Data Processing Addendum

1. What this addendum is

This Data Processing Addendum (the "Addendum") is part of the Terms of Service between ATTEMPER LLC ("Attemper", "we") and the customer ("you"). It applies whenever the Service processes Customer Personal Information. It takes effect when the Terms do, without a separate signature. If it conflicts with the Terms, this Addendum controls for Customer Personal Information. Words with a capital letter that are not defined here have the meaning the Terms give them.

2. Definitions

• Privacy Laws means the U.S. federal and state laws on the privacy and security of personal information that apply to the processing under this Addendum, including the California Consumer Privacy Act as amended (the "CCPA") and the comprehensive privacy laws of other states.
• Customer Personal Information means personal information in Customer Content that the Service processes on your behalf. It does not include information about you, your Members and your use of the Service that we handle for our own purposes as our Privacy Policy describes, such as account, billing and security information.
• Personal information, business, controller, service provider, processor, contractor, consumer, sell, share, deidentified and business purpose have the meanings the Privacy Laws give them. "Personal information" includes "personal data".
• Subprocessor means a third party we engage to process Customer Personal Information for us.
• Security Incident means a breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Information or Credentials in our systems or our Subprocessors' systems.

3. Roles

For Customer Personal Information, you are the business or controller, and Attemper is your service provider, processor or contractor. You decide why Customer Personal Information is processed; we process it to provide the Service to you. If a Privacy Law treats any processing under section 5 as processing we decide for ourselves, we are a controller or business for that processing only, we will meet the duties that law gives a controller for it, and we remain your service provider or processor for everything else.

Connected Services are not our Subprocessors. When a runbook sends data to a Connected Service, it does so on your instructions, and that service's handling of the data is governed by your agreement with it.

4. What we do and do not do with Customer Personal Information

You disclose Customer Personal Information to us only for the limited and specified business purposes in Annex 1.

We will:

• process Customer Personal Information only on your documented instructions and for the business purposes in Annex 1. The Terms, this Addendum, your settings, your runbooks and the calls your Members, Agents and Entry Points make are your instructions;
• tell you if we believe an instruction breaks a Privacy Law, or if we can no longer meet our obligations under the Privacy Laws;
• comply with the Privacy Laws that apply to us as your service provider, and give Customer Personal Information the level of privacy protection they require;
• make sure everyone we authorize to process Customer Personal Information is bound by a duty of confidentiality; and
• let you take reasonable and appropriate steps to make sure we process Customer Personal Information in line with your obligations under the Privacy Laws, and to stop and fix any processing that is not authorized.

We will not:

• sell or share Customer Personal Information;
• retain, use or disclose Customer Personal Information for any purpose other than the business purposes in Annex 1, including for any other commercial purpose, or outside our direct business relationship with you, except as the Privacy Laws allow a service provider, such as for internal use to build or improve the quality of the services we provide to you, as long as we do not use the information to perform services for anyone else, to detect and prevent security incidents and illegal activity, or to comply with law, and only as far as each use is reasonably necessary and proportionate; or
• combine Customer Personal Information with personal information we receive from or for anyone else, except as the Privacy Laws allow.

We certify that we understand these restrictions and will comply with them.

Health data. If Customer Personal Information includes consumer health data under Washington's My Health My Data Act or a similar state law, despite section 9 of the Terms, we process it only under this Addendum and your instructions, consistent with your own consumer health data privacy policy; we help you, by appropriate technical and organizational measures, meet your obligations to the people it concerns; and when you tell us a person has asked to delete it, we delete it from our systems, including from backups as section 10 describes, and tell our Subprocessors to do the same.

5. De-identified data and training

Your instruction. The training setting is your documented instruction to us under this Addendum. Training is on when your workspace is created. Leaving it on, or turning it on later, instructs us to process Customer Personal Information as this section describes; turning it off withdraws that instruction for training runs that start afterwards. We process Customer Personal Information for training only as this instruction and this section allow.

Training uses only de-identified data. While training is on for your workspace, as section 10 of the Terms describes, you instruct and authorize us to de-identify Customer Personal Information in Training Data. You also authorize us to use the de-identified result to train, test and improve the models that power the Service. Once data is de-identified to the standard of the Privacy Laws, it is no longer personal information.

How we de-identify. We will take reasonable measures so that de-identified data cannot reasonably be used to infer information about, or otherwise be linked to, a particular person or household. We publicly commit, in our Privacy Policy, to keep and use it only in de-identified form and not to try to re-identify it, and we will contractually require anyone who receives it to do the same. We do not sell, license or give Training Data to anyone else for their own use.

When training is off, we do not use Customer Personal Information from your workspace, de-identified or not, in any training run that starts after training was turned off. Records created while training is off are never used for training, even if training is turned on later.

