;
• application-level encryption of stored OAuth refresh tokens, Meta Page access tokens, publishing credentials and outreach mailbox credentials;
• tokens for AI assistants stored only as hashes, issued to one user and revocable by that user;
• passwordless sign-in (one-time email codes or Google Sign-In) with session cookies the page’s scripts cannot read;
• access limited by organisation, project and role, so team members see only what their role allows;
• a request log with IP addresses kept for 6 months (sign-in and security events 12 months) for security investigations;
• error reports sent to Sentry. Error reports carry no user identifier, no request bodies, headers, cookies, query strings or local variables, and email and IP addresses are masked;
• daily database backups kept for 30 days; and
• a separate off switch for each outside data source, so one can be stopped quickly.

Kapiway may update these measures as long as the update does not lower the overall level of protection.

6. Personal data breaches

Kapiway will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will go to the account owner’s email address and will describe, as far as Kapiway then knows, the nature of the breach, the categories and rough number of people and records affected, the likely consequences, and the steps taken or proposed. Kapiway will add information as it learns more and will take reasonable steps to contain the breach. Notifying the Customer is not an admission of fault.

7. Data subject requests

If Kapiway receives a request from a person about Customer Personal Data, it will pass the request to the Customer and will not answer it except to say it has been passed on, unless the law requires otherwise. Taking into account the nature of the processing, Kapiway will help the Customer answer requests to access, correct, delete, restrict, port or object to processing. Much of this the Customer can do in the Service itself; for the rest, write to support@kapiway.com.

The Customer instructs Kapiway to delete, on request, a review, comment or thread excerpt about the person asking, and to tell the Customer it did so.

8. International transfers

Kapiway processes Customer Personal Data in the United States. Where Data Protection Law restricts a transfer of Customer Personal Data from the European Economic Area, the United Kingdom or Switzerland to Kapiway, the parties agree that:

• the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) apply and are incorporated into this DPA by reference: Module 2 (controller to processor) where the Customer is a controller, and Module 3 (processor to processor) where the Customer is itself a processor for its own client;
• in those clauses, the optional docking clause (clause 7) applies; under clause 9 the general written authorisation option applies, with the notice period in Section 4 of this DPA; the optional wording in clause 11 does not apply; clauses 17 and 18 are governed by and brought in the courts of Ireland; Annex I is completed by Section 2 of this DPA and Annex II by Section 5; the competent supervisory authority is the one that applies under clause 13;
• for transfers from the United Kingdom, the International Data Transfer Addendum issued by the UK Information Commissioner applies, completed with the information above, and either party may end it as its Section 19 allows; and
• for transfers from Switzerland, the EU clauses apply with these changes: references to the GDPR are read as references to the Swiss Federal Act on Data Protection; the Swiss Federal Data Protection and Information Commissioner (FDPIC) is the competent authority where the transfer is governed by Swiss law; the term “Member State” includes Switzerland, so that data subjects in Switzerland can bring claims in Switzerland, where they usually live (clause 18(c)).

The Standard Contractual Clauses are governed by the law their own terms choose. The Terms, including their Delaware governing law, govern everything else in this DPA. If this DPA conflicts with the Standard Contractual Clauses, the clauses win.

9. Deletion and return

The Customer can delete much of its data from inside the Service and can ask for a copy from Settings or at support@kapiway.com. Both requests stay open after the Customer’s plan ends, even though the rest of the Service is closed until the Customer subscribes again. To delete your account sooner, ask from Settings. To delete one website’s data, email support@kapiway.com. Kapiway then deletes the Customer Personal Data in it and confirms by email; on request, Kapiway first gives the Customer a copy of its data.

At the end of the Service, the Customer chooses whether Kapiway deletes or returns Customer Personal Data. If the Customer does not choose, Kapiway keeps it for 90 days after the plan ends (a cancellation, a free trial that ends without payment, or a payment still unpaid 5 days after it failed) so the Customer can come back, as the Terms (Section 4) describe, and then deletes it, unless the Customer asks for a copy first. Deleted data leaves the database backups within the 30 days they are kept, and Kapiway deletes it again after any restore. Kapiway may keep data the law requires it to keep, protected under this DPA, for as long as the law requires.

10. Audits

On written request, Kapiway will answer reasonable security questionnaires and give the Customer the information it needs to show that Kapiway meets this DPA. If that is not enough to meet the Customer’s obligations under Data Protection Law, or a regulator asks, the Customer may audit Kapiway once a year, with at least 30 days’ notice, during business hours, at its own cost, and under confidentiality; an independent auditor may do it for the Customer if bound by the same confidentiality.

11. Liability and term

Each party’s liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow a limit. This DPA lasts as long as Kapiway processes Customer Personal Data.

12. Contact

Slickup LLC (doing business as Kapiway), support@kapiway.com, c/o Agents and Corporations, Inc., 1201 Orange St, Suite 600, One Commerce Center, Wilmington, DE 19801, USA.