Data processing addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between Rollstack Inc. (“Rollstack”) and the customer that accepts it (“Customer”) for Customer’s use of the Product and Services, whether that agreement is the Rollstack Terms of Service at https://www.rollstack.com/legal/terms-of-service, an Order Form, or another written agreement (the “Agreement”). This DPA applies only where, and to the extent that, Rollstack Processes Customer Personal Data on behalf of Customer. It is incorporated into the Agreement, and Customer accepts it by accepting the Agreement or by accepting this DPA electronically in the Services. Customer’s acceptance, including electronic acceptance, is its signature of this DPA (Section 15.C).

If Customer and Rollstack have signed a separate data processing agreement that covers the Services, that agreement applies instead of this DPA.

Capitalized terms not defined in this DPA have the meanings given in the Agreement. If this DPA conflicts with the Agreement, this DPA controls with respect to the Processing of Customer Personal Data. If the Standard Contractual Clauses or the UK Addendum apply and conflict with this DPA, they control.

1. Definitions

A. “Account and Usage Data” means Personal Data that Rollstack collects about Customer, its Authorized Users and its other contacts in connection with the account, billing, support, security and operation of the Services, such as names, contact and log-in details, billing information, and usage, log and device data, but not Customer Content. Account and Usage Data is not Customer Personal Data.

B. “Customer Content” means data, files and other content that Customer or its Authorized Users connect, upload or submit to the Services, and the outputs the Services generate from them, including “Customer Internal Data” and “Outputs” as defined in the Agreement.

C. “Customer Personal Data” means Personal Data in Customer Content that Rollstack Processes on behalf of Customer under the Agreement.

D. “Data Protection Laws” means all data protection and privacy laws that apply to Rollstack’s Processing of Customer Personal Data under the Agreement, which may include the GDPR, the UK GDPR, the Swiss FADP and US State Privacy Laws.

E. “GDPR” means Regulation (EU) 2016/679 (the General Data Protection Regulation).

F. “Personal Data” means information relating to an identified or identifiable natural person, and any information protected as “personal data,” “personal information” or a similar term under Data Protection Laws.

G. “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data while it is Processed by Rollstack or its Subprocessors. It does not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, such as pings, port scans and failed log-in attempts.

H. “Restricted Transfer” means a transfer of Customer Personal Data from the European Economic Area (“EEA”), Switzerland or the United Kingdom to a country that the European Commission, the Swiss Federal Council or the UK government, as applicable, has not recognized as providing an adequate level of protection.

I. “Services” means the Product and the Services, as defined in the Agreement.

J. “Standard Contractual Clauses” or “SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

K. “Subprocessor” means any third party that Rollstack engages to Process Customer Personal Data, other than Rollstack’s employees and individual contractors acting under Rollstack’s direct authority.

L. “Subprocessor List” means the list of Subprocessors at https://www.rollstack.com/legal/subprocessors, as updated from time to time.

M. “Swiss FADP” means the Swiss Federal Act on Data Protection of 25 September 2020.

N. “UK Addendum” means the International Data Transfer Addendum to the SCCs (version B1.0) issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018.

O. “UK GDPR” means the GDPR as it forms part of the law of the United Kingdom under the European Union (Withdrawal) Act 2018, together with the UK Data Protection Act 2018.

P. “US State Privacy Laws” means the California Consumer Privacy Act of 2018, as amended, and its regulations (together, the “CCPA”), and the other US state consumer privacy laws that apply to Rollstack’s Processing of Customer Personal Data.

Q. “Business,” “Consumer,” “Controller,” “Data Subject,” “Process,” “Processor,” “Sell,” “Service Provider,” “Share” and “Supervisory Authority” have the meanings given in Data Protection Laws. “Controller” includes “Business,” “Processor” includes “Service Provider,” and “Data Subject” includes “Consumer.”

2. Scope and Roles

A. Customer is the Controller of Customer Personal Data (or, where Customer acts on behalf of another Controller, a Processor), and Rollstack is its Processor. Under the CCPA, Customer is the Business and Rollstack is its Service Provider.

B. Rollstack Processes Account and Usage Data as an independent Controller, for its own business purposes as described in its Privacy Policy at https://www.rollstack.com/legal/privacy-policy, such as managing accounts, billing, providing support, securing and debugging the Services, analytics and improving the Services. This DPA does not apply to Account and Usage Data.

