Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between PeakKR ("Processor", "PeakKR") and the customer ("Controller", "you"). It applies when PeakKR processes personal data on your behalf as part of Customer Data. It takes effect automatically when you accept the Terms; email privacy@peakkr.com if you need a countersigned copy.

1. Roles and scope

You're the controller of personal data in Customer Data (for example, contact details of your team and your clients, and data from accounts you connect). PeakKR is the processor and processes it only to provide PeakKR under the Terms and your documented instructions, which are the Terms, this DPA and your use and configuration of the service.

2. Details of processing

• Subject matter and duration: providing PeakKR for the length of your subscription, plus the deletion period below.
• Nature and purpose: hosting, storing, displaying, analyzing and transmitting Customer Data, including through AI features you choose to use.
• Data subjects: your users, your clients and their contacts, and people in data you import or connect.
• Personal data: names, business contact details, messages and content, usage data, and website or search analytics you connect. You shouldn't upload sensitive categories of data (such as health or financial account data).

3. Processor obligations

• Process personal data only on your documented instructions, and tell you if we believe an instruction breaks data protection law.
• Ensure people with access are bound by confidentiality.
• Keep appropriate technical and organizational security measures, including encryption in transit, hashed passwords, workspace separation and limited production access.
• Help you, taking into account the nature of processing, respond to data subject requests and meet your security, breach-notification and impact-assessment obligations.
• Notify you without undue delay, and where feasible within 72 hours, after becoming aware of a personal data breach affecting your data.
• Make available information reasonably needed to show compliance with this DPA, and allow reasonable audits on 30 days' notice, no more than once a year, at your cost.

4. Subprocessors

You authorize PeakKR to use the subprocessors below. We impose data protection terms on each that are no less protective than this DPA and remain responsible for their performance. We'll give at least 14 days' notice of a new subprocessor by updating this page and emailing account owners; you may object on reasonable data protection grounds, and if we can't address the objection you may cancel without penalty.

5. International transfers

PeakKR is operated from the United States. Where personal data from the European Economic Area, the United Kingdom or Switzerland is transferred, the parties rely on the European Commission's Standard Contractual Clauses (Module 2, controller to processor, and Module 3 where applicable) and the UK Addendum, which are incorporated by reference. In them, you are the data exporter and PeakKR the importer, the governing law and courts are those of Ireland, and the descriptions in section 2 and the measures in section 3 complete the annexes.

6. Deletion and return

You can export your data while your account is active. After your account closes, PeakKR deletes Customer Data within 90 days, unless the law requires it to keep some of it, in which case it stays protected under this DPA.

7. CCPA

For California personal information, PeakKR acts as a service provider: it won't sell or share it, retain, use or disclose it outside the direct business relationship with you, or combine it with other data except as the CCPA allows.

8. Order of precedence

If this DPA conflicts with the Terms about personal data, this DPA prevails; if the Standard Contractual Clauses apply, they prevail over both.

Contact

PeakKR · privacy@peakkr.com