Data processing addendum

1.Who this covers

This addendum is part of the Terms of service between Scale Modern Business Solutions LLC ("Scale", "we") and the business that uses Scale Suite ("you"). It applies when you put personal information about other people into Scale Suite, like your clients, leads, team or customers, and Scale handles it for you.

For that information, you decide why and how it is used (you are the "business" or controller), and Scale handles it for you (Scale is your "service provider" or processor). If this addendum and the Terms disagree about personal information, this addendum wins.

2.Words we use

• Personal information means information about a person that you put into Scale Suite, or that people give your business through Scale, like a booking or a payment page.
• Processing means anything done with it, such as storing, sending, organizing or deleting it.
• Subprocessor means a company Scale uses to help process personal information for you, listed on the Subprocessors page.
• Security incident means a breach of security that leads to personal information being lost, changed, or seen or taken by someone who should not have it.

3.Only on your instructions

We process personal information only to provide Scale Suite to you as described in the Terms, and on your instructions. Your instructions are the Terms, this addendum, the settings you choose in the suite, and any other written instructions you give us that we agree to.

If we believe an instruction breaks the law, we tell you, and we do not have to follow it.

AI improvement: Scale uses personal information in your business content to improve AI only if your account owner turns on the AI improvement opt-in described in the AI policy. That choice is your instruction, and you may withdraw it at any time. Even then, Scale uses it only to build and improve its own service, never to provide services to another business. [Mike: confirm this fits the CCPA service provider rules.]

4.California service provider terms

For personal information covered by the California Consumer Privacy Act (CCPA), Scale is your service provider, and these terms apply as required by section 7051 of the CCPA regulations (California Code of Regulations, title 11):

• You disclose personal information to Scale only for these limited and specified business purposes: providing, securing, supporting and fixing Scale Suite for you, as described in the Terms.
• Scale does not sell or share the personal information. "Share" here means sharing for cross context behavioral advertising.
• Scale does not keep, use or disclose it for any purpose other than those business purposes, including any other commercial purpose, and not outside our direct business relationship with you, except as the CCPA allows.
• Scale does not combine it with personal information we get from others or collect ourselves, except as the CCPA regulations allow.
• Scale complies with the CCPA and gives the personal information the same level of privacy protection the CCPA requires of you.
• You may take reasonable and appropriate steps to make sure Scale uses the personal information in a way consistent with your CCPA obligations, as set out in section 11.
• Scale tells you if it decides it can no longer meet its CCPA obligations. You may then, on notice, take reasonable and appropriate steps to stop and fix unauthorized use, including stopping use of Scale Suite.
• Scale helps you answer consumer requests, as set out in section 9.
• Scale requires each subprocessor, by written contract, to follow terms that protect the personal information at least as well as these.

5.Our people

Only people at Scale who need personal information to do their work can reach it, and they must keep it confidential. Support staff can open your AI memory and settings only while support access is on, as described in section 12 of the Terms and the AI policy.

6.Security

We use reasonable technical and organizational measures to protect personal information, appropriate to the risk. They include encryption in transit, encrypted bank connection tokens, passkey sign in, limited staff access, and the measures in the Privacy policy. We review them as the service and the risks change.

7.Subprocessors

You allow Scale to use the subprocessors on the Subprocessors page. Each is under a written contract that protects the personal information at least as well as this addendum, and Scale remains responsible for their work.

We tell you at least 30 days before we add a subprocessor that will handle your personal information, by email and in the app. If you object for a reasonable reason related to data protection, tell us at legal@scalembs.com within that time. We will try to find a fix. If we cannot, you may cancel the affected part of the service, and we refund what you prepaid for time after it ends.

8.Security incidents

If we learn of a security incident affecting personal information we process for you, we tell you without undue delay. We tell you what we know about what happened, the information and people affected, what we are doing about it, and who you can talk to, and we update you as we learn more.

We help you meet your own duties to notify people, regulators or others. Telling you about an incident is not an admission of fault.

9.Helping you with requests

Scale Suite lets you find, export, correct and delete personal information yourself. If a person asks you to see, correct or delete their information and you cannot do it in the suite, we help you within a reasonable time. If a person asks us directly, we tell them to contact you, unless the law says otherwise.

We also give you information you reasonably need for a risk assessment or a cybersecurity audit the law requires of you, to the extent it is about our part of the service.

10.When the service ends

You can export your data at any time. When you close your account or delete a business, you can restore it for 30 days. After that we delete the personal information, and copies in backups are deleted within 35 days after that, as the Privacy policy describes.

We may keep information the law requires us to keep, like payment and tax records, only for as long as the law requires and only for that purpose.

11.Audits by questionnaire

Once a year, or after a security incident, you may send us a reasonable written security and privacy questionnaire, and we answer it within a reasonable time. Where we have them, we share summaries of our subprocessors' security reports, such as SOC 2 reports, under confidentiality.

An on site audit happens only if the law or a regulator requires one. It needs reasonable notice, takes place during business hours, must not reach other customers' data, and is at your cost.

12.Financial businesses

If your business is a financial institution under the Gramm Leach Bliley Act, like a mortgage lender or broker, Scale acts as your service provider under the FTC Safeguards Rule (16 CFR part 314). Scale will put in place and keep appropriate safeguards for the customer information it handles for you, tell you promptly about a security incident affecting it so you can meet your own reporting duties, and cooperate with your reasonable oversight of Scale, including the questionnaire in section 11.

13.Health information

Do not put protected health information under HIPAA into Scale Suite. Scale is not a HIPAA business associate and does not sign business associate agreements.

14.Where it is stored

Personal information is stored mostly in the United States. Cloudflare may handle a request in the data center nearest the person making it. Scale Suite Mail mailboxes are stored in Canada. The Subprocessors page lists where each provider works.

15.Other terms

This addendum lasts as long as Scale processes personal information for you. The limits of liability and other terms in the Terms of service apply to it. Questions: legal@scalembs.com, or Scale Modern Business Solutions LLC, 2415 San Ramon Valley Blvd, Suite 4, San Ramon, CA 94583.