Data Processing Addendum

This addendum applies automatically when you accept the Terms of Service; there is nothing to sign. If your organization needs a countersigned copy, email legal@booksmachine.com.

1. Scope and roles

This addendum is between the customer that accepted the Terms of Service ("Customer") and Halide Works, a trade name of David Torcivia LLC, a New York limited liability company ("Processor"). It applies to personal data contained in Customer Data that Processor processes on Customer's behalf in providing Books Machine (the "Service"). For that data Customer is the controller (or a processor acting for its own controller) and Processor is the processor. Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the EU General Data Protection Regulation ("GDPR") and, where relevant, the UK GDPR and other applicable data protection laws ("Data Protection Laws").

2. Instructions

Processor processes Customer personal data only on Customer's documented instructions, which are the Terms, this addendum and Customer's use and configuration of the Service, unless the law requires otherwise, in which case Processor will inform Customer first where the law allows. Processor will tell Customer if it believes an instruction infringes Data Protection Laws.

3. Confidentiality

Processor ensures that people authorized to process Customer personal data are bound by confidentiality. Processor's staff cannot open the contents of a workspace except through a time-limited, read-only support grant that a workspace owner gives and can revoke, and every such access is recorded in the workspace's audit log.

4. Security measures

Processor maintains appropriate technical and organizational measures, including:

• encryption of data in transit, and encryption at rest of credentials Customer stores in the Service;
• logical isolation of each workspace's records in a separate database;
• role-based access within workspaces and least-privilege roles for Processor's administrators;
• passkey and authenticator-app sign-in, and recent strong verification before sensitive actions;
• audit logging of administrative actions and support access;
• rate limiting and abuse detection;
• backups, and export tools that let Customer retrieve its data at any time;
• error records that exclude request bodies, cookies, query strings and secret tokens.

5. Subprocessors

Customer authorizes Processor to engage the subprocessors listed on the Subprocessors page. Processor imposes data protection obligations on each subprocessor that are no less protective than this addendum, and remains responsible for their performance. Processor will give at least 30 days' notice of a new subprocessor by updating that page and emailing workspace members. Customer may object on reasonable data protection grounds within that period; the parties will work in good faith to resolve the objection, and if they cannot, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period.

6. Assistance

Taking into account the nature of the processing, Processor will assist Customer in responding to data subject requests, largely through the Service's own tools for finding, correcting, exporting and deleting records, and will forward any request it receives directly. Processor will provide reasonable information to help Customer with data protection impact assessments and consultations with authorities.

7. Personal data breaches

Processor will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer personal data. The notice will describe the breach, the data and data subjects likely affected, the likely consequences, and the measures taken or proposed, updating Customer as more is known.

8. International transfers

Customer personal data is primarily processed in the United States. To the extent a transfer of personal data from the European Economic Area, Switzerland or the United Kingdom to Processor is not covered by an adequacy decision or another valid mechanism, the parties incorporate the Standard Contractual Clauses adopted by European Commission Decision 2021/914 (Module Two where Customer is a controller, Module Three where Customer is a processor), with Customer as data exporter and Processor as data importer. Clause 7 does not apply; option 2 of Clause 9 applies with the notice period in section 5; the optional language in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland; and the annexes are completed by the Annex below and section 4. For transfers from the United Kingdom, the UK International Data Transfer Addendum applies, and for Switzerland the Clauses apply with the Federal Act on Data Protection treated as the relevant law.

9. Return and deletion

Customer can export its data at any time. When Customer deletes a workspace, Processor deletes its data, stored files and the backups Processor holds after a 14-day recovery period, unless the law requires retention. Copies Customer mirrored to its own storage are Customer's to delete, and residual copies in the hosting provider's recovery systems expire within 30 days.

10. Audits

Processor will make available the information reasonably necessary to demonstrate compliance with this addendum. Where that information is not sufficient, Customer may, no more than once a year and on 30 days' notice, audit Processor's compliance through a mutually agreed independent auditor bound by confidentiality, at Customer's cost, in a way that does not compromise other customers' data.

11. US state privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, Processor is a service provider or processor. Processor will not sell or share Customer personal data, will not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service, will not combine it with personal data from other sources except as the law permits, and will comply with and provide the same level of protection required by those laws.

12. Order of precedence

If this addendum conflicts with the Terms, this addendum governs for the processing of Customer personal data. If the Standard Contractual Clauses apply and conflict with this addendum, the Clauses govern. Liability under this addendum is subject to the limitations in the Terms, except where the Clauses or Data Protection Laws provide otherwise.

Annex: details of processing