Data Processing Addendum
This Addendum ("DPA") forms part of the Terms of Service between Dotco Technologies LLC ("Dotco Technologies", "Processor") and the Customer ("Controller"). It applies where Dotco Technologies processes Personal Data on the Customer's behalf and that processing is subject to data protection law such as the EU GDPR, the UK GDPR, or the CCPA/CPRA. If you require a signed copy, email legal@signalstrm.com.
1. Definitions
"Personal Data", "Controller", "Processor", "Data Subject", "Processing", and "Supervisory Authority" have the meanings in the GDPR. "Customer Personal Data" means Personal Data within Customer Data (as defined in the Terms) that Dotco Technologies processes on the Customer's behalf. "Data Protection Law" means all laws applicable to the processing of Personal Data under the Terms, including the EU GDPR, UK GDPR, and the CCPA/CPRA.
2. Roles and scope
The Customer is the Controller and Dotco Technologies is the Processor of Customer Personal Data. For website visitors and account administrators, Dotco Technologies is an independent Controller and its Privacy Policy governs. Under the CCPA/CPRA, Dotco Technologies acts as a "service provider" and does not sell or share Customer Personal Data or retain, use, or disclose it for any purpose other than performing the Service.
3. Processing instructions
Dotco Technologies will process Customer Personal Data only (a) to provide and support the Service, (b) as further documented in the Terms and this DPA, and (c) on the Customer's other lawful written instructions. Dotco Technologies will inform the Customer if, in its opinion, an instruction infringes Data Protection Law (without obligation to provide legal advice).
4. Details of processing
| Subject matter | Provision of the Signal CRM service. |
| Duration | The term of the subscription, plus the deletion period in Section 10. |
| Nature and purpose | Hosting, storage, and processing of CRM records to enable sales pipeline management, contact management, and reporting. |
| Categories of Data Subjects | The Customer's business contacts, prospects, advertisers, partners, and the Customer's own personnel who use the Service. |
| Categories of Personal Data | Names, business contact details, job titles, company affiliations, communications and notes, deal and activity history. The Customer must not submit special-category data. |
5. Confidentiality
Dotco Technologies ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and process the data only as instructed.
6. Security
Dotco Technologies implements and maintains appropriate technical and organizational measures, taking into account the state of the art and the risks of processing. These include encryption in transit, application-level tenant isolation, access controls and least-privilege administration, managed and patched infrastructure, logging, and regular review. Measures may be updated so long as security is not materially reduced.
7. Subprocessors
The Customer authorizes Dotco Technologies to engage the subprocessors listed at /subprocessors. Dotco Technologies imposes data-protection obligations on each subprocessor that are no less protective than this DPA and remains liable for its subprocessors' performance. Dotco Technologies will update the subprocessor page before adding or replacing a subprocessor. A Customer with a signed DPA may object on reasonable data-protection grounds within 30 days; if the parties cannot resolve the objection, the Customer may terminate the affected part of the Service and receive a pro-rated refund of prepaid fees.
8. Data Subject rights and assistance
Taking into account the nature of the processing, Dotco Technologies will assist the Customer with appropriate technical and organizational measures, insofar as possible, to respond to Data Subject requests and to meet the Customer's obligations regarding security, breach notification, data protection impact assessments, and prior consultation. Tools in the Service (export, edit, delete) allow the Customer to fulfil most requests directly. If Dotco Technologiesreceives a request from a Data Subject, it will direct them to the Customer.
9. Personal Data breach
Dotco Technologies will notify the Customer without undue delay, and in any case within 72 hours, after becoming aware of a Personal Data breach affecting Customer Personal Data, and will provide information reasonably available to help the Customer meet its notification obligations. Notice will be sent to the account's admin/security contact.
10. Return and deletion
On termination, the Customer may export Customer Personal Data for 30 days. Dotco Technologies will then delete it from production systems; backup copies are overwritten on a rolling basis within 90 days. Dotco Technologies may retain data where required by law, kept only for that purpose.
11. Audits
Dotco Technologies will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates, no more than once per year (unless required by a Supervisory Authority), on reasonable notice, during business hours, subject to confidentiality, and at the Customer's expense. Dotco Technologies may satisfy an audit request by providing existing reports or documentation.
12. International transfers
Dotco Technologies processes data in the United States. To the extent transfers of Customer Personal Data from the EEA, UK, or Switzerland are subject to Data Protection Law, the parties incorporate the European Commission's Standard Contractual Clauses (Module Two, Controller-to-Processor) and the UK International Data Transfer Addendum by reference, with Dotco Technologies as "data importer" and the Customer as "data exporter", and with the docking clause, the option for onward transfers under the SCCs, and California/relevant EU member-state law and courts as elected in the Terms and applicable law.
13. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms.
14. Conflict
If there is a conflict between this DPA and the rest of the Terms regarding the processing of Personal Data, this DPA controls.
15. Contact
Data protection contact: privacy@signalstrm.com