Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Marqeable, Inc. (“Marqeable”) and the customer (“Customer”). It applies when Marqeable processes personal data in Customer Data on Customer’s behalf (“Customer Personal Data”). It applies automatically; there is nothing to sign. Words not defined here have the meaning the Terms or applicable data protection law give them.

For Customer Personal Data, Customer is the controller (or “business”) and Marqeable is its processor (or “service provider”). Marqeable is the controller of the account, billing and usage data it needs to run its own business, as our Privacy Policy describes.

Marqeable processes Customer Personal Data only on Customer’s documented instructions. Customer’s instructions are the Terms, this DPA, and how Customer’s users set up and use the Service, including the use described under “Improving Marqeable” in the Terms. Marqeable will tell Customer if it believes an instruction breaks data protection law. Customer is responsible for the lawfulness of its instructions and for having a legal basis, notices and consents for the processing.

• Confidentiality. People who process Customer Personal Data are bound to keep it confidential.
• Security. Marqeable keeps the measures in Annex 2 in place and may improve them over time, but won’t reduce the overall protection they give.
• Requests from individuals. Marqeable helps Customer answer requests to access, correct, delete or port personal data, mainly through the product. If Marqeable receives a request meant for Customer, it passes it on and doesn’t answer it except as Customer instructs.
• Personal data breaches. Marqeable notifies Customer without undue delay after becoming aware of a breach affecting Customer Personal Data, with the information Customer reasonably needs to meet its own obligations, and takes reasonable steps to contain it.
• Assessments. Marqeable gives Customer reasonable help with data protection impact assessments and consultations with authorities about the Service.
• Deletion. When Customer closes its account, Marqeable deletes Customer Personal Data within 90 days, except backup copies (overwritten on a rolling 30-day cycle) and data the law requires it to keep. Customer can export its data before closing.
• Audits. Marqeable makes available the information reasonably necessary to show it meets this DPA. If that isn’t enough, Customer may audit Marqeable on 30 days’ written notice, no more than once a year, during business hours, at its own cost and under confidentiality.

Customer authorizes Marqeable to use the sub-processors listed on our sub-processors page. Marqeable binds each one by contract to data protection terms at least as protective as this DPA, and remains responsible for them.

Marqeable updates that page and emails Customer’s admins at least 30 days before adding a sub-processor. Customer may object on reasonable data protection grounds by emailing info@marqeable.com within that time. The parties will try to resolve the objection in good faith; if they can’t, Customer may close its account and receive a refund of fees prepaid for the period after closing.

Marqeable processes Customer Personal Data in the United States. Where data protection law requires safeguards for a transfer of personal data from the EEA, the UK or Switzerland, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module 2 (controller to processor) or Module 3 (processor to processor), which are incorporated by reference, with Customer as data exporter and Marqeable as data importer, and:

• the optional docking clause and Clause 11 option do not apply;
• in Clause 9, option 2 (general authorization) applies, with the notice period in “Sub-processors” above;
• in Clauses 17 and 18, the law and courts of Ireland apply;
• Annexes 1 and 2 of this DPA complete the Clauses’ annexes;
• for UK transfers, the UK International Data Transfer Addendum applies, and for Swiss transfers, references to the GDPR are read as references to the Swiss Federal Act on Data Protection.

If the Clauses conflict with this DPA, the Clauses win.

Where U.S. state privacy laws such as the CCPA apply, Marqeable processes Customer Personal Data as a service provider or processor. Marqeable will not sell or share it, will not keep, use or disclose it outside its direct business relationship with Customer except as those laws permit (including to build and improve the Service), and will not combine it with personal data from other sources except as they allow. Marqeable will tell Customer if it can no longer meet these obligations.

• Data encrypted in transit (TLS).
• Hosting on Amazon Web Services, with databases and file storage encrypted at rest.
• Each account’s data isolated from other accounts’ at the database level.
• Credentials for connected tools encrypted with a key specific to each account.
• Role-based access for Customer’s users, and an audit log of account changes.
• Access to production systems limited to the staff who need it.
• Backups on a rolling 30-day cycle.

Data protection questions: Marqeable, Inc., [Mailing address to be added], info@marqeable.com.