C. Annex I describes the subject matter, nature, purpose and duration of the Processing, the types of Customer Personal Data and the categories of Data Subjects.

3. Customer Instructions and Responsibilities

A. Rollstack will Process Customer Personal Data only on Customer’s documented instructions, unless applicable law requires otherwise. In that case, Rollstack will inform Customer of the legal requirement before the Processing, unless the law prohibits it.

B. The Agreement, this DPA, and Customer’s use and configuration of the Services, including by its Authorized Users, are Customer’s complete instructions. Additional instructions require Rollstack’s written agreement, and Rollstack may charge for them.

C. Rollstack will immediately inform Customer if, in Rollstack’s opinion, an instruction infringes Data Protection Laws. Rollstack is not required to provide legal advice or to assess Customer’s compliance.

D. Customer is responsible for Customer Content and for its own compliance with Data Protection Laws, including providing any required notices, obtaining any required consents and having a lawful basis for the Processing. Customer represents and warrants that it has, and will maintain, all rights, notices, consents and lawful bases needed for Rollstack to Process Customer Personal Data under the Agreement, and that its instructions comply with Data Protection Laws.

E. Customer will not submit to the Services any of the following, unless Customer and Rollstack have agreed in writing to terms for it: special categories of Personal Data, or Personal Data relating to criminal convictions and offenses; protected health information under HIPAA, which requires a business associate agreement with Rollstack; payment card data; government identification numbers, such as Social Security, passport or driver’s license numbers; financial account numbers; biometric or genetic data; Personal Data of children under 16; or data subject to export controls, such as ITAR or EAR (together, “Restricted Data”). Customer is solely responsible for any Restricted Data it submits in breach of this Section.

F. Customer will provide Customer Personal Data to Rollstack only through the Services, and not by email or support channels, unless Rollstack agrees otherwise.

4. Confidentiality

Rollstack will ensure that the personnel it authorizes to Process Customer Personal Data are bound by appropriate obligations of confidentiality.

5. Security

A. Rollstack will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, as described in Annex II.

B. Rollstack may update these measures from time to time, provided that the updates do not materially reduce the overall security of Customer Personal Data.

C. Customer is responsible for its use of the Services, including securing its account credentials, managing its Authorized Users and their access, configuring the Services, and protecting Customer Personal Data outside the Services.

6. Personal Data Breach

A. Rollstack will notify Customer without undue delay after becoming aware of a Personal Data Breach.

B. Rollstack will provide the information about the Personal Data Breach that is available to it and that Customer reasonably needs to meet its obligations under Data Protection Laws, as that information becomes available, and will take reasonable steps to contain and investigate the Personal Data Breach.

C. Customer is responsible for any notifications to Supervisory Authorities, Data Subjects or others that Data Protection Laws require of it.

D. Rollstack’s notice of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.

7. Subprocessors

A. Customer gives Rollstack general authorization to engage Subprocessors, including those on the Subprocessor List when Customer accepts this DPA.

B. Rollstack will give notice of a new Subprocessor at least 10 days before it starts Processing Customer Personal Data, by updating the Subprocessor List and by notifying Customer by email to the address associated with its account or in the Services. Where Rollstack must replace a Subprocessor urgently for security or service-continuity reasons, it may give shorter notice where Data Protection Laws allow.

C. Customer may object to a new Subprocessor on reasonable data protection grounds by emailing security@rollstack.com within 10 days after the notice. If Customer does not object within that period, Customer is deemed to have approved the Subprocessor.

D. If Customer objects, Rollstack will use reasonable efforts to offer a change to the Services, or to Customer’s configuration or use of them, that avoids the Processing of Customer Personal Data by the new Subprocessor. If Rollstack cannot do so within a reasonable period, either party may terminate the affected Services on written notice. Termination is Customer’s sole and exclusive remedy for its objection.

E. Rollstack will enter into a written agreement with each Subprocessor that imposes, in substance, the same data protection obligations as this DPA, to the extent applicable to the services the Subprocessor provides. Rollstack is liable for its Subprocessors’ Processing of Customer Personal Data to the same extent as if Rollstack had performed it itself, subject to Section 13.

8. Assistance

A. If Rollstack receives a request from a Data Subject about Customer Personal Data, Rollstack will promptly forward the request to Customer, may direct the Data Subject to Customer, and will not respond to it except as Data Protection Laws require.