Excluded data. Your instruction to train does not cover consumer health data, protected health information, payment card data or children's personal information. We do not process them for training in any way, except to find and drop the records that contain them, and never de-identify them for training.

6. Subprocessors

General authorization. You authorize us to use the Subprocessors listed on our Subprocessors page.

Our duties. Before a Subprocessor processes Customer Personal Information, we will have a written contract with it that requires it to protect the information at least as well as this Addendum does. We remain responsible to you for its performance.

New Subprocessors. We will add a new Subprocessor to the list, and email the owner of each workspace, at least 15 days before it starts processing Customer Personal Information. If you object on reasonable data protection grounds, tell us within that time. If we cannot address your objection, you may stop using the affected part of the Service or close your account, and we will refund fees you prepaid for the time after that.

7. Security and incidents

Safeguards. We maintain reasonable administrative, technical and physical safeguards designed to protect Customer Personal Information, appropriate to its nature, as described in Annex 2. We will not materially reduce the overall protection of the measures in Annex 2 while you use the Service.

Incidents. We will notify the owner of your workspace immediately after we discover a Security Incident, even while we are still investigating, and in any case within 72 hours. For an incident involving Credentials, we will tell you which connections were affected and revoke, or help you revoke, the affected tokens and keys. We will give you the information we have that you reasonably need to meet your own obligations, such as what happened and when, what information and which connections' Credentials were involved, what we have done to contain it, and what we are doing about it. We will update you as we learn more. Telling you about an incident is not an admission of fault.

8. Helping you meet your obligations

Requests from people. If a person asks us about Customer Personal Information, for example to access or delete it, we will tell them to contact you or pass the request to you. We will not answer it ourselves unless the law requires it. The Service lets you find and delete Customer Content yourself, and lets the workspace's owner download the workspace's runbook runs and runbooks. If you need more help to answer a request, we will provide reasonable assistance. When you direct us to delete a person's information, we delete it, or let you delete it, and tell our Subprocessors to do the same. If you cannot delete it yourself in the Service, tell us and we will delete it within 30 days.

Assessments. We will give you the information you reasonably need for a data protection assessment, risk assessment or cybersecurity audit the Privacy Laws require of you about the Service, and cooperate with the person conducting it.

Showing our compliance. We will make available the information reasonably necessary to show that we comply with this Addendum. Once every 12 months, with at least 30 days' notice, you may assess our compliance, at your cost, through written questions or, where the Privacy Laws require, an audit by a qualified independent assessor bound by confidentiality, during business hours and without disrupting the Service.

9. Your obligations

You are responsible for having a lawful basis for the processing you instruct, and for making sure your instructions follow the Privacy Laws. You are also responsible for giving the notices and getting the consents the Privacy Laws require, including for training while it is on, and for not sending us the data section 9 of the Terms keeps out of Attemper. If we learn that Customer Content includes data the Terms keep out of Attemper, we will tell you, keep it out of training, and help you delete it.

10. Keeping and deleting

We process Customer Personal Information for as long as you keep it in the Service. You choose whether it is returned or deleted at the end: before you close your account, the workspace's owner can download the workspace's runbook runs and runbooks from Settings, and if we end your access, you have 30 days to export your data, as section 11 of the Terms describes. When you delete Customer Content or close your account, or when that export time has passed, we delete the Customer Personal Information in it within 30 days, and from backups within 90 days after the deletion, unless a law requires us to keep it.

You direct us to keep Run Skeletons. A Run Skeleton records which runbooks and tools ran, which fields each step used, who or what supplied each value, whether each step was approved or declined and by whom, when each step happened and whether it worked. It does not hold the values themselves. To the extent a Run Skeleton contains Customer Personal Information, we keep protecting it under this Addendum for as long as we keep it. A Run Skeleton does not hold identifiers of people other than your Members; those are Run Content and are deleted as this section describes. After your account closes, we keep Run Skeletons only as the record of what ran and use them for nothing else. We also keep the review sheets you signed for API connections, as the record of what you approved, and keep protecting any Customer Personal Information in them under this Addendum.

11. Liability and term

Each party's liability under this Addendum is subject to the limits in the Terms. This Addendum lasts as long as we process Customer Personal Information for you.

Annex 1. The processing

Annex 2. Security measures

We maintain the measures described on our Security page, including:

• encryption of stored Credentials, each with its own data key, wrapped by a key held outside the database;
• one-way fingerprints, never the keys themselves, for the app keys and webhook address secrets we issue;
• encrypted connections for calls to Connected Services, and refusal of calls to private, loopback and link-local addresses;
• database rules and server-side checks that keep each workspace's data separate;
• a run log that the application's interfaces can add to but cannot change or delete, except that deleting content removes an entry's values and responses and keeps its skeleton; and
• access to production systems limited to the people who need it.