Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Wilco Inc.(“Wilco”) and the Customer. It applies to personal information in Customer Data that Wilco processes on the Customer’s behalf (“Customer Personal Data”), mainly information about the Customer’s End Users. Capitalized terms not defined here have the meanings given in the Terms.

For Customer Personal Data, the Customer controls the information and Wilco is its service provider (a “processor” or “service provider” under applicable privacy laws). For account, billing and website information about the Customer and its team, Wilco acts on its own account under its Privacy Policy.

• Subject matter and purpose: providing the Service: answering End Users over web chat, SMS and phone, booking appointments, handing conversations to the Customer’s staff, and related support, security and billing.
• Categories of people: End Users who contact the Customer, and the Customer’s staff named in its configuration.
• Categories of data: names, phone numbers, email addresses, message content, call transcripts, appointment details, messaging-consent records, and any other information End Users choose to provide.
• Duration: the term of the Terms plus the deletion period in section 9.
• Sensitive data: the Customer must not use the Service to collect sensitive health information, payment card data or government identification numbers, as set out in the Acceptable Use Policy.

Wilco will process Customer Personal Data only to provide the Service and on the Customer’s documented instructions. The Terms, this DPA and the Customer’s configuration and use of the Service are those instructions. Wilco will tell the Customer if it believes an instruction violates applicable law, and may decline to follow it.

The Customer is responsible for the lawfulness of the instructions and of the collection of Customer Personal Data, including giving End Users every required notice and obtaining every required consent.

Where U.S. state privacy laws such as the California Consumer Privacy Act apply, Wilco:

• will not sell or share Customer Personal Data, as those terms are defined by those laws;
• will not retain, use or disclose it for any purpose other than the business purposes set out in this DPA, or outside the direct business relationship with the Customer;
• will not combine it with personal information it receives from other sources, except as those laws permit;
• will comply with those laws and provide the level of privacy protection they require, and will notify the Customer if it determines it can no longer meet these obligations;
• allows the Customer, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use.

Wilco certifies that it understands and will comply with these restrictions.

Wilco limits access to Customer Personal Data to personnel who need it to provide, support or secure the Service, and requires them to keep it confidential. Staff access to a Customer’s account is time-limited and recorded in an audit log.

Wilco maintains reasonable technical and organizational measures appropriate to the sensitivity of the data, including:

• encryption of data in transit, and encryption at rest provided by our hosting providers;
• separate application-level encryption of calendar credentials;
• database-level isolation so that each Customer can access only its own data;
• restricted, logged administrative access;
• verification of signed requests from our telephony and payment providers.

Wilco may update these measures, provided the overall level of protection is not reduced.

The Customer authorizes Wilco to use the sub-processors listed below. Wilco requires each sub-processor to protect Customer Personal Data to a standard comparable to this DPA, and remains responsible for their performance.

Wilco will update this list and email the account owner at least 15 days before adding or replacing a sub-processor, except where an urgent change is needed to keep the Service running or secure, in which case Wilco will notify as soon as practical. If the Customer objects on reasonable data-protection grounds, the parties will discuss it in good faith. If they cannot resolve it, the Customer may terminate the affected part of the Service, which is its sole remedy.

Customer Personal Data is stored primarily in Canada and is processed in the United States by the sub-processors indicated above. Wilco protects transferred data through its contracts with those sub-processors. The Customer is responsible for telling its End Users that their information may be processed outside their province, state or country.

The Service includes tools that let the Customer export an End User’s information and process deletion requests. If Wilco receives a request from an End User about Customer Personal Data, it will refer the request to the Customer and will not respond itself except to confirm the referral or as the law requires. Wilco will provide reasonable further assistance with requests, regulator inquiries and privacy assessments, and may charge for assistance beyond what the Service’s tools provide.

After the Terms end and the export period in the Terms has passed, Wilco will delete or de-identify Customer Personal Data within 90 days, except copies in backups (which are overwritten in the normal course) and records Wilco must keep by law. Retained records stay subject to this DPA.

Wilco will notify the Customer without undue delay after confirming a breach of security that results in unauthorized access to, or loss or disclosure of, Customer Personal Data. The notice will describe the breach as far as it is known, and Wilco will take reasonable steps to contain it and to help the Customer meet its own notification and record-keeping obligations. Notice of a breach is not an admission of fault.

On written request, no more than once a year, Wilco will provide information reasonably needed to show its compliance with this DPA, such as a description of its security measures and sub-processors. Any further audit must be agreed in advance, conducted at the Customer’s expense under confidentiality terms, and must not unreasonably disrupt the Service.

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA governs. Questions about this DPA can be sent to contact@getwilco.app.