B. Taking into account the nature of the Processing, Rollstack will provide reasonable assistance, through the Services’ functionality where possible, for Customer to respond to Data Subject requests, to the extent Customer cannot do so on its own.

C. When Customer instructs Rollstack to delete a Consumer’s Customer Personal Data under the CCPA, Rollstack will delete it, or enable Customer to delete it, and will notify its Subprocessors to do the same, unless an exception under the CCPA applies.

D. Taking into account the nature of the Processing and the information available to it, Rollstack will provide reasonable assistance with Customer’s data protection impact assessments and prior consultations with Supervisory Authorities, to the extent Data Protection Laws require it and Customer cannot meet those requirements using the information Rollstack makes available under Section 9.

E. Rollstack may charge Customer, at its then-current rates, for assistance under this Section 8 that goes beyond the Services’ standard functionality.

9. Audits

A. Rollstack will make available, on Customer’s written request and subject to confidentiality, its standard security documentation, including a copy of its most recent SOC 2 Type II report or a comparable report or certification. This information is Rollstack’s Confidential Information. Rollstack may, at its discretion, answer additional security questionnaires and may charge for doing so.

B. Customer will first rely on the information provided under Section 9.A. Customer may request a further audit only where a Supervisory Authority requires it, after a Personal Data Breach affecting Customer Personal Data, or where Data Protection Laws give Customer that right and Customer reasonably demonstrates that the information provided under Section 9.A is not sufficient to show Rollstack’s compliance with this DPA.

C. Except where Data Protection Laws or a Supervisory Authority require otherwise, any further audit must (i) be requested with at least 30 days’ written notice and a scope agreed in advance; (ii) take place no more than once in any 12-month period, except where a Supervisory Authority requires it or after a Personal Data Breach, during normal business hours and without unreasonable disruption to Rollstack’s business; (iii) be performed by Customer or by an independent auditor that is not a competitor of Rollstack and is bound by written confidentiality obligations; (iv) not include access to Rollstack’s systems, to other customers’ data, or to Rollstack’s proprietary or privileged information; and (v) be at Customer’s expense, including Rollstack’s reasonable costs for the time of its personnel.

10. Return and Deletion

A. During the term of the Agreement, Customer may delete Customer Content using the Services’ features or ask Rollstack to delete it, and Rollstack will delete it within 30 days of the request. This Section 10 applies to all Customer Content and replaces any shorter deletion period in the Agreement.

B. Within 14 days after the Agreement ends, Customer may ask Rollstack to return Customer Personal Data, and Rollstack will do so to the extent technically feasible, in a format Rollstack chooses. After that, Rollstack will delete or anonymize Customer Personal Data within a reasonable time, in line with its standard deletion processes.

C. Customer Personal Data in backups will be deleted in line with Rollstack’s standard backup rotation and protected from further active Processing until then.

D. Rollstack may keep Customer Personal Data where the law requires it. This DPA continues to apply to that data for as long as Rollstack keeps it.

E. On Customer’s written request, Rollstack will confirm the deletion in writing.

11. CCPA and Other US State Privacy Laws

A. Customer discloses Customer Personal Data to Rollstack only for the limited and specified business purposes of providing the Services under the Agreement, as described in Annex I.

B. Rollstack will not:

i. Sell or Share Customer Personal Data;

ii. retain, use or disclose Customer Personal Data for any purpose, including any commercial purpose, other than the business purposes specified in this DPA, or as otherwise permitted by the CCPA;

iii. retain, use or disclose Customer Personal Data outside the direct business relationship between Customer and Rollstack; or

iv. combine Customer Personal Data with Personal Data that it receives from or on behalf of others, or collects from its own interactions with Consumers, except as permitted by the CCPA.

C. Rollstack will comply with the obligations that apply to it under the CCPA and will provide the same level of privacy protection that the CCPA requires of Customer.

D. Rollstack will notify Customer if it determines that it can no longer meet its obligations under the CCPA.

E. Customer may take reasonable and appropriate steps to ensure that Rollstack uses Customer Personal Data consistently with Customer’s obligations under the CCPA, through the information and audits described in Section 9, and may, on notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data.

F. Rollstack will assist Customer with Consumer requests as described in Section 8.

G. If Customer provides deidentified data to Rollstack, Rollstack will not attempt to reidentify it, except as the CCPA permits.

H. Rollstack will engage Subprocessors only under written contracts that comply with the CCPA, as described in Section 7.

