Customer Data Processing Addendum

1. Definitions

• “Account” means any accounts or instances created by, or on behalf of, Customer or its Affiliates within the Services or Clicks! platform.
• “Affiliate” means any entity within a controlled group of companies that directly or indirectly, through one or more intermediaries, controls, is controlled by, or is under common control with one of the Parties.
• “Applicable Data Protection Laws” means all laws and regulations applicable to the Processing of Customer Personal Data, including but not limited to GDPR, CCPA/CPRA, and state privacy laws.
• “Contracted Processor” means any third party appointed by or on behalf of Digiwoof to Process Customer Personal Data in connection with the Services.
• “Customer Personal Data” means Personal Data contained within Customer Data that Digiwoof Processes by or on behalf of Customer to provide the Services in accordance with the Agreement.
• “Services” means the services, Clicks! platform features, and other activities carried out by or on behalf of Digiwoof for Customer.
• “Sub-Processor” means a direct Processor of a Processor. For the avoidance of doubt, Contracted Processors are Sub-Processors.

2. Scope and Applicability

Duration: This Addendum takes effect on the Effective Date and continues concurrently for the duration that Personal Data is Processed by Digiwoof pursuant to the Agreement.

Scope: This Addendum applies to the Processing of all Customer Personal Data, regardless of country of origin, place of Processing, location of Data Subjects, or any other factor.

3. Processing of Customer Personal Data

Digiwoof will act as a Processor of Customer Personal Data. Customer will act as the Controller of Customer Personal Data.

Digiwoof shall:

• Comply with all Applicable Data Protection Laws in the Processing of Customer Personal Data.
• Not Process Customer Personal Data other than on Customer’s documented instructions, including to provide and improve the Services set forth in the Agreement.
• Inform Customer immediately if, in Digiwoof’s reasonable opinion, a Processing instruction given by Customer infringes Applicable Data Protection Laws.

4. Personnel Confidentiality and Security

Digiwoof shall take reasonable steps to ensure the reliability of any employee, agent, or contractor who may have access to Customer Personal Data, ensuring that access is strictly limited to those with a need to know and subject to strict legal or contractual confidentiality obligations.

5. Security Measures

Digiwoof maintains comprehensive technical and organizational measures (TOMs) including AES-256 encryption at rest, TLS 1.2+ encryption in transit, role-based access controls, automatic backups, and multi-factor authentication to protect personal data against unauthorized access, loss, or alteration.

6. Sub-Processors

Customer authorizes Digiwoof to engage Sub-Processors to support the delivery of Services. An up-to-date list of current sub-processors is publicly available on our Sub-Processors Page.

7. Personal Data Breach Notification

In the event of a confirmed Personal Data Breach affecting Customer Personal Data under Digiwoof’s control, Digiwoof will notify Customer without undue delay and within seventy-two (72) hours of becoming aware, taking immediate corrective action to mitigate risks.