Data Processing Addendum

This Data Processing Addendum ("DPA") explains how Live Free Software handles the personal information our clients collect through our platform. It is part of our Terms of Service.

Each section starts with a short summary in italics. Summaries are for convenience; the full text governs.

1.Who this applies to

In short: you control your customers' data. We process it for you, on your instructions.

This DPA is between Live Free Software LLC ("we," "Processor") and the business that uses our services ("you," "Controller"). It applies whenever we process Client Data that is personal information.

Terms not defined here have the meanings in our Terms of Service. "Applicable Privacy Law" means every US federal and state privacy law that applies, including the New Hampshire Privacy Act (RSA 507-H) and the California Consumer Privacy Act.

2.Roles

• You are the controller (or "business") for Client Data. You decide why and how it is used.
• We are your processor (or "service provider"). We process Client Data only to provide the Services to you.
• You are responsible for having a lawful basis and the consents needed for the data you give us.

3.Details of the processing

4.Your instructions

We process Client Data only on your documented instructions. These Terms, this DPA and your use of the platform's settings are your instructions. If we believe an instruction breaks the law, we will tell you.

We may also process Client Data when the law requires it. Where the law allows, we will tell you first.

5.Confidentiality

Everyone we allow to process Client Data is bound by a duty of confidentiality.

6.Security

In short: reasonable technical and organizational safeguards, listed in Annex A.

We maintain the security measures in Annex A. We may update them, as long as the overall level of protection does not go down.

7.Sub-processors

In short: we use vetted providers, list them publicly, and give 30 days' notice of new ones.

• You authorize us to use the sub-processors on our Sub-processors page.
• We give at least 30 days' notice before adding a new one. You may object in writing during that time for reasonable data-protection reasons.
• If we can't resolve your objection, you may cancel the affected Services and receive a prorated refund.
• Each sub-processor is bound by a written contract with protections at least as strong as this DPA.
• We remain responsible for our sub-processors' work.

8.Helping you meet your obligations

• Privacy requests. The platform lets you find, export, correct and delete contact data. If we get a request about your data, we forward it to you and do not answer it ourselves unless you tell us to.
• Assessments. We give you the information you reasonably need for data protection assessments.
• Regulators. We cooperate with you on reasonable requests from regulators.

9.Security breaches

We notify you within 72 hours of confirming a breach that affects your Client Data. We tell you what happened, what data was involved and what we are doing about it. We update you as we learn more.

10.Return and deletion

When the Services end, you have 30 days to export your Client Data. We delete it within 90 days after that, except data in backups (deleted on their normal cycle) and records the law requires us to keep.

11.Audits

On written request, we provide information that shows we comply with this DPA. This includes our infrastructure providers' independent security certifications. If that is not enough, you may audit our compliance once a year, with 30 days' notice, at your own cost, during business hours.

12.US state law terms

As your service provider, we will not:

• sell or share Client Data, including for targeted advertising;
• keep, use or disclose Client Data for any purpose other than providing the Services;
• use Client Data outside our direct business relationship with you; or
• combine Client Data with personal information from other sources, except as the law allows.

We will tell you if we can no longer meet these duties. You may then take reasonable steps to stop unauthorized use. We understand and will comply with these restrictions.

13.International transfers

Client Data is stored in the United States. We do not currently serve clients outside the US. If we do in the future, we will add the approved transfer terms (such as Standard Contractual Clauses) to this DPA.

14.General

This DPA lasts as long as we process Client Data for you. If it conflicts with the Terms on data protection, this DPA controls. Liability under this DPA is subject to the limits in the Terms.

Annex A.Security measures

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
• Two-factor authentication required for all users
• Access limited to people who need it, removed promptly when no longer needed
• Activity logging and monitoring
• Regular backups
• Hosting on major US cloud providers with independent SOC 2 Type II and ISO 27001 certifications
• Card payments handled by PCI DSS-certified payment processors; we never store full card numbers

15.Contact