Data Processing Addendum

1 About this addendum

This Data Processing Addendum (the “Addendum”) forms part of the MethodData Sync For Mindbody Terms and Conditions(the “Terms”) between [FULL LEGAL ENTITY NAME], doing business as Method Data(“we,” “us,” or “our”), and the business that accepted the Terms (“you” or the “Customer”). You accept this Addendum when you accept the Terms, and no separate signature is needed.

This Addendum applies where Data Protection Law applies to our processing of Customer Personal Data when we provide MethodData Sync For Mindbody(the “App”). Capitalized words not defined here have the meaning given in the Terms.

2 Definitions

“Customer Personal Data” means personal information in Customer Data that we process on your behalf through the App.

“Data Protection Law” means the privacy and data protection laws that apply to the processing of Customer Personal Data, including where applicable the EU General Data Protection Regulation (“GDPR”), the UK GDPR, the Swiss Federal Act on Data Protection, and U.S. state privacy laws such as the California Consumer Privacy Act (“CCPA”).

“Security Incident” means a breach of our security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data held by the App.

“Standard Contractual Clauses” means the clauses annexed to European Commission Implementing Decision (EU) 2021/914.

“Subprocessor” means a third party we engage to process Customer Personal Data.

“Controller,” “processor,” “data subject,” and “processing” have the meanings given in the GDPR. “Business” and “service provider” have the meanings given in the CCPA.

3 Roles and scope

You are the controller (or business) of Customer Personal Data, or a processor acting for another controller. We are your processor (or service provider). Annex 1 describes the processing.

This Addendum does not apply to information we process as a controller to manage our relationship with you, such as account, billing, and support information. HubSpot, Mindbody, and Stripe provide their services to you under your own agreements with them and are not our Subprocessors.

4 Our obligations

We will:

• Process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this Addendum, and the settings and mappings you configure in the App.
• Tell you if we believe an instruction breaks Data Protection Law, or if a law requires us to process Customer Personal Data in another way, unless that law prohibits us from telling you.
• Ensure that our personnel who can access Customer Personal Data are bound by confidentiality obligations.
• Maintain the security measures described in Annex 2. We may update them, provided the overall level of protection does not materially decrease.
• Refer to you any request we receive from an individual about Customer Personal Data, and give you reasonable help to respond where you cannot do so yourself through the App or your connected accounts.
• Give you reasonable help with data protection impact assessments and consultations with regulators that Data Protection Law requires of you.

5 Your obligations

You are responsible for your own compliance with Data Protection Law, including having a lawful basis for the processing, giving any required notices, and obtaining any required consents. You confirm that your instructions comply with Data Protection Law, and you will not use the App to process the categories of information that section 4 of the Terms prohibits.

6 Subprocessors

You give us general authorization to engage Subprocessors. Our current Subprocessors are listed in Annex 3. We require each one in writing to protect Customer Personal Data to a standard no less protective than this Addendum, and we remain responsible to you for its performance.

We will give you at least 15 days’ notice by email before adding or replacing a Subprocessor. You may object in writing within that period on reasonable data protection grounds. If we cannot resolve your objection, your only remedy is to cancel your subscription under section 5 of the Terms before the change takes effect.

7 Security incidents

We will notify you without undue delay after we become aware of a Security Incident, give you the information we reasonably have about what happened and the steps we are taking, and take reasonable steps to contain and investigate it. Our notification is not an admission of fault or liability. You are responsible for any notices to regulators or individuals that Data Protection Law requires of you.

8 International transfers

We process Customer Personal Data in the United States and in the locations listed in Annex 3. Where Data Protection Law requires a transfer mechanism for Customer Personal Data that you transfer to us, the following apply and are incorporated into this Addendum. Accepting the Terms counts as signing them.

European Economic Area. The Standard Contractual Clauses apply, with you as data exporter and us as data importer. Module Two applies where you are a controller, and Module Three applies where you are a processor. For those clauses:

• Clause 7 (docking clause) and the optional wording in Clause 11 do not apply.
• Clause 9 uses Option 2 (general written authorization), with the notice period in section 6 of this Addendum.
• Clause 17 uses Option 1 with the law of Ireland, and under Clause 18 the courts of Ireland resolve disputes.
• Annexes I, II, and III of the clauses are completed by Annexes 1, 2, and 3 of this Addendum. The competent supervisory authority is determined under Clause 13.

United Kingdom. The UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, applies. Its tables are completed with the information in this Addendum and its Annexes, and either party may end it as set out in its Section 19.

Switzerland. The Standard Contractual Clauses apply as adapted for Swiss law. References to the GDPR mean the Swiss Federal Act on Data Protection, references to a member state include Switzerland, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

9 U.S. state privacy laws

Where U.S. state privacy laws apply, we act as your service provider or processor and process Customer Personal Data only for the business purpose of providing the App. We will not sell it, share it for cross-context behavioral advertising, keep, use, or disclose it outside our direct business relationship with you, or combine it with personal information from other sources, except as those laws allow. We will tell you if we can no longer meet our obligations under those laws, and you may then take reasonable steps to stop and remedy any unauthorized use.

10 Demonstrating compliance

On written request, and no more than once in any 12 months, we will give you the information reasonably needed to show that we comply with this Addendum, including written answers to a reasonable security questionnaire. You may carry out an on-site audit only where Data Protection Law or a regulator requires it, or after a Security Incident that affected your Customer Personal Data. You must give at least 30 days’ written notice, agree the scope with us in advance, keep the results confidential, and pay your own costs and our reasonable costs.

11 Return and deletion

You can obtain Customer Personal Data from your connected HubSpot and Mindbody accounts at any time. You can delete Customer Personal Data held by the App at any time with Delete my data in the App’s Settings, which deletes it immediately. If you uninstall the App, we delete Customer Personal Data held by the App seven days after we detect the uninstall.

After termination, we act on export and deletion requests as section 10 of the Terms describes, and we delete Customer Personal Data held by the App within 30 days after you ask us to, and in any case within 90 days after termination. Copies in backups are overwritten on our normal backup cycle. We may keep Customer Personal Data longer only where the law requires it, and this Addendum continues to protect it while we do.

12 Liability and general terms

Each party’s liability under this Addendum, including under the Standard Contractual Clauses as between the parties, is subject to the exclusions and limits in section 12 of the Terms. Nothing in this Addendum limits a data subject’s rights under the Standard Contractual Clauses or Data Protection Law.

This Addendum lasts for as long as we process Customer Personal Data on your behalf. If it conflicts with the Terms on a data protection matter, this Addendum prevails, and if the Standard Contractual Clauses conflict with either, the Standard Contractual Clauses prevail. Except as the Standard Contractual Clauses require, this Addendum is governed by the law and courts stated in section 14 of the Terms. We may update this Addendum in the way the Terms describe for changes to the Terms.

Annex 1: Details of the processing

Annex 2: Security measures

• Encryption at rest of connection secrets, including OAuth tokens, API keys, staff passwords, authentication tokens, and webhook signature keys.
• Encryption of data in transit between the App, its providers, and the connected platforms using TLS.
• Logical separation of each Customer’s data within the App.
• Hosting with established cloud providers that maintain their own physical and environmental security.

Annex 3: Subprocessors