Data processing addendum.

01What this covers#

This addendum is part of our Terms of Service between you ("Customer") and Fresh Lime Media LLC dba Peak Engine ("Peak"). It applies only to personal data about your customers, leads, vendors and staff that Peak processes for you through the hosted parts of the Peak apps or while our team runs your tools on a managed plan ("Customer Personal Data"). It doesn't apply to data that sits only in your own database or accounts and never passes through our systems, or to account data Peak controls (see the Privacy Policy).

Words like controller, processor, business, service provider, personal data and processing mean what they mean in the privacy law that applies, including the CCPA and other U.S. state laws, and the GDPR where it applies. If you have a signed agreement with its own data terms, those apply first and this addendum fills any gaps.

02Roles and details#

You're the controller (or business). Peak is the processor (or service provider).

03Our commitments#

Peak will:

1. Process Customer Personal Data only on your documented instructions (these terms, this addendum, and how you set up and use the Service) and to provide the Service, unless the law requires otherwise, in which case we'll tell you unless the law forbids it.
2. Not sell or share it; not keep, use or disclose it outside our direct business relationship with you or for any purpose other than providing the Service; and not combine it with other data except as the law allows. We certify we understand and will follow these restrictions.
3. Make sure everyone with access is bound to keep it confidential.
4. Keep reasonable technical and organizational security measures that fit the risk (see "Security measures").
5. Help you answer requests from people about their data by passing on requests we receive and giving you tools or reasonable help, and help with security, breach notices and any required assessments. Help beyond normal support may be at your reasonable cost.
6. When your account or plan ends, delete or return Customer Personal Data in our hosted systems within 90 days of your request, except backups that roll off on their normal schedule and data the law requires us to keep.
7. Give you the information reasonably needed to show we follow this addendum, through a security questionnaire or, no more than once a year on 30 days' notice, a remote review of our documentation at your cost. Third-party reports can satisfy this where available.
8. Tell you if we can no longer meet our obligations under the privacy laws that apply.

04Security incidents#

We'll notify you without undue delay, and within 72 hours after we confirm a breach of security affecting Customer Personal Data in our hosted systems, with the information we have then, and we'll update you as we learn more. You decide on and send any notices to your customers and regulators, except where the law requires us to notify directly. A breach of your own database, storage or accounts, or one caused by your compromised credentials, is your responsibility, though we'll help where we reasonably can.

05Subprocessors#

You give general approval for the subprocessors on our Subprocessors page. We put data protection terms on them that protect the data at least as much in substance as this addendum, and we're responsible for their work as the Terms describe. We'll update that page and email account owners at least 30 days before adding or replacing a subprocessor that handles Customer Personal Data. You can object on reasonable data-protection grounds within 15 days; if we can't resolve it, you can stop using the affected part and delete your workspace. Providers you connect yourself are yours, not our subprocessors.

06Your responsibilities#

You're responsible for: a lawful basis and notices to your customers; getting the consents you need; keeping data accurate and limited to what you need; not sending us data you can't lawfully send (like health records or card numbers); setting retention in your own database; answering people's requests; your own accounts; and your own security.

07Data from outside the U.S.#

Peak processes data in the United States, and the Service is meant for U.S. businesses. If Customer Personal Data covered by the GDPR, UK GDPR or Swiss law is transferred to Peak, the parties agree to the EU Standard Contractual Clauses (Commission Decision (EU) 2021/914), Module Two (controller to processor), with the UK International Data Transfer Addendum and Swiss amendments as applicable, completed with the details in this addendum, Utah County, Utah as the place for disputes where the clauses allow it, and Ireland's law and courts where the clauses require an EU member state.

08Security measures#

• Encryption in transit, and encryption of stored keys and sensitive settings
• Row-level separation so each business's data stays apart
• Role-based access and least privilege for our team
• Sign-in with Google or one-time codes
• Audit logs of actions, including AI actions
• Signature checks on incoming webhooks, and rate limits
• A separate demo workspace with sending turned off
• Vendor review before we use a subprocessor
• Backups for databases Peak hosts, and a written incident response process

You secure your own database and accounts.

09Liability and what wins#

Liability under this addendum is subject to the limits in the Terms (or your signed agreement), except where the law doesn't allow it. If documents conflict: a signed agreement wins, then this addendum (for Customer Personal Data), then the Terms.

Questions: hello@peak-engine.com. Fresh Lime Media LLC dba Peak Engine · 972 W 1050 S, American Fork, UT 84003 · hello@peak-engine.com · (801) 822-9439