Data processing addendum

1. Definitions

Capitalised terms not defined in this DPA have the meaning given in the Terms or the applicable Data Protection Laws.

• "Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under this DPA, which may include the UK GDPR and the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, the EU GDPR (Regulation (EU) 2016/679), the California Consumer Privacy Act as amended (CCPA/CPRA), the Australian Privacy Act 1988 (Cth), the Personal Information Protection and Electronic Documents Act (Canada), Quebec's Law 25 and the New Zealand Privacy Act 2020, in each case to the extent they apply.
• "Personal Data", "Controller", "Processor", "Data Subject", "Process"/"Processing", "Personal Data Breach" and "Sub-processor" have the meanings given in the UK GDPR or, where another Data Protection Law applies, the equivalent terms in that law.
• "Subscriber Personal Data" means Personal Data Processed by Ringzel on the Subscriber's behalf in connection with the Services, including Caller audio, recordings, transcripts, summaries, check reports, messages, enquiry details, bookings, website chat content and related metadata.
• "Services" has the meaning given in the Terms.
• "Standard Contractual Clauses" or "SCCs" means the standard contractual clauses for the transfer of personal data to third countries adopted by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
• "UK Transfer Mechanism" means the International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner's Office, or the International Data Transfer Addendum to the SCCs, as applicable.

2. Roles and scope

• The Subscriber is the Controller and Ringzel is the Processor of Subscriber Personal Data. The Subscriber may also be a Processor for another Controller; if so, the Subscriber appoints Ringzel as a Sub-processor on the same terms and warrants that it has authority to do so.
• The Subscriber is solely responsible for complying with its obligations as Controller (or, where applicable, as Processor for another Controller) under Data Protection Laws, including: establishing the lawful basis for the Processing; giving all required notices to, and obtaining all required consents from, Data Subjects (including for automated handling, call recording, transcription and any processing outside the UK); responding to Data Subject requests; carrying out any required impact assessments; and notifying supervisory authorities and Data Subjects of Personal Data Breaches where required. Ringzel's role under this DPA is limited to the Processor obligations expressly set out in it.
• Ringzel is a Controller, not a Processor, for Personal Data about the Subscriber and its authorised users that Ringzel uses to manage the relationship (account, billing, support and marketing data). That data is covered by our Privacy Policy, not this DPA.
• Each Party will comply with the obligations that apply to it under Data Protection Laws.
• The subject matter, duration, nature and purpose of the Processing, and the categories of Data Subjects and Personal Data, are set out in Annex A.

3. Processing instructions

• Ringzel will Process Subscriber Personal Data only on the Subscriber's documented instructions consistent with the standard functionality of the Services, including instructions given through the configuration of the Services, the Terms, this DPA and the Privacy Policy. The Subscriber's use of the Services in its configured form is the Subscriber's standing instruction. Ringzel may also Process Subscriber Personal Data where required by applicable law and will, where lawful, tell the Subscriber of that requirement first.
• The Subscriber warrants that its instructions and its configuration of the Services comply with Data Protection Laws. Ringzel is not required to verify the lawfulness of any instruction. If, in Ringzel's reasonable opinion, an instruction infringes Data Protection Laws, Ringzel may decline or suspend acting on it without liability and will tell the Subscriber.
• To the maximum extent permitted by law, Ringzel has no liability for any loss or claim arising from acting on the Subscriber's instructions or from the Subscriber's configuration (or misconfiguration) of the Services.

4. Confidentiality

Ringzel will ensure that anyone it authorises to Process Subscriber Personal Data is bound by an appropriate duty of confidentiality and is instructed on how to handle it. The form of those obligations and instructions is at Ringzel's discretion.

5. Security

• Ringzel will implement and maintain appropriate technical and organisational measures to protect Subscriber Personal Data against unauthorised or unlawful Processing and against accidental loss, destruction, damage, alteration or disclosure, having regard to the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing, and the risks to Data Subjects. A summary of the current measures is set out in Annex B.
• The Subscriber is responsible for using the security features the Services make available, and for the security of its own accounts, credentials, devices and systems. Ringzel is not liable for any incident arising from the Subscriber's failure to do so or from the Subscriber's configuration of the Services.
• No security measure is fault-free. Ringzel does not warrant that its measures will prevent every Personal Data Breach or other incident. Ringzel's liability for any failure of its measures is subject to section 13.

