Data Processing Addendum

1. Scope and roles

This DPA applies to personal information that Customer or its users put into MapKnock, or that MapKnock collects for Customer, such as Customer’s own customer records, notes, text message opt-ins and conversations, mail recipients Customer supplies, and visitors matched on Customer’s website (“Customer Personal Data”). For Customer Personal Data, Customer is the controller or business, and MapKnock is its processor or service provider.

It doesn’t apply to MapKnock Data (property and contact information MapKnock licenses and provides to Customer), which MapKnock controls as an independent business and which the Terms of Service govern, or to MapKnock’s own account, billing and website information about Customer and its users, which the Privacy Policy covers.

2. Details of processing

• Purpose and nature: hosting, organizing, displaying, sending and receiving messages and mail, syncing with Customer’s CRM, supporting and securing the service.
• People concerned: Customer’s customers, prospects, homeowners it contacts, people who opt in to its texts, its website visitors and its users.
• Types of data: names, postal and email addresses, phone numbers, property details, messages, notes, opt-in and opt-out records, visit and activity records, and device information.
• Duration: for the term of the Agreement and the deletion period in section 9.
• Sensitive data: none intended. Customer won’t put sensitive personal information into MapKnock.

3. Processing on Customer’s instructions

MapKnock processes Customer Personal Data only on Customer’s documented instructions. The Agreement, Customer’s configuration of the service and its actions in it are those instructions. MapKnock will tell Customer if it believes an instruction breaks the law, and may decline it. Customer is responsible for the lawfulness of its instructions and for having the notices and consents the processing needs.

For Customer Personal Data, MapKnock will not:

• sell or share it, as those terms are used in the CCPA;
• retain, use or disclose it for any purpose other than the business purposes in this DPA, or outside its direct business relationship with Customer;
• combine it with personal information from other sources, except as the law allows a service provider to; or
• use it in contact lookups or provide it to any other customer.

MapKnock may use Customer Personal Data to build or improve the quality of its services, to detect security incidents and fraud, and to create aggregated or de-identified information that can’t reasonably identify anyone, which it will not try to re-identify. MapKnock will comply with the CCPA and provide the same level of privacy protection the CCPA requires, will tell Customer if it can no longer meet its obligations, and Customer may then take reasonable steps to stop and remedy unauthorized processing.

4. Confidentiality

MapKnock makes sure everyone it authorizes to process Customer Personal Data is bound by a duty of confidentiality and accesses only what their work requires.

5. Security

MapKnock maintains technical and organizational measures appropriate to the risk, including:

• encryption of data in transit, and encryption at rest by its hosting and database providers;
• tenant isolation enforced in the database with row-level security, and role-based access within each workspace;
• two-factor authentication for administrators and access to production limited to the people who need it;
• secrets and provider credentials kept on servers and never sent to browsers;
• logging, monitoring, backups, vulnerability management and prompt patching;
• vendor security review and written contracts with every subprocessor; and
• a written information security program reviewed at least once a year.

6. Subprocessors

Customer authorizes MapKnock to use the subprocessors described on the Service Providers page. MapKnock binds each one by written contract to obligations at least as protective as this DPA and remains responsible for them. MapKnock will update that page at least 15 days before adding or replacing a subprocessor that processes Customer Personal Data. Customer may object on reasonable data protection grounds within that period; the parties will discuss it in good faith, and if they can’t resolve it, Customer may end the affected service and receive a refund of prepaid fees for it. A named list is available to Customer on request under confidentiality.

7. Helping with privacy requests

MapKnock will help Customer, through the service’s features or on request, to answer requests from people to access, correct, delete or port their information or to opt out, taking into account the nature of the processing. If MapKnock receives a request about Customer Personal Data directly, it will refer the person to Customer, except that MapKnock will itself honor opt-outs and do-not-contact requests across the platform. MapKnock will also provide information Customer reasonably needs for data protection assessments.

8. Security incidents

MapKnock will notify Customer without undue delay, and no later than 72 hours, after confirming a breach of security that leads to the unauthorized access, disclosure, loss or alteration of Customer Personal Data. The notice will describe what happened, the data and people affected as far as known, what MapKnock is doing, and a contact. MapKnock will take reasonable steps to contain and remedy the incident and help Customer meet its own notification duties. Notice is not an admission of fault.

9. Return and deletion

Customer can export its leads at any time. Within 90 days after the Agreement ends, MapKnock will delete Customer Personal Data, except copies in backups that are overwritten in the normal course, and records the law, a carrier or a defense of claims requires MapKnock to keep, such as opt-in and opt-out records, which stay confidential and protected by this DPA for as long as they are kept.

10. Information and audits

On written request, no more than once a year, MapKnock will provide information reasonably needed to show its compliance with this DPA, such as a description of its security program and answers to a reasonable security questionnaire. If a regulator requires it, or after a security incident affecting Customer Personal Data, Customer may arrange a further assessment by an independent assessor bound by confidentiality, on 30 days’ notice, during business hours, at Customer’s cost, and without access to other customers’ data.

11. General

Processing takes place in the United States. If this DPA conflicts with the rest of the Agreement about Customer Personal Data, this DPA wins. Each party’s liability under this DPA is subject to the limits in the Terms of Service. This DPA lasts as long as MapKnock processes Customer Personal Data.