Data Processing Addendum

1. Application and definitions

This Data Processing Addendum (the “Addendum”) forms part of the Terms of Service (the “Terms”) between WatchMyCover (“WatchMyCover”) and Customer, and applies to the extent WatchMyCover processes Personal Information on Customer’s behalf in providing the Services. Capitalized terms not defined here have the meanings given in the Terms. If this Addendum conflicts with the Terms on the subject of the processing of Personal Information, this Addendum controls.

• “Privacy Laws” means the laws and regulations of the United States and its states that apply to the processing of Personal Information under the Terms, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its regulations (the “CCPA”), and the comparable consumer privacy laws of other states.
• “Personal Information” means information contained in Customer Data that identifies, relates to, describes, or is reasonably capable of being associated with an identified or identifiable individual, and that is protected as “personal information” or “personal data” under Privacy Laws.
• “Security Incident” means a breach of WatchMyCover’s security leading to the unauthorized or unlawful access to, or the acquisition, disclosure, loss, or destruction of, Personal Information in WatchMyCover’s possession or control.
• “Subprocessor” means a third party that WatchMyCover engages to process Personal Information on Customer’s behalf.
• The terms “business,” “business purpose,” “controller,” “processor,” “service provider,” “sell,” and “share” have the meanings given in the applicable Privacy Laws.

2. Roles of the parties

As between the parties, Customer is the business or controller of Personal Information, and WatchMyCover is Customer’s service provider or processor. Customer determines the purposes and means of the processing. Each party will comply with the obligations that apply to it under Privacy Laws.

Customer is responsible for the lawfulness of its collection of Personal Information and of its instructions to WatchMyCover, and for giving any notice to, and obtaining any consent from, the individuals concerned that Privacy Laws require.

3. Processing on Customer’s instructions

WatchMyCover will process Personal Information only on Customer’s documented instructions, which consist of the Terms, this Addendum, Customer’s use and configuration of the Services, and any further written instructions the parties agree. The nature, purpose, and details of the processing are set out in Section 12.

WatchMyCover will notify Customer if, in its opinion, an instruction violates Privacy Laws, and will not be required to follow such an instruction.

4. Service provider restrictions

WatchMyCover processes Personal Information for the limited and specified business purposes of providing, maintaining, securing, and supporting the Services for Customer. WatchMyCover will not:

• sell or share Personal Information;
• retain, use, or disclose Personal Information for any purpose other than those business purposes, including for any commercial purpose other than providing the Services, or as otherwise permitted of a service provider by Privacy Laws;
• retain, use, or disclose Personal Information outside the direct business relationship between WatchMyCover and Customer; or
• combine Personal Information with personal information that it receives from or on behalf of another person, or collects from its own interaction with an individual, except as Privacy Laws permit a service provider to do.

WatchMyCover will comply with the obligations that apply to it as a service provider under Privacy Laws and will provide the level of privacy protection those laws require. WatchMyCover will notify Customer if it determines that it can no longer meet its obligations under Privacy Laws. Customer may take reasonable and appropriate steps to ensure that WatchMyCover uses Personal Information consistently with Customer’s obligations under Privacy Laws and, on notice, to stop and remediate any unauthorized use of Personal Information.

WatchMyCover certifies that it understands the restrictions in this Section 4 and will comply with them.

5. Confidentiality

WatchMyCover will ensure that each person it authorizes to process Personal Information is subject to a duty of confidentiality, and will limit access to Personal Information to personnel who need it to provide or support the Services.

6. Security

WatchMyCover will implement and maintain reasonable administrative, technical, and physical safeguards appropriate to the nature of the Personal Information, designed to protect it against Security Incidents. The measures in place are described on the security page. WatchMyCover may update those measures from time to time, provided the overall level of protection is not materially reduced.

Customer is responsible for the secure use of the Services by its Authorized Users, including safeguarding credentials, configuring two-factor sign-in, and controlling the persons to whom it sends upload links and shared report links.

7. Subprocessors

Customer authorizes WatchMyCover to engage the Subprocessors listed below, and to engage others in accordance with this Section 7. WatchMyCover will enter into a written agreement with each Subprocessor imposing data protection obligations no less protective than those in this Addendum, and remains responsible for each Subprocessor’s performance of those obligations.

