Data Processing Addendum

You are the controller of personal data you submit; Warm Winter is the processor acting on your documented instructions. Terms such as “personal data,” “processing,” “controller,” and “processor” have the meaning under applicable law (including, as applicable, the GDPR/UK GDPR and U.S. state privacy laws such as the CCPA/CPRA — under which Warm Winter is a “service provider” and does not “sell” or “share” personal data). This Addendum applies only to personal data within Customer Data; the details are in Annex A.

We process personal data only to provide, secure, and support the Service, as described in the Business Terms and Annex A, and on your documented lawful instructions. We will not process it for our own independent purposes and will not sell or share it. Any use to improve the Service beyond your instance is limited to aggregated and/or de-identified data that is not personal data.

We ensure personnel authorized to process personal data are bound by appropriate confidentiality obligations.

We implement and maintain commercially reasonable technical and organizational measures appropriate to the risk, designed to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access. A current summary is available on request.

You authorize us to engage subprocessors (e.g. cloud hosting and infrastructure) under data protection obligations no less protective than this Addendum; we remain responsible for their performance. We will make the current list available on request and give notice of new ones, with a reasonable opportunity to object on reasonable data protection grounds.

Taking into account the nature of the processing, we will provide reasonable assistance to help you respond to data subject requests. If we receive such a request directly, we will — unless legally prohibited — direct the person to you.

We will notify you without undue delay after becoming aware of a personal data breach affecting your personal data, and provide information reasonably available to help you meet your notification obligations.

On termination or your written request, we will delete or return personal data within a reasonable period, except aggregated/de-identified data that is no longer personal data and copies required to be retained by law (which remain subject to this Addendum).

We will make available information reasonably necessary to demonstrate compliance and, on reasonable prior notice and no more than once per year (absent a legal requirement or a breach), allow you or a mutually agreed auditor to verify compliance, subject to confidentiality and without disrupting operations.

If personal data is transferred across borders in a way that requires a lawful transfer mechanism, the parties will reasonably cooperate to put one in place (e.g. Standard Contractual Clauses), which is incorporated by reference when applicable.

This Addendum is governed by the same law and limited by the same liability provisions as the Business Terms, including the limitation of liability in Section 8 of those Terms. It takes effect on the later of the Business Terms’ effective date and the date both parties sign. Notices to us go to ricovigil1@gmail.com.