Data Processing Addendum

Overview

This Data Processing Addendum ("DPA") supplements the agreement between Statisfy Inc. ("Processor") and its customer ("Controller") and governs Statisfy's processing of personal data on the Controller's behalf when providing the Statisfy platform and services. It is designed to meet the requirements of EU and UK data protection law (GDPR), the CCPA, and the CPRA, and incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum for international transfers.

Key Terms

• Scope: Statisfy processes personal data only on documented instructions from the Controller, and solely to provide the Services under the Agreement
• Security: Personnel with access to personal data are bound by confidentiality and trained on data security practices; appropriate technical and organizational measures are maintained
• Audits: Controllers may audit compliance with reasonable (30 days') prior written notice, at the Controller's expense
• International transfers: Governed by the EU Standard Contractual Clauses and, for UK transfers, the International Data Transfer Addendum
• Sub-processors: Statisfy engages sub-processors for cloud hosting, authentication, integrations, meeting transcription, analytics, monitoring, and email delivery; Statisfy remains liable for their compliance
• Breach notification: Statisfy will notify the Controller without undue delay upon becoming aware of a personal data breach
• Return and deletion: Upon termination, Statisfy will delete or return all personal data within thirty (30) days, unless retention is required by law
• Liability: Statisfy's aggregate liability under the DPA is limited to fees paid by the Controller in the three (3) months preceding the claim

Contact

To request an executable copy of the DPA or ask questions about our data processing practices, contact our Data Protection Officer at privacy@statisfy.com.