6. Sub-processors

• The Subscriber gives Ringzel general written authorisation to engage Sub-processors (including affiliates of Ringzel) to Process Subscriber Personal Data, subject to this section.
• Ringzel may engage third-party Sub-processors to help provide the Services. Ringzel maintains a current list of the Sub-processors that Process Subscriber Personal Data, which is available to the Subscriber on request at privacy@ringzel.com.
• Ringzel will use reasonable efforts to give the Subscriber prior notice before adding or replacing a Sub-processor that Processes Subscriber Personal Data, by such means and within such period as Ringzel considers reasonably practicable. The Subscriber may object on reasonable, documented data-protection grounds within fifteen (15) days of notice. If the Subscriber objects, the Parties will discuss the issue in good faith for up to thirty (30) days. If no resolution is reached, the Subscriber's sole and exclusive remedy is to terminate the affected Services by written notice with effect from the date the change takes effect, with no refund or further liability to either Party. Failure by Ringzel to give notice in time does not, by itself, give rise to liability beyond the limitations and exclusions in section 13 and the Terms.
• Ringzel will impose data-protection terms on each Sub-processor that are substantially similar to those in this DPA, so far as relevant to the services that Sub-processor provides. Ringzel's liability to the Subscriber for the acts and omissions of its Sub-processors is limited to what Ringzel's liability would have been had Ringzel performed the relevant act or omission itself, and is in any event subject to section 13 and the Terms.

7. International transfers

• The Subscriber acknowledges that Ringzel and its Sub-processors Process Subscriber Personal Data outside the UK, including in the United States, as described in the Privacy Policy, including call recordings. This involves international transfers of Personal Data. The Subscriber authorises those transfers and any onward transfers necessary to provide the Services. Ringzel may add, change or remove processing locations from time to time, and is not required to give individual notice of such a change beyond the Sub-processor change process in section 6.
• Where Data Protection Laws require a transfer mechanism for a transfer of Subscriber Personal Data from the UK or the EEA to a country without an adequacy decision, the Parties rely on the following safeguards, incorporated into this DPA by reference as applicable to the transfer and the recipient: (a) the SCCs, Module 2 (Controller to Processor) or Module 3 (Processor to Processor), with the Subscriber as data exporter and Ringzel or the relevant Sub-processor as data importer; (b) the UK Transfer Mechanism for transfers from the UK; and (c) where the recipient is certified, the EU-US Data Privacy Framework and its UK Extension.
• The Parties agree to complete the annexes or appendices of the SCCs and the UK Transfer Mechanism using the information in Annex A, Annex B, the Sub-processor list and the contact details in this DPA. Optional clauses (including the docking clause) apply unless excluded in writing. Where the SCCs or the UK Transfer Mechanism offer a choice, Ringzel may select the option more favourable to it (or to the data importer), provided the instrument permits that choice.
• Where another Data Protection Law imposes additional cross-border requirements, Ringzel will, at the Subscriber's reasonable request and cost, give such cooperation as Ringzel considers reasonably appropriate to support the Subscriber's compliance.

8. Data Subject requests

• Taking into account the nature of the Processing and the information available to it, Ringzel will give the Subscriber reasonable assistance, primarily through the tools and information available in the Services, to help the Subscriber respond to Data Subject requests. Assistance that materially exceeds this is provided on a time-and-materials basis at Ringzel's then-current rates.
• If Ringzel receives a request directly from a Data Subject about Subscriber Personal Data, Ringzel will (unless prohibited by law) refer the Data Subject to the Subscriber and, where reasonably practicable, tell the Subscriber. Primary responsibility for responding rests with the Subscriber.

9. Personal Data Breaches

• Ringzel will notify the Subscriber without undue delay after becoming aware of a confirmed Personal Data Breach affecting Subscriber Personal Data. The notification will include, to the extent then known and lawful to disclose, the information required by Article 33(3) of the UK GDPR. Further information may be provided in stages as the investigation progresses.
• Ringzel will take the steps it reasonably considers appropriate to investigate, contain and remediate the Personal Data Breach and will, at the Subscriber's reasonable request and cost, give such further cooperation with the Subscriber's investigation and notification obligations as Ringzel considers reasonably appropriate.
• Notifying a Personal Data Breach is not, by itself, an admission of fault or liability by Ringzel. Ringzel's liability for any Personal Data Breach is subject to section 13 and the Terms.

10. Impact assessments and prior consultation

Where required by Data Protection Laws, Ringzel will, taking into account the nature of the Processing and the information available to it, give the Subscriber reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, primarily through the information in this DPA, the Privacy Policy and the Services. Assistance that materially exceeds that information is provided on a time-and-materials basis at Ringzel's then-current rates.

