This addendum forms part of the terms of service between Dcypher-IT LLC ("Processor", "we") and the customer named in the account ("Controller", "you") for the hosted edition of BOSS HQ ("the Service"). It applies to the extent that we process personal information on your behalf.
You decide what personal information is entered into the Service and why; you are the controller (or, under some laws, the "business"). We process it only to run the Service for you; we are the processor (or "service provider"). Where we process information for our own purposes (billing you, securing our systems), we are a controller of that information and the privacy policy governs.
We process personal information only on your documented instructions, which are: the terms of service, this addendum, and the settings and actions you take inside the Service (connecting an integration, sending an email, exporting a file). We will tell you if we believe an instruction breaks the law, and we may stop until it is resolved.
Everyone we allow to access your information is bound by confidentiality. Our operator access to your installation is read-only, requires a reason, is time-limited and is recorded in your audit log, where you can see it.
We keep the technical and organizational measures listed in Annex B. We may improve them; we will not reduce the overall level of protection during the term.
You authorize the categories of subprocessors listed in the privacy policy. We keep a current list available inside the Service and on request. We give at least 30 days' notice before adding a new category by posting it in the Service; you may object in writing on reasonable grounds, and if we cannot resolve the objection you may end the affected part of the Service without penalty. We remain responsible for our subprocessors.
Integrations you connect yourself (accounting, practice-management, court, banking, payment and storage providers) are engaged by you directly and are not our subprocessors.
Taking into account the nature of the processing, we help you respond to requests from individuals (access, correction, deletion, portability, objection) by providing the export, correction and deletion tools inside the Service and by answering your questions. We help you with security assessments and, where required, data protection impact assessments, using the information in Annex B and the status page.
If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal information we process for you, we will notify you without undue delay and in any event within 72 hours of becoming aware, with what we know at that time: the nature of the breach, the categories and approximate number of individuals and records, the likely consequences, and the measures taken or proposed. We will keep you updated as we learn more.
During the term you can export all of your information at any time in open formats. At the end of the term, on your written request, we return or delete the personal information within 30 days and delete remaining copies, except where the law requires us to keep it. Backup copies expire on their normal schedule and are protected until then.
The Service is hosted in the United States unless your plan states otherwise. Where you transfer personal information to us from a jurisdiction that restricts transfers, the parties enter into the applicable standard contractual clauses (EU Module 2, controller to processor, and the UK addendum where relevant), which are incorporated by reference, with Annexes A and B of this addendum serving as their annexes. [Counsel: confirm the mechanism and the clause version at signing.]
On reasonable written notice, not more than once a year unless a breach or a regulator requires it, you may ask us to demonstrate compliance with this addendum. We will answer questionnaires, provide the records the Service keeps (audit logs, integrity checks, restore drills, status history) and, where that is not sufficient, allow an audit by an independent auditor bound by confidentiality, at your cost, at a time and in a manner that does not disrupt other customers.
To the extent a US state privacy law applies: we act as a service provider or processor; we do not sell or share personal information, retain, use or disclose it outside the direct business relationship, or combine it with information from other sources except as the law permits for a service provider; we will notify you if we can no longer meet our obligations; and you may take reasonable steps to stop and remediate unauthorised use.
Liability under this addendum is subject to the limitation of liability in the terms of service. If this addendum conflicts with the terms, this addendum prevails for the processing of personal information.
Subject matter and duration. The provision of the Service for the term of the account.
Nature and purpose. Storage, organization, retrieval, transmission (email, text, connected integrations) and backup of business records, so that the customer can run its business.
Categories of individuals. The customer's staff and contractors; its customers, clients, tenants, guests and their contacts; its vendors and their contacts; applicants for trade accounts; for law firms, clients, opposing parties, witnesses, experts and other persons named in matters.
Categories of personal information. Names and contact details; job titles and roles; pay and employment details; time and location punches; customer transaction history; documents and photographs uploaded by the customer; identification numbers on trade account applications (sealed); for law firms, matter information including information that may be privileged, and trust ledger balances; sign-in and audit records.
Sensitive information. May be present where the customer enters it (for example, health information in a matter or a personnel file, government identifiers on applications). The Service does not require it.