Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the agreement between Maxint Inc. ("Maxint") and the business customer ("Customer") for Maxint Work or Orca (the "Agreement"), which consists of our Terms of Service, the applicable Product Terms and any order form. It applies when Maxint processes Customer Personal Data on the Customer’s behalf. If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data. A countersigned copy is available on request from legal@maxint.com.
1. Definitions
- Customer Personal Data: personal data or personal information that Maxint processes on behalf of the Customer in providing Maxint Work or Orca, as described in Annex I.
- Data Protection Laws: laws that apply to the processing of Customer Personal Data, which may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act ("CCPA") and other US state privacy laws.
- Security Incident: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Standard Contractual Clauses: the clauses annexed to European Commission Implementing Decision (EU) 2021/914.
- Terms such as "controller", "processor", "data subject", "personal data", "processing", "business", "service provider" and "sell" or "share" have the meanings given in the Data Protection Laws.
2. Roles and instructions
The Customer is the controller (or business) and Maxint is the processor (or service provider) of Customer Personal Data. Maxint will process Customer Personal Data only on the Customer’s documented instructions, which are the Agreement, this DPA and the Customer’s use and configuration of the service, unless required otherwise by law, in which case Maxint will tell the Customer before processing unless the law prohibits it. Maxint will tell the Customer if it believes an instruction infringes Data Protection Laws. The Customer is responsible for having a lawful basis for the processing and for providing any notices and obtaining any consents required.
3. Confidentiality
Maxint will ensure that people authorized to process Customer Personal Data are bound by obligations of confidentiality and access it only as needed to provide the service.
4. Security
Maxint will implement and maintain the technical and organizational measures described in Annex II, which are designed to protect Customer Personal Data against Security Incidents. Maxint may update these measures provided it does not materially reduce the overall level of protection.
5. Subprocessors
The Customer gives Maxint general authorization to engage subprocessors. Our current subprocessors are listed on our subprocessors page. Maxint will give at least 30 days’ notice of a new subprocessor by updating that page and notifying Customers who subscribe to updates. The Customer may object on reasonable data protection grounds within that period; the parties will discuss the objection in good faith, and if it cannot be resolved, the Customer may terminate the affected service and receive a refund of prepaid fees for the unused period. Maxint will impose data protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for its subprocessors’ performance.
6. Assistance
Taking into account the nature of the processing, Maxint will assist the Customer, through the service’s features or otherwise, in responding to requests from data subjects to exercise their rights, and with data protection impact assessments and consultations with supervisory authorities where required. If Maxint receives a request directly from a data subject about Customer Personal Data, it will refer the data subject to the Customer.
7. Security Incidents
Maxint will notify the Customer without undue delay after becoming aware of a Security Incident, and will provide information the Customer reasonably needs to meet its own obligations, as it becomes available. Maxint will take reasonable steps to contain and remediate the Security Incident. Notification is not an acknowledgment of fault or liability.
8. Deletion and return
During the term, the Customer can export Customer Personal Data using the service. After the Agreement ends, Maxint will delete Customer Personal Data within 30 days, except where the law requires Maxint to keep it, in which case Maxint will protect it and process it only for that purpose. Deleted data may remain in encrypted backups until they are overwritten in the ordinary course.
9. Audits
Maxint maintains a SOC 2 Type II report from an independent auditor; the services in its scope are shown in the Maxint trust center. On request, and subject to confidentiality, Maxint will provide its most recent SOC 2 report and reasonable answers to security questionnaires. Where the Customer reasonably needs more to demonstrate compliance with Data Protection Laws, or a supervisory authority requires it, the Customer may conduct an audit on at least 30 days’ notice, no more than once a year, during business hours, at its own cost, and in a way that does not compromise other customers’ data.
10. International transfers
Maxint processes Customer Personal Data in the United States, and its subprocessors may process it in other countries. To the extent the Customer’s transfer of Customer Personal Data to Maxint is a restricted transfer under the GDPR, the UK GDPR or Swiss law, the parties agree that:
- for transfers subject to the GDPR, Module Two (controller to processor) of the Standard Contractual Clauses applies, and Module Three (processor to processor) applies where the Customer is itself a processor. Clause 7 (docking) applies; under clause 9, option 2 (general authorization) applies with the notice period in section 5 of this DPA; the optional language in clause 11 does not apply; under clauses 17 and 18, the clauses are governed by and disputes resolved in the courts of Ireland; and Annexes I and II of this DPA complete the clauses’ annexes;
- for transfers subject to the UK GDPR, the clauses apply as amended by the UK Information Commissioner’s International Data Transfer Addendum, version B1.0, with the tables completed by this DPA, and either party may end the Addendum as set out in its section 19;
- for transfers subject to Swiss law, the clauses apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
If the Standard Contractual Clauses conflict with this DPA, the Standard Contractual Clauses control.
11. US state privacy laws
Where the CCPA or similar US state laws apply, Maxint will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than providing the service under the Agreement, or outside the direct business relationship with the Customer, except as those laws permit; will not combine it with personal information Maxint receives from other sources, except as those laws permit; will comply with those laws and provide the same level of privacy protection they require; will notify the Customer if it can no longer meet its obligations under them; and allows the Customer to take reasonable steps to stop and remediate unauthorized use. Maxint certifies that it understands and will comply with these restrictions.
12. Liability
Each party’s liability under this DPA is subject to the limitations of liability in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not allow it.
Annex I: Details of processing
| Maxint Work | Orca | |
|---|---|---|
| Parties | Data exporter: the Customer (controller, or processor under Module Three). Data importer: Maxint Inc., 1875 Mission St, Ste 103 #180, San Francisco, CA 94103, United States, privacy@maxint.com (processor). | |
| Data subjects | The Customer’s administrators and users, and people mentioned in Customer Content | End users of the Customer’s apps |
| Categories of personal data | Names, email addresses, account and profile details; messages, documents, tasks, files and other Customer Content; usage and log data | App user IDs set by the Customer; purchase receipts, transaction and product IDs and timestamps; general device information; paywall test data |
| Sensitive data | None intended. The Customer should not put special categories of data into the service unless needed and lawful, and is responsible for doing so. | |
| Frequency | Continuous, for the term of the Agreement | |
| Nature and purpose | Hosting, storing and displaying Customer Content; collaboration features; search; AI features the Customer enables; integrations the Customer authorizes; support | Validating purchases, maintaining entitlement states and transaction history, analytics and paywall testing, support |
| Retention | For the term of the Agreement, then deleted as described in section 8 | |
| Supervisory authority | The supervisory authority determined under clause 13 of the Standard Contractual Clauses | |
Annex II: Technical and organizational measures
- Encryption of data in transit with TLS 1.3 and at rest with AES-256.
- Passkey sign-in for users and single sign-on options for Customers; hardware security keys, role-based access and logging for internal access to production systems.
- Logical separation of each Customer’s data.
- Network protection, including DDoS mitigation, automated monitoring, anomaly detection and regular vulnerability scanning.
- Replication, backups and tested recovery.
- An incident response process.
- Confidentiality obligations for personnel with access to Customer Personal Data.
- Due diligence and contractual data protection obligations for subprocessors.
- Independent examination under SOC 2 Type II, for the services in the report’s scope.