Introduction

This Data Processing Policy ("DPP") is part of the Software as a Service ("SaaS") Agreement between CreateAnAPI, Inc. doing business as PromoLink ("Service Provider") and the Customer ("Customer"). This DPP governs the processing of personal data in connection with the Services provided under the SaaS Agreement.

Definitions

• Data Protection Laws: Refers to all applicable data protection and privacy laws, including but not limited to the California Consumer Privacy Act (CCPA) and any other applicable regulations governing the processing of personal data.
• Personal Data: Any information relating to an identified or identifiable natural person, as defined under applicable Data Protection Laws.
• Processing: Any operation or set of operations performed on Personal Data, such as collection, recording, storage, use, or disclosure.

Scope and Roles

Service Provider is the processor and Customer is the controller of Personal Data, except where Service Provider processes Personal Data for its own purposes as outlined in the Privacy Policy. This DPP applies to all Personal Data processed by the Service Provider in the course of providing the Services.

Processing Details

Service Provider will process Personal Data as required to provide the Services, and only on documented instructions from the Customer unless otherwise required by applicable law. This includes the type of Personal Data, the categories of data subjects, and the purposes of processing as described in the SaaS Agreement.

Subprocessors

Service Provider may engage third-party subprocessors to assist in providing the Services. Service Provider shall ensure that any subprocessors agree to the same obligations regarding data protection as those in this DPP. A list of current subprocessors shall be available upon request, and the Service Provider will notify Customer of any intended changes to subprocessors.

Data Security

Service Provider shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing Personal Data. Such measures shall include, but are not limited to:

• Access Controls: Ensuring that only authorized personnel have access to Personal Data.
• Encryption: Encrypting Personal Data both in transit and at rest where applicable.
• Incident Response: Establishing processes to identify, evaluate, and respond to data security incidents.

Data Subject Rights

Service Provider shall assist Customer in fulfilling its obligations to respond to requests from data subjects, including rights to access, rectify, or delete Personal Data. Requests made by data subjects directly to the Service Provider shall be promptly communicated to Customer.

Data Breach Notification

In the event of a Personal Data breach affecting Customer's Personal Data, Service Provider shall notify Customer without undue delay, but no later than seventy-two (72) hours after becoming aware of the breach. The notification shall include relevant information to enable Customer to comply with its obligations under applicable Data Protection Laws.

Data Transfers

Service Provider shall not transfer Personal Data to countries outside the United States without appropriate safeguards in place, such as an equivalent legal mechanism.

Data Retention

Service Provider shall retain Personal Data for no longer than necessary to fulfill the purposes for which it was processed. Upon termination of the SaaS Agreement, Personal Data shall be deleted or returned to Customer, as described in the Agreement.

Audits and Compliance

Upon reasonable written notice, Service Provider shall make available to Customer all information necessary to demonstrate compliance with the obligations set out in this DPP and allow for audits conducted by Customer or a third party appointed by Customer, subject to reasonable confidentiality obligations.

Liability

The liability of Service Provider arising under or in connection with this DPP shall be limited to the liability caps set forth in the SaaS Agreement.

Governing Law

This DPP shall be governed by and construed in accordance with the laws applicable to the SaaS Agreement.

Miscellaneous

The DPP is part of the SaaS Agreement and shall automatically terminate upon the termination of the SaaS Agreement. Any conflicts between the DPP and other terms of the SaaS Agreement shall be resolved in favor of the DPP with respect to the processing of Personal Data.

Contact Information

For questions or concerns regarding this Data Processing Policy, users may contact the Service Provider at info@createanapi.com.