• Vercel Inc.: Hosting of the website and the web application. Location of processing: United States.
• Render Services, Inc.: Hosting of the application programming interface and background processing. Location of processing: United States.
• Neon, Inc.: Database and storage of uploaded documents. Location of processing: United States.
• Resend, Inc.: Delivery of account email and of email sent on a Customer’s behalf. Location of processing: United States.
• Anthropic, PBC: Automated reading of a certificate into a draft, when a user requests it. Location of processing: United States.
• PostHog, Inc.: Product analytics and error reporting, without Customer Data content. Location of processing: United States.
• Stripe, Inc.: Subscription billing and payment processing. Location of processing: United States.
• Google LLC: Address suggestions while a company address is typed. Location of processing: United States.
• Mintlify, Inc.: Hosting of the help documentation. Location of processing: United States.

WatchMyCover will update this list before a new Subprocessor begins processing Personal Information. Customer may object to a new Subprocessor on reasonable data protection grounds by writing to WatchMyCover within 15 days after the list is updated. If the parties cannot resolve the objection, Customer may terminate the affected Services and receive a refund of any prepaid fees covering the period after termination.

8. Requests from individuals

The Services allow Customer to access, correct, export, and delete Personal Information itself. Taking into account the nature of the processing, WatchMyCover will give Customer reasonable assistance in responding to requests from individuals to exercise their rights under Privacy Laws, to the extent Customer cannot do so through the Services.

If WatchMyCover receives such a request directly, and can identify that it relates to Customer, WatchMyCover will forward it to Customer without undue delay and will not respond to it other than to tell the individual that it has been forwarded, unless Customer instructs otherwise or the law requires.

9. Security Incidents

WatchMyCover will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer’s Personal Information. The notice will describe, to the extent known, the nature of the Security Incident, the Personal Information affected, and the steps WatchMyCover has taken or will take to contain and remedy it, and WatchMyCover will supplement the notice as further information becomes available.

WatchMyCover will take reasonable steps to contain and investigate the Security Incident and will cooperate reasonably with Customer so that Customer can meet its own notification obligations under applicable law. A notice under this Section 9 is not an acknowledgment of fault or liability.

10. Return and deletion

Customer may export its compliance register at any time during the Subscription Term. Within 30 days after Customer’s account is closed, WatchMyCover will delete Personal Information, except for copies it is required by law to retain and copies in backups, which are overwritten in the ordinary course and remain subject to this Addendum until then.

11. Information and audits

On Customer’s written request, and no more than once in any twelve-month period unless a Security Incident has occurred or a regulator requires it, WatchMyCover will make available the information reasonably necessary to demonstrate its compliance with this Addendum, including written responses to reasonable security questionnaires. Where that information is not sufficient to demonstrate compliance, the parties will agree on the scope, timing, and cost of a further assessment, which must be conducted during business hours, on reasonable notice, under obligations of confidentiality, and without access to the data of any other customer.

12. Details of the processing

• Subject matter and purpose: providing the Services to Customer, namely recording and checking the insurance of Customer’s Subcontractors against Customer’s requirements, sending reminders and document requests on Customer’s behalf, receiving and storing the documents returned, and producing reports.
• Duration: the Subscription Term, and the period after it until deletion under Section 10.
• Individuals concerned: Customer’s Authorized Users, and the employees and representatives of Customer’s Subcontractors and of their insurance agents and brokers.
• Categories of Personal Information: names, business email addresses and telephone numbers, employer and role, and such Personal Information as appears on certificates of insurance and related documents, which is ordinarily limited to business contact details.
• Sensitive information: none is intended to be processed. The Terms prohibit Customer from submitting it.
• Location of processing: the United States.

13. General

Each party’s liability under this Addendum is subject to the exclusions and limitations of liability in the Terms. This Addendum is governed by the law that governs the Terms, and remains in effect for as long as WatchMyCover processes Personal Information on Customer’s behalf.

A customer that requires a countersigned copy of this Addendum may request one at info@watchmycover.com.