HaloSuite Data Processing Addendum

Version 1.0. Effective Not yet effective — draft awaiting launch date.

This addendum ("DPA") is part of the HaloSuite Terms of Service between HaloSuite, a trade name of its operator, whose identity is kept on record and given where the law requires ("HaloSuite", "we") and the business that uses HaloSuite ("Customer", "you"). It applies when HaloSuite processes Customer Personal Data. If this DPA and the Terms disagree about Customer Personal Data, this DPA wins.

1. Definitions

• Customer Personal Data: personal information about people other than your HaloSuite users that you or your team put into HaloSuite, or that HaloSuite collects for you, for example your leads, customers and contacts, people who book through your booking page or fill in your forms, and people you email or text.
• Data Protection Law: every privacy and data protection law that applies to that data, including the EU and UK GDPR and US state privacy laws such as the California Consumer Privacy Act (CCPA).
• "Controller", "processor", "business", "service provider", "personal data breach" and similar terms mean what Data Protection Law says.

2. Roles

You are the controller (the "business") of Customer Personal Data. We are your processor (your "service provider"). We process it only to provide HaloSuite to you, as described in the Terms, this DPA and the settings and instructions you give in the app.

Details of the processing

• Subject matter and duration: providing HaloSuite, for as long as you use it and until the data is deleted under section 9.
• Nature and purpose: storing, organizing, analyzing and transmitting data to run the CRM, scheduling, messaging, content, website and automation features you use, including generating drafts with the AI provider you connect.
• People concerned: your leads, customers, contacts, website and booking-page visitors, and message recipients.
• Kinds of data: contact details (names, email addresses, phone numbers, postal addresses), company and role, communication history and message content, appointment details, notes, consent and opt-out records, invoices and payment status, and any other data you choose to put in. You agree not to put special categories of data (such as health data) into HaloSuite unless a feature is built for it.

3. Our duties

We will:

• process Customer Personal Data only on your documented instructions (the Terms, this DPA and your use of the app), unless the law requires otherwise, in which case we tell you first unless the law forbids it; and tell you if we believe an instruction breaks Data Protection Law;
• make sure everyone who can access it is bound by confidentiality;
• keep it secure with appropriate technical and organizational measures, including encrypted connections, encryption of stored credentials, two-factor authentication for accounts, separation between workspaces, approval steps before anything is sent, and activity logs;
• help you, as far as reasonably possible, to answer requests from people exercising their privacy rights, and with security, breach notification, data protection impact assessments and consultations with regulators, to the extent they relate to our processing;
• tell you without undue delay, and where possible within 72 hours, after we become aware of a personal data breach affecting Customer Personal Data, with the information you reasonably need to meet your own obligations;
• give you the information reasonably needed to show that we meet this DPA, for example by answering a reasonable written security questionnaire once a year.

4. US state privacy law (CCPA) terms

We will not: sell or share Customer Personal Data (as those words are defined in the CCPA); keep, use or disclose it for any purpose other than providing HaloSuite to you, or outside our direct business relationship with you; or combine it with personal information we receive from others, except as Data Protection Law allows for service providers. We will comply with the CCPA's obligations for service providers, give the same level of privacy protection the CCPA requires, and tell you if we can no longer meet them. You may take reasonable steps to stop and fix unauthorized use. We certify that we understand these restrictions.

5. Subprocessors

You authorize us to use the subprocessors listed at https://halosuite.ai/legal/subprocessors. We will bind each of them by written contract to data protection obligations at least as protective as this DPA, and we remain responsible for them. We will update that list at least 14 days before adding or replacing a subprocessor. If you object on reasonable data protection grounds, tell us within that time; we will try to address the concern, and if we cannot, you may stop using the affected feature or end your use of HaloSuite.

6. Services you connect are yours

The AI provider whose key you connect, and services such as Google, Meta, LinkedIn, X, QuickBooks and your own Twilio account, are your providers under your own agreements with them. When HaloSuite sends Customer Personal Data to them, it does so on your instruction. They are not our subprocessors, and you are responsible for your agreements with them.

7. Your duties

You confirm that:

• you have a lawful basis, and have given every notice and obtained every consent required, for us to process Customer Personal Data as you instruct, including consent before texting anyone and before sending marketing email where the law requires it;
• your own privacy policy tells people that you use service providers such as HaloSuite, and, if you text people, that you do not share their mobile numbers or text-message consent with third parties for marketing;
• if you add analytics or advertising tags to pages you publish with HaloSuite, you inform visitors and obtain the consent the law requires; and
• your instructions to us comply with Data Protection Law.

8. International transfers

HaloSuite runs on servers operated by our hosting provider (see the subprocessor list), and our staff, contractors and subprocessors may process Customer Personal Data in other countries. Where Data Protection Law requires a transfer mechanism for Customer Personal Data from the EU, EEA, UK or Switzerland, the European Commission's Standard Contractual Clauses (controller-to-processor or processor-to-processor module, as applicable), with the UK Addendum where relevant, apply and are incorporated by reference, with HaloSuite as data importer. For the Clauses, the governing law and courts are those of Ireland, and the annex information is in section 2 and section 3 of this DPA.

9. Deletion at the end

When you delete your workspace, we delete Customer Personal Data after the 30-day period in which you can change your mind, and deleted data leaves our backups as they are overwritten. We may keep data only where the law requires it, and this DPA keeps applying to it while we hold it. Before deleting, you can export what you need; if a feature you need for export is not yet available in the app, email hello@halosuite.ai and we will help.

10. Liability and term

This DPA lasts as long as we process Customer Personal Data for you. Each party's liability under this DPA is subject to the limits in the Terms, to the extent Data Protection Law allows.

Questions: hello@halosuite.ai.