Data Processing Addendum

01Scope and parties

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Finowl Inc. ("Finowl") and the customer that has accepted them ("Customer"). It applies whenever Finowl processes Customer Personal Data on Customer's behalf in providing the Services, and it takes effect automatically when Customer accepts the Terms. No signature is required.

If there is a conflict between this DPA and the Terms, this DPA controls with respect to the processing of Customer Personal Data. If there is a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses control.

02Definitions

"Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Terms, including the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
"Customer Personal Data" means personal data contained in the inputs Customer submits to the API.
"Sub-processor" means a third party engaged by Finowl that processes Customer Personal Data.
"Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
"Controller", "processor", "data subject", "personal data", "processing", "service provider" and "supervisory authority" have the meanings given in Data Protection Laws.

03Roles of the parties

Customer is the controller, or a processor acting on behalf of a third-party controller, of Customer Personal Data. Finowl is a processor, or sub-processor, and a service provider under the CCPA. Finowl processes account and billing information about Customer and its personnel as an independent controller under its Privacy Policy, and that processing is outside the scope of this DPA.

Customer is responsible for the lawfulness of the processing, for providing any required notices and obtaining any required consents, and for ensuring that its instructions comply with Data Protection Laws.

04Details of the processing

Subject matter	Providing breach checks and gender predictions through the Finowl API.
Duration	For the term of the Terms. Each item of Customer Personal Data is processed only for the duration of the API request that contains it.
Nature and purpose	Receiving inputs, performing lookups and computations, and returning results to Customer.
Categories of data subjects	Customer's end users, customers, prospects, contacts and personnel whose data Customer chooses to submit.
Categories of personal data	Email addresses, names, usernames and passwords, as submitted by Customer, and the results derived from them, such as breach records and gender estimates.
Special categories	None intended. Customer must not submit special category data.
Frequency	Continuous, as determined by Customer's API requests.

05Processing on instructions

Finowl will process Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA and Customer's use of the API, unless processing is required by law. In that case Finowl will inform Customer before processing unless the law prohibits it. Finowl will tell Customer if it believes an instruction infringes Data Protection Laws.

As a service provider under the CCPA, Finowl will not sell or share Customer Personal Data, retain, use or disclose it for any purpose other than providing the Services, retain, use or disclose it outside the direct business relationship with Customer, or combine it with personal information from other sources except as permitted by the CCPA.

06Transient processing and deletion

Finowl processes Customer Personal Data transiently. Inputs and results are held in memory only for as long as needed to complete the request and are not written to Finowl's databases or logs. Passwords are hashed in memory and matched using a partial hash. Finowl retains only usage metadata, such as the endpoint, time, status and credits consumed, which does not contain the inputs or results.

Because Customer Personal Data is not retained after each response, no return or deletion is required on termination. Any residual data held by Sub-processors is deleted in accordance with their contractual obligations.

07Confidentiality

Finowl ensures that personnel authorized to access Customer Personal Data are bound by appropriate obligations of confidentiality and access it only as needed to provide, secure or support the Services.

08Security measures

Finowl implements and maintains appropriate technical and organizational measures to protect Customer Personal Data, including:

encryption of data in transit with TLS;
transient, in-memory processing of API inputs, with no storage of request or response contents;
hashing of passwords submitted for checks before any lookup, and use of a partial hash only;
storage of API keys, session tokens and sign-in links only as cryptographic hashes;
authentication of every API request and isolation of each customer's keys, usage and balance;
rate limiting and abuse controls;
least-privilege access to production systems and separation of internal services with dedicated credentials; and
regular backups of account data with automatic rotation.

Finowl may update these measures over time, provided the overall level of protection is not reduced.

09Sub-processors

Customer gives Finowl general authorization to engage Sub-processors, including infrastructure and hosting providers and data intelligence partners that perform parts of a lookup. Finowl will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA, and remains responsible for each Sub-processor's performance.

Finowl will make its current list of Sub-processors available to Customer on request, subject to confidentiality, at support@finowl.co. Finowl will notify Customer of any new Sub-processor at least 14 days before it begins processing Customer Personal Data, if Customer has asked to receive these notifications. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, Customer may stop using the affected Services and terminate the Terms as its sole remedy.

10Data subject requests and assistance

Taking into account the nature of the processing, Finowl will assist Customer with appropriate measures to respond to requests from data subjects exercising their rights. If Finowl receives a request directly, it will not respond except to direct the data subject to Customer, unless required by law. Because Finowl does not retain Customer Personal Data, most requests can be addressed by Customer from its own records.

Finowl will provide reasonable assistance with data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Data Protection Laws and relating to Finowl's processing.

11Security incidents

Finowl will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notification will describe, to the extent known, the nature of the incident, the likely consequences and the measures taken or proposed. Finowl will take reasonable steps to contain and remediate the incident. Notification is not an acknowledgment of fault.

12Audits

On written request, and no more than once a year unless required by a supervisory authority or following a Security Incident, Finowl will provide information reasonably necessary to demonstrate compliance with this DPA, such as written responses to security questionnaires. If that information is not sufficient to meet Customer's obligations under Data Protection Laws, the parties will agree in good faith on the scope, timing and cost of any further audit, which will be conducted with reasonable notice, during business hours and subject to confidentiality.

13International transfers

Finowl may process Customer Personal Data in the United States and other countries where Finowl or its Sub-processors operate. To the extent Customer Personal Data originating in the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties agree that:

the Standard Contractual Clauses approved by European Commission Implementing Decision (EU) 2021/914 are incorporated by reference, using Module Two (controller to processor) or Module Three (processor to processor) as applicable, with Clause 7 included, Option 2 of Clause 9 with the notice period in this DPA, the optional language in Clause 11 omitted, and Ireland as the governing law and forum under Clauses 17 and 18;
for transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner applies, and either party may end it as permitted by its Section 19; and
for transfers from Switzerland, references to the GDPR are read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

The information required by the annexes to the Standard Contractual Clauses is set out in this DPA, including the details of processing and security measures above.

14Liability and term

Each party's liability arising out of or relating to this DPA is subject to the limitations of liability in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow it. This DPA remains in effect for as long as Finowl processes Customer Personal Data under the Terms.

15Contact

For questions about this DPA, to request the Sub-processor list or to subscribe to Sub-processor notifications, contact support@finowl.co.