Data Processing Addendum

The Customer decides why and how Customer Personal Data is processed. MyPal processes it on the Customer’s behalf, as its processor and service provider, under applicable US state privacy laws.

• Process Customer Personal Data only on the Customer’s documented instructions: the Terms, this addendum, and the Customer’s use and settings of the Service. MyPal will tell the Customer if it believes an instruction breaks the law.
• Not sell or share Customer Personal Data, and not use it for advertising.
• Not retain, use or disclose it for any purpose other than providing the Service to the Customer, and not combine it with personal information from other customers or sources, except as the law allows a service provider to.
• Not use it to train AI models.
• Ensure everyone at MyPal who can access it is bound to confidentiality.
• Protect it with the measures in section 9.
• Comply with the obligations that applicable US state privacy laws place on service providers, and tell the Customer if it can no longer meet them.

The Customer authorizes MyPal to use the sub-processors listed on the Sub-processors page. MyPal is responsible for its sub-processors’ processing of Customer Personal Data as if it were its own.

MyPal will email the Customer’s administrators at least 14 days before a new sub-processor starts processing Customer Personal Data. If the Customer objects on reasonable data-protection grounds, the parties will discuss it in good faith. If they cannot resolve it, the Customer may cancel the Service before the change takes effect, without penalty.

If someone asks MyPal to access, correct, delete or stop processing their information in Customer Data, MyPal will pass the request to the Customer and will not answer it itself unless the Customer asks. MyPal will help the Customer respond, through the Service’s features or, where those are not enough, by acting on the Customer’s written instruction within 30 days.

If MyPal becomes aware of unauthorized access to or disclosure of Customer Personal Data, it will notify the Customer without undue delay. It will share what it knows about the incident and the information affected, take reasonable steps to contain it, and help the Customer meet any notification duties it has.

During the term, the Customer can export contacts and deals from the Service, and may ask MyPal for a complete export.

When the Terms end, the Customer may ask for an export within 30 days. MyPal will then delete Customer Personal Data from its systems within a further 30 days, or within 30 days of an earlier written request from the Customer to delete it. MyPal may keep information the law requires it to keep, and copies in system logs kept for security, which are used for nothing else and are protected under this addendum for as long as they exist.

MyPal will give the Customer the information reasonably needed to show it meets this addendum, including answering a reasonable written security questionnaire once a year, and will reasonably help with any data-protection assessment the Customer must carry out about the Service.

• Hosting in the United States, with server disks encrypted.
• Encrypted connections (HTTPS) for every request to the Service.
• Application-level encryption, with keys MyPal manages, of connected-account access tokens, two-step verification secrets, and the Service’s record of the actions it takes.
• Every workspace’s data separated from every other’s in the application.
• Role-based access within each workspace, set by the Customer’s administrators.
• Passwords stored as one-way hashes, a 12-character minimum, checks against known breached passwords, lockout after repeated failed sign-ins, and two-step verification available to every user.
• Sessions that end after 7 days without use and last no longer than 30, with re-authentication required for sensitive actions.
• A log of the changes made in each workspace, visible to its administrators.
• Card numbers and Social Security numbers removed from content before it is sent to AI providers, and providers’ training and retention options set to exclude Customer Personal Data where they offer them.
• Access to production systems limited to the people at MyPal who run them.

The Customer is responsible for having a lawful basis, and any notice and consent the law requires, for the Customer Personal Data it puts into the Service and for the communications it sends and records through it.

MyPal hosts Customer Personal Data in the United States. Sub-processors may process it elsewhere, as the Sub-processors page states. The Terms’ limitation of liability applies to this addendum. If this addendum conflicts with the Terms on personal data, this addendum controls.

Questions about this addendum: [email protected]. Legal notices: [email protected].