I. Rollstack certifies that it understands and will comply with the restrictions in this Section 11.

J. Where other US State Privacy Laws apply, Rollstack will Process Customer Personal Data as a Processor in accordance with this DPA, including its provisions on confidentiality (Section 4), assistance (Section 8), information and assessments (Section 9), deletion or return (Section 10) and Subprocessors (Section 7).

12. International Transfers

A. Customer authorizes Rollstack and its Subprocessors to Process Customer Personal Data in the United States and in the other countries where they operate, subject to this Section 12.

B. For Restricted Transfers from the EEA or Switzerland, the SCCs apply as set out in Section 1 of Exhibit A. For Restricted Transfers from the United Kingdom, the UK Addendum applies as set out in Section 2 of Exhibit A.

C. Where a Restricted Transfer is covered by a lawful transfer mechanism that Rollstack adopts, such as a certification under the EU-U.S. Data Privacy Framework, its UK Extension or the Swiss-U.S. Data Privacy Framework, that mechanism applies instead of the SCCs or the UK Addendum to the extent it covers the transfer.

D. Where other Data Protection Laws restrict transfers of Customer Personal Data out of a country (for example, in Canada, including Québec, South Africa, Australia, Curaçao, Mexico or Saudi Arabia), this DPA provides the contractual protections for those transfers. If those laws require additional transfer terms, Rollstack will reasonably cooperate with Customer to put them in place.

13. Liability

The limitations and exclusions of liability in the Agreement apply to each party’s liability arising out of or related to the Agreement and this DPA together, in the aggregate, whether in contract, tort or under any other theory, and references in those provisions to liability under the Agreement include liability under this DPA. Nothing in this DPA limits either party’s liability to Data Subjects under the third-party beneficiary provisions of the SCCs, or any other liability, to the extent it cannot be limited by law.

14. Term and Changes

A. This DPA remains in effect for as long as Rollstack Processes Customer Personal Data under the Agreement.

B. Notwithstanding any requirement in the Agreement that amendments be signed, Rollstack may update this DPA on notice to Customer, for example by email or in the Services, where Rollstack reasonably considers the update necessary to comply with Data Protection Laws or guidance from a Supervisory Authority, or to reflect a change to or replacement of the SCCs or the UK Addendum. The current version is posted on Rollstack’s website with its “Last updated” date.

C. If a change in Data Protection Laws makes Rollstack’s Processing of Customer Personal Data under this DPA unlawful or commercially impracticable, Rollstack may suspend or terminate the affected Services on notice to Customer.

15. General

A. This DPA is governed by the law, and subject to the jurisdiction, that govern the Agreement, except where the SCCs or the UK Addendum require otherwise.

B. Rollstack will send notices under this DPA to the email address associated with Customer’s account. Customer will send notices to Rollstack at security@rollstack.com.

C. Customer’s acceptance of the Agreement or of this DPA, including electronically in the Services, is its signature of this DPA and, where they apply, of the SCCs and the UK Addendum, and satisfies any requirement in the Agreement that amendments be signed, including for updates under Section 14.B. Rollstack’s acceptance is effective at the same time.

Annex I: Details of Processing

A. List of Parties

Signature and date: each party is deemed to have signed this Annex I on the date Customer accepts this DPA (Section 15.C).

B. Description of Processing and Transfers

Categories of Data Subjects whose Personal Data is transferred

• Customer’s Authorized Users
• Individuals whose Personal Data is included in Customer Content, as determined by Customer, which may include Customer’s employees, customers, prospects, suppliers and other contacts

Categories of Personal Data transferred

• Any Personal Data included in Customer Content, as determined by Customer, which may include names, contact details, professional details and other information in connected data sources, uploaded files, presentations, prompts and outputs

Special categories of Personal Data transferred (if applicable) and applied restrictions or safeguards

• None. Customer may not submit Restricted Data unless the parties have agreed in writing to terms for it (Section 3.E).

The frequency of the transfer

• Continuous, for the term of the Agreement.

Nature and purpose of the Processing

• Hosting, storing and otherwise Processing Customer Personal Data to provide the Services under the Agreement, including connecting to Customer’s data sources, storing data and files, generating presentations, reports and other outputs (including with the AI model providers on the Subprocessor List), providing support and securing the Services. These are the business purposes for which Rollstack Processes Customer Personal Data as a Service Provider.