11. Audits

• Ringzel will make available to the Subscriber the information reasonably necessary to demonstrate compliance with this DPA, primarily through this DPA, the Privacy Policy, a summary of its security measures and, where available, third-party reports or certifications. The Subscriber agrees that these materials are sufficient, in the ordinary course, to meet Ringzel's obligations under Article 28(3)(h) of the UK GDPR and equivalent provisions of other Data Protection Laws.
• If the Subscriber reasonably believes those materials are insufficient, it may request an audit on these terms: (a) no more than once in any twelve-month period, except where a supervisory authority requires otherwise or after a confirmed Personal Data Breach materially affecting the Subscriber's data; (b) on at least sixty (60) days' written notice; (c) entirely at the Subscriber's cost, including Ringzel's reasonable internal costs at its then-current rates; (d) during normal business hours, by a qualified independent auditor that is not a competitor of Ringzel and has signed a non-disclosure agreement acceptable to Ringzel; (e) limited to information reasonably necessary to verify Ringzel's compliance with this DPA; (f) without access to other customers' Personal Data, to source code, or to information that would compromise Ringzel's security or its confidentiality obligations to third parties; and (g) subject to the Subscriber promptly sharing the audit report with Ringzel and to any reasonable remediation timetable the Parties agree.
• The Subscriber will indemnify Ringzel against any loss or claim caused by the Subscriber's or its auditor's misuse of information obtained through an audit.

12. Return and deletion

• Call recordings are kept for as long as reasonably necessary to provide the Services, and are deleted or anonymised as set out in this section.
• On termination of the Services, the Subscriber may, within thirty (30) days of the effective date of termination, ask Ringzel to return or delete Subscriber Personal Data, using any export functionality available in the Services where possible. After that period, Ringzel may delete Subscriber Personal Data without further notice, and the Subscriber waives any further right to return or copies.
• Ringzel will delete or anonymise Subscriber Personal Data within a reasonable time after termination, except where retention is required by applicable law, by an order of a competent authority, or for the establishment, exercise or defence of legal claims.
• Subscriber Personal Data held in any backups will be overwritten in the ordinary course of the backup cycle. Until then it remains subject to this DPA, but Ringzel is not required to actively delete it from backups.

13. Liability

• The liability of each Party under or in connection with this DPA, the SCCs and any UK Transfer Mechanism (whether in contract, tort including negligence, breach of statutory duty, under the SCCs, the UK Transfer Mechanism, Data Protection Laws or otherwise) is subject to the limitations, exclusions and aggregate cap on liability in section 19 of the Terms.
• All claims by the Subscriber under or in connection with this DPA, the SCCs, any UK Transfer Mechanism and Data Protection Laws (including claims for fines, compensation under Article 82 of the UK GDPR or equivalent, and indemnity claims) count towards a single aggregate cap under section 19 of the Terms.
• To the maximum extent permitted by law, neither Party is liable to the other under or in connection with this DPA for loss of profits, revenue, business, goodwill, anticipated savings or opportunity, loss or corruption of data, or any indirect, special, incidental, consequential, exemplary or punitive damages.
• Nothing in this DPA limits or excludes any liability that cannot be limited or excluded under applicable law, including, where applicable, liability for fraud or for death or personal injury caused by negligence.

14. Subscriber indemnity

The Subscriber will indemnify, defend and hold harmless Shipstack LLC and its affiliates, directors, officers, employees and agents against any loss, claim, fine, penalty, regulatory action, cost or expense (including reasonable legal fees) arising out of or in connection with: (a) the Subscriber's instructions to Ringzel or its configuration of the Services; (b) the Subscriber's failure to obtain any consent or give any notice required under Data Protection Laws or applicable call-recording, electronic-communications, AI-disclosure or marketing laws; (c) any breach by the Subscriber of this DPA, Data Protection Laws or the Terms; (d) any data the Subscriber or its Callers submit to the Services that the Subscriber was not entitled to submit; or (e) any claim by another Controller, a regulator or a Data Subject relating to (a) to (d).

15. Third-party rights

A person who is not a Party to this DPA has no right to enforce any of its terms. This section does not limit any rights Data Subjects have under the SCCs, the UK Transfer Mechanism or Data Protection Laws that cannot be excluded.

16. Order of precedence

If there is a conflict between (a) the SCCs or the UK Transfer Mechanism, (b) this DPA and (c) the Terms, the order of precedence for the subject matter of the conflict is (a), then (b), then (c). Each Party agrees to interpret these documents so as to give effect to the limitations, exclusions and aggregate cap on liability in section 19 of the Terms wherever the law permits.

17. Governing law

This DPA is governed by the same law, and subject to the same jurisdiction provisions, as the Terms, except that the SCCs and the UK Transfer Mechanism are governed by the laws specified in those instruments. Where a mandatory rule of Data Protection Laws requires a different governing law for a specific obligation, that rule applies only to that obligation.

Annex A: Description of processing

Annex B: Technical and organisational measures

This is a summary of the measures Ringzel maintains. Implementation details may change over time, but Ringzel will not materially reduce the overall level of protection during the Subscriber's Subscription.

Contact

For questions about this DPA, the Sub-processor list, or to request a counter-signed copy, contact the data protection address.

• Data protection: privacy@ringzel.com
• General: hello@ringzel.com
• Post: Shipstack LLC, 30 N Gould St, Suite #68891, Sheridan, WY 82801, USA