Data Processing Addendum

This addendum is part of the Terms of Service between you, the business (“you”), and Waylum Inc. (“we”). It applies when we process personal data of your signers for you, and meets the processor terms of the GDPR, UK GDPR, PIPEDA and similar laws. If it conflicts with the Terms, this addendum wins for personal data.

1. Roles

You are the controller of signers’ personal data. We are your processor. We process it only to provide Waivepad to you, following your instructions in the service and in these terms.

2. What we process

• Signers, and children they sign for.
• Names, contact details, dates of birth, addresses, emergency contacts, answers to your questions (which may include health information), drawn signatures, IP address, browser and time.
• To store, show, seal, export and email signed waivers, for as long as your account is open.

3. Our commitments

• We process signers’ data only on your instructions, unless the law requires otherwise, in which case we tell you first where allowed.
• People who can access it are bound to keep it confidential, and access is limited to what is needed to run the service.
• We protect it with encryption in transit and at rest, access controls, rate limits and a tamper-evident seal on each signature.
• We help you answer signers’ requests to access, correct or delete their data. Most of this you can do in your account.
• We tell you without undue delay, and within 72 hours of becoming aware, of a breach affecting your signers’ data, with what we know and what we are doing about it.
• We give you the information you reasonably need to show you meet your obligations, and help with impact assessments where needed.
• When your account closes, we delete signers’ data within 30 days, and backups expire within a further 30 days, unless the law requires us to keep it.

4. Subprocessors

You allow us to use these subprocessors. We will update this list at least 30 days before adding one, and you may object by closing your account if you disagree.

• Cloudflare: hosting, database and security.
• Clerk: business sign-in (no signer data).
• Resend: emailing signed copies to signers who give an email.

Each one is bound by data protection terms at least as protective as these.

5. Transfers

We are based in Canada, and some subprocessors process data in the United States and elsewhere. Where the law requires it, transfers are covered by the EU Standard Contractual Clauses, the UK Addendum or another lawful safeguard, which are incorporated here by reference.

6. Your commitments

You have a lawful basis to collect signers’ data, tell signers how you use it, and do not instruct us to process it in a way that breaks the law.

Contact

Waylum Inc., Ontario, Canada. Email hello@waivepad.com.