Data Processing Addendum

1. What this addendum is

This Data Processing Addendum ("DPA") is part of the agreement between Swift ("Swift") and each business that uses Swift ("Customer") under the Terms of Service. It covers personal information in Customer Data that Swift processes for Customer. Words defined in the Terms mean the same here. If this DPA and the Terms disagree about personal information, this DPA wins.

2. Roles

Customer is the business (or controller) that decides why and how its Customer Data is used. Swift is its service provider (or processor) and processes Customer Data only to provide, secure and support the Service, on Customer's documented instructions. The Terms, Customer's settings and what Customer and its users do in the Service are those instructions.

Swift tells Customer if it believes an instruction breaks the law, and may refuse it.

Customer is responsible for the lawfulness of its Customer Data and for any notices and consents the law requires, including for calls, texts and recordings.

3. State privacy law commitments

For the California Consumer Privacy Act and similar state laws, Swift:

• won't sell or share Customer Data (as those laws define those words)
• won't keep, use or disclose it for any purpose other than providing the Service, or outside its direct business relationship with Customer, except as those laws allow
• won't combine it with personal information from other sources, except as those laws allow
• will follow those laws and give the same level of privacy protection they require
• will tell Customer if it can no longer meet these duties, and lets Customer take reasonable steps to stop and fix unauthorized use

4. Confidentiality

Everyone at Swift who can access Customer Data is bound to keep it confidential, and gets access only as their job needs.

5. Security

Swift keeps reasonable technical and organizational safeguards in place, including:

• encryption of data in transit, and of stored provider credentials
• separation of each workspace's data, with role-based access inside a workspace
• limited, logged staff access
• rate limits, abuse detection and alerts to Swift's staff
• backups and access controls at our hosting and database providers

6. Subprocessors

Customer authorizes Swift to use the subprocessors listed at /subprocessors. Swift binds each one in writing to data-protection duties at least as protective as this DPA and stays responsible for them.

Swift gives at least 30 days' notice before adding a subprocessor. Customer may object on reasonable data-protection grounds within that time; if the parties can't resolve it, Customer may end the affected part of the Service and get a refund of fees prepaid for it.

7. Requests from people and authorities

If someone asks Swift to see, correct or delete their information in Customer Data, Swift will pass the request to Customer and not answer it itself unless the law requires. Swift gives Customer tools and reasonable help to answer these requests (for example, export, edit and delete in the app), and helps with risk assessments where Customer needs information only Swift has.

If an authority asks for Customer Data, Swift will tell Customer first unless the law forbids it.

8. Security incidents

Swift will tell Customer without undue delay, and within 72 hours, after confirming a breach of security that leads to unauthorized access to Customer Data. The notice will say what is known and what Swift is doing, and Swift will update it as it learns more and help Customer meet its own notice duties.

9. Return and deletion

Customer can export Customer Data at any time while the account is open, and for 30 days after it ends. Swift then deletes it, including from backups as they cycle out, except what the law or a legal hold requires it to keep, which stays protected by this DPA.

10. Information and audits

Once a year, or after a security incident, Customer may ask for information that shows Swift meets this DPA, such as a security questionnaire answered in writing. If that isn't enough to meet a legal requirement, Customer may arrange a reasonable audit, at its own cost, with 30 days' notice, during business hours and under confidentiality.

11. Where data is processed

Swift and its subprocessors process Customer Data in the United States.

12. Term

This DPA lasts as long as Swift processes Customer Data. The Terms' limits of liability apply to it. Questions: legal@swiftcrm.tech. A signed copy is available on request.