1. Definitions

“Customer Personal Data” means personal data in Customer’s content and apps (as defined in the terms) that GoodTaco processes for Customer, including data about the people who use Customer’s apps.
“Data Protection Laws” means the laws that apply to that processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act (CCPA).
“Controller,” “processor,” “data subject,” “personal data breach,” “service provider” and similar terms have the meanings given in the Data Protection Laws.

2. Roles and instructions

Customer is the controller (or a processor acting for its own controller) of Customer Personal Data, and GoodTaco is its processor (or sub-processor) and service provider.
GoodTaco processes Customer Personal Data only on Customer’s documented instructions. The terms, this DPA, and Customer’s use and configuration of the Services (such as building, publishing and sharing apps, and connecting integrations) are Customer’s complete instructions. GoodTaco will tell Customer if it believes an instruction breaks Data Protection Laws.
GoodTaco may also process Customer Personal Data where the law requires it, after telling Customer unless the law forbids that.
Customer is responsible for having a lawful basis for the processing, giving the notices and getting the consents the law requires, and the accuracy of Customer Personal Data. Customer won’t put into GoodTaco the data types its acceptable use policy bans.

3. Details of processing

Subject matter and duration: providing the Services under the terms, for as long as GoodTaco processes Customer Personal Data.
Nature and purpose: hosting, storing, building and running apps, processing content with AI models to answer Customer’s requests, sending email Customer’s apps send, syncing with integrations Customer connects, support, and security.
Data subjects: Customer’s workspace members, the people who use Customer’s apps, and people whose data Customer puts into GoodTaco, such as Customer’s own customers, staff, contractors and contacts.
Types of personal data: whatever Customer chooses to include, typically names, contact details, job details, records of orders, jobs and transactions, and sign-in details. Special categories of data and the data types banned in the acceptable use policy aren’t intended to be processed.

4. Confidentiality and staff

GoodTaco makes sure that people it authorizes to process Customer Personal Data are bound by confidentiality, and gives access only to staff who need it to provide, support or secure the Services.

5. Security

GoodTaco maintains appropriate technical and organizational measures to protect Customer Personal Data, taking into account the state of the art, costs, and the risks of the processing. These include encryption in transit (TLS 1.2 or later) and at rest within its cloud providers, encrypted storage of integration tokens, isolated environments for building apps, and access limited to staff who need it. GoodTaco may update these measures as long as overall protection isn’t reduced.

6. Sub-processors

Customer authorizes GoodTaco to use the sub-processors on its sub-processor list. GoodTaco binds each by written contract to data protection obligations at least as protective as this DPA and remains responsible for them.
GoodTaco will tell Customer at least 30 days before adding or replacing a sub-processor. Customer may object on reasonable data protection grounds by emailing compliance@goodtaco.ai within that time. The parties will discuss the concern in good faith. If they can’t resolve it, Customer may end the affected Services and get a refund of prepaid fees for the time left, as its only remedy.

7. Helping Customer

Data subject requests: GoodTaco will pass on to Customer any request it receives from a data subject about Customer Personal Data, and won’t answer it except to point the person to Customer. Customer can access, correct, export and delete most Customer Personal Data itself in the Services; where it can’t, GoodTaco will reasonably help.
Assessments: GoodTaco will give reasonable help with data protection impact assessments and consultations with regulators, as far as they concern GoodTaco’s processing.

8. Personal data breaches

GoodTaco will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will give Customer the information it reasonably needs to meet its own obligations, as it becomes available. GoodTaco will take reasonable steps to contain the breach and reduce its effects. Notifying Customer isn’t an admission of fault.

9. Deletion and return

Customer can export its data while its account is active. After Customer’s workspace or account is deleted or closed, GoodTaco deletes Customer Personal Data within 30 days, except copies in backups, which are deleted as the backups roll off, and data the law requires GoodTaco to keep. Data kept in backups or by law stays protected by this DPA.

10. Information and audits

GoodTaco will make available the information reasonably needed to show it meets this DPA, including answers to reasonable security questionnaires, no more than once a year unless a regulator requires more or after a breach. If that isn’t enough for Customer to meet its obligations under Data Protection Laws, Customer may, with at least 30 days’ notice, have an independent auditor bound by confidentiality review GoodTaco’s compliance, at Customer’s expense, during business hours and without disrupting operations or accessing other customers’ data.

11. International transfers

GoodTaco is based in the United States, and its primary databases and file storage are in the United States. Customer authorizes GoodTaco and its sub-processors to process Customer Personal Data in the United States and the other countries where they operate.
Where Customer Personal Data is transferred from the European Economic Area to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated into this DPA by reference: Module Two where Customer is a controller, and Module Three where Customer is a processor. Clause 7 (docking) applies; Clause 9 option 2 (general authorization, with notice under section 6) applies; the optional wording in Clause 11 doesn’t apply; Clauses 17 and 18 choose the law and courts of Ireland; and Annexes I and II are completed by sections 2, 3, 5 and 6 of this DPA.
For transfers from the UK, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies, completed with the information above, and either party may end it as its Section 19 allows. For transfers from Switzerland, the EU Standard Contractual Clauses apply with references read as referring to Swiss law and the Swiss Federal Data Protection and Information Commissioner.
If GoodTaco or a sub-processor is certified under the EU-US Data Privacy Framework or its UK or Swiss extensions, transfers covered by the certification may rely on it instead.

12. US state privacy laws

Where GoodTaco is a service provider or processor under the CCPA or similar US state laws, GoodTaco won’t sell or share Customer Personal Data; won’t keep, use or disclose it outside the direct business relationship with Customer or for any purpose other than providing the Services as these terms describe; won’t combine it with personal data from other sources except as the law allows; will give it the same level of protection those laws require; and will tell Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and fix unauthorized use.

13. General

If this DPA conflicts with the terms, this DPA wins for Customer Personal Data. If the Standard Contractual Clauses conflict with this DPA, the clauses win.
Each party’s liability under this DPA is subject to the limitations in the terms, except where the Standard Contractual Clauses or Data Protection Laws don’t allow that.
This DPA lasts as long as GoodTaco processes Customer Personal Data. GoodTaco may update it to reflect changes in Data Protection Laws or the Services, with notice as the terms describe, without reducing its protection.
Questions or a countersigned copy for your records: compliance@goodtaco.ai.

Data processing addendum