Retention period

• For the term of the Agreement, then deleted as described in Section 10.

Transfers to Subprocessors

• Subprocessors on the Subprocessor List Process Customer Personal Data for the purposes and duration described in this Annex I. AI model providers may also keep prompts and outputs for a limited period to detect abuse (for example, up to 30 days), and longer only if a request is flagged for abuse or the law requires it.

C. Competent Supervisory Authority

• For Restricted Transfers from the EEA: the supervisory authority determined under Clause 13 of the SCCs, that is, the authority of the EU Member State where Customer is established or, if Customer is not established in the EEA, where its EU representative is established or, failing that, where the Data Subjects concerned are located. For Restricted Transfers from the United Kingdom: the Information Commissioner’s Office. For Restricted Transfers from Switzerland: the Federal Data Protection and Information Commissioner.

Annex II: Technical and Organizational Measures

Rollstack maintains a security program, assessed by an independent auditor under the SOC 2 Type II standard, that includes the following measures. Rollstack may update them under Section 5.B.

• Access control: access to Customer Personal Data is limited to personnel who need it, through unique accounts, role-based permissions and multi-factor authentication for access to production systems.
• Encryption: industry-standard encryption of Customer Personal Data in transit over public networks and at rest.
• Logging and monitoring: logging of access to production systems and monitoring for security events.
• Network and infrastructure security: segregated production environments, firewalls or equivalent cloud controls, and hardened configurations.
• Vulnerability management: regular vulnerability scanning, timely patching and periodic penetration testing.
• Change management: review and testing of changes before they are deployed to production.
• Business continuity: backups of production data and tested recovery procedures.
• Incident response: documented procedures to detect, investigate and respond to security incidents.
• Personnel security: confidentiality obligations, background checks where permitted by law, and security awareness training.
• Vendor management: security review of Subprocessors before engagement, and written data protection terms with them.
• Physical security: provided by Rollstack’s cloud hosting providers, whose data centers are covered by SOC 2 or ISO 27001 reports.
• Data deletion: deletion of Customer Personal Data as described in Section 10.
• Assistance to Customer: deletion features in the Services, and documented processes for handling Customer instructions and forwarding Data Subject requests to Customer.

Annex III: List of Subprocessors

Customer authorizes the Subprocessors on the Subprocessor List at https://www.rollstack.com/legal/subprocessors, as updated under Section 7.

Exhibit A: International Transfers

1. EEA and Swiss Restricted Transfers

This Section 1 applies to Restricted Transfers from the EEA or Switzerland that are not covered by another transfer mechanism under Section 12.C.

A. The SCCs are incorporated into this DPA as follows:

i. Module Two applies where Customer is a Controller, and Module Three applies where Customer is a Processor;

ii. in Clause 7, the optional docking clause does not apply;

iii. in Clause 9, Option 2 (general written authorization) applies, and the time period for prior notice of Subprocessor changes is 10 days;

iv. in Clause 11, the optional language does not apply;

v. in Clause 13, the competent supervisory authority is the one identified in Annex I;

vi. in Clause 17, the SCCs are governed by the laws of Ireland;

vii. in Clause 18(b), disputes are resolved before the courts of Ireland;

viii. Annexes I, II and III of the SCCs are completed with the information in Annexes I, II and III of this DPA;

ix. the audits described in Clause 8.9 are carried out as described in Section 9 of this DPA, to the extent consistent with Clause 8.9, and Rollstack provides the certification of deletion described in Clauses 8.5 and 16(d) in writing, which may be by email; and

x. for transfers from Switzerland, references to the GDPR are to the Swiss FADP, the competent supervisory authority is the Federal Data Protection and Information Commissioner, and “Member State” in Clause 18(c) includes Switzerland, so that Data Subjects in Switzerland can bring claims where they habitually reside.

2. UK Restricted Transfers

This Section 2 applies to Restricted Transfers from the United Kingdom that are not covered by another transfer mechanism under Section 12.C.

A. The UK Addendum is incorporated into this DPA as follows:

i. Table 1 is completed with the information in Annex I of this DPA;

ii. in Table 2, the Addendum EU SCCs are the SCCs as incorporated under Section 1 of this Exhibit A;

iii. in Table 3, the Appendix Information is the information in Annexes I, II and III of this DPA; and

iv. in Table 4, the Importer may end the UK Addendum as set out in its Section 19.