Data Processing Addendum

This addendum sets the rules for how FaxToFax handles personal data contained in the faxes and other content you put into FaxToFax. It is required by Article 28 of the GDPR and similar laws. In short: we process that data only on your instructions; we keep it secure; we use only the subprocessors listed on our website and give you 30 days' notice of new ones; we tell you about a personal data breach within 72 hours; we help you respond to requests from individuals; and we delete the data when our service ends. It forms part of our Terms of Service automatically, so there is nothing extra to sign.

1. Scope and parties

This Data Processing Addendum ("DPA") is between the customer that has accepted the FaxToFax Terms of Service ("Customer" or "you") and FaxToFax.com ("FaxToFax", "we" or "us"). It applies whenever we process Customer Personal Data in providing the Service and Data Protection Laws apply to that processing. It forms part of the Terms and takes effect when you accept them. If you need a countersigned copy, email privacy@faxtofax.com.

2. Definitions

• "Data Protection Laws" means all laws on data protection and privacy that apply to the processing of Customer Personal Data under the Terms, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act and other U.S. state privacy laws, Canada's PIPEDA and Ontario's Personal Health Information Protection Act (PHIPA).
• "Customer Personal Data" means personal data contained in Customer Data (as defined in the Terms) that we process on your behalf.
• "SCCs" means the standard contractual clauses annexed to European Commission Implementing Decision (EU) 2021/914.
• "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
• "Subprocessor" means a third party we engage to process Customer Personal Data.
• "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the GDPR, and equivalent terms in other Data Protection Laws have corresponding meanings.

3. Roles and instructions

• You are the controller of Customer Personal Data, or a processor acting for your own clients. We are your processor, or your subprocessor where you are a processor.
• We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, your use and configuration of the Service (including the retention period you choose and any deletions you make), and any other written instructions we agree with you.
• We will tell you if, in our opinion, an instruction infringes Data Protection Laws. If the law requires us to process Customer Personal Data in another way, we will tell you before doing so unless the law prohibits it.
• You are responsible for the lawfulness of your instructions and of the processing, including having a legal basis for it and giving any required notices to data subjects.
• The details of the processing are set out in Annex 1.

4. Confidentiality

We ensure that people authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality and have access only where needed for the purposes in this DPA.

5. Security

We implement the technical and organizational measures described in Annex 2, which are designed to provide a level of security appropriate to the risk, as required by Article 32 of the GDPR. We may update these measures over time, provided that the overall level of protection is not reduced.

6. Subprocessors

• You give us general authorization to use the Subprocessors listed in Annex 3.
• We will give you at least 30 days' notice before adding or replacing a Subprocessor, by email to the account owner and by updating Annex 3.
• You may object to a new Subprocessor on reasonable data protection grounds by emailing privacy@faxtofax.com within the notice period. We will discuss your concerns in good faith. If we cannot reasonably address them, you may cancel your subscription before the change takes effect; this is your sole remedy for the objection.
• We impose on each Subprocessor, by written contract, data protection obligations that are no less protective than those in this DPA, and we remain responsible to you for each Subprocessor's performance of those obligations.

7. Data subject requests

The Service lets you find, export and delete Customer Personal Data and set retention periods, which you can use to respond to requests from data subjects. If we receive a request directly from a data subject about Customer Personal Data, we will not respond to it ourselves except to direct the person to you, and we will forward it to you promptly. Taking into account the nature of the processing, we will give you reasonable help, through appropriate technical and organizational measures, to respond to requests to exercise data subject rights.

8. Assistance with compliance

Taking into account the nature of the processing and the information available to us, we will give you reasonable help to meet your obligations under Articles 32 to 36 of the GDPR (and equivalent provisions of other Data Protection Laws), including on security, personal data breach notification, data protection impact assessments and prior consultation with supervisory authorities.

9. Personal data breaches

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. To the extent available, our notice will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and limit its effects. Where we cannot provide all of this information at once, we will provide it in phases as it becomes available. We will send the notice to the account owner's email address. Notifying you of a breach is not an admission of fault or liability.

10. Return and deletion

When the Service ends, you may export Customer Personal Data using the Service, and we will delete it as described in the Terms: when the account is closed, or when stored faxes reach the end of your retention period. Deleted data may remain in encrypted backups for up to 30 days before being overwritten, and stays protected by this DPA until then. We may keep Customer Personal Data where the law requires it, and will continue to protect it under this DPA.

11. Audits and information

We will make available to you the information reasonably needed to demonstrate our compliance with Article 28 of the GDPR, including this DPA, our Security Overview and answers to reasonable security questionnaires. If that information is not enough to show our compliance, or a supervisory authority requires it, we will allow an audit by you or an independent auditor you appoint, provided that: you give at least 30 days' written notice; the audit takes place no more than once in any 12 months (unless there has been a personal data breach or a supervisory authority requires otherwise); the auditor is bound by confidentiality; the audit takes place during normal business hours without unreasonably disrupting our operations or putting other customers' data or our security at risk; and you bear the audit costs.

12. International transfers

Our Subprocessors process data in the United States and elsewhere, as shown in Annex 3.

12.1 Transfers from the European Economic Area

Where Customer Personal Data subject to the GDPR is transferred to us, or by us to a Subprocessor, in a country that is not covered by an adequacy decision, the SCCs are incorporated into this DPA by reference and apply as follows:

• Module Two (controller to processor) applies where you are a controller, and Module Three (processor to processor) applies where you are a processor. You are the data exporter and FaxToFax is the data importer.
• Clause 7 (docking clause) applies.
• Clause 9(a): Option 2 (general written authorization) applies, with the notice period set out in section 6 of this DPA.
• Clause 11(a): the optional language does not apply.
• Clause 13: the competent supervisory authority is determined in accordance with Clause 13(a).
• Clause 17: the SCCs are governed by the law of Ireland.
• Clause 18(b): disputes are resolved before the courts of Ireland.
• Annexes I and II of the SCCs are completed with Annexes 1 and 2 of this DPA, and Annex III with Annex 3 of this DPA.

12.2 Transfers from the United Kingdom

Where Customer Personal Data subject to the UK GDPR is transferred to a country not covered by UK adequacy regulations, the UK Addendum is incorporated into this DPA and completed with the information in this DPA and its annexes.

12.3 Transfers from Switzerland

Where the FADP applies, the SCCs apply with the necessary adaptations: references to the GDPR include the FADP, the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority, and data subjects in Switzerland may bring claims in their place of habitual residence.

12.4 Onward transfers and other laws

When we transfer Customer Personal Data to a Subprocessor outside the data's country of origin, we use the SCCs or another valid transfer mechanism, such as the EU-U.S. Data Privacy Framework where the Subprocessor is certified under it. Where other Data Protection Laws, such as PIPEDA, apply to cross-border transfers, we take the steps those laws require. If the SCCs conflict with this DPA or the Terms, the SCCs prevail.

13. U.S. state privacy laws

Where the California Consumer Privacy Act or a similar U.S. state law applies, we act as your service provider or processor. We will not sell or share Customer Personal Data; will not retain, use or disclose it for any purpose other than the business purposes set out in the Terms, or outside our direct business relationship with you; and will not combine it with personal information we receive from others, except as those laws allow. We will comply with the obligations that apply to us under those laws, provide the same level of privacy protection they require, and tell you if we can no longer meet our obligations. You may take reasonable steps to stop and remedy any unauthorized use of Customer Personal Data. We certify that we understand and will comply with these restrictions.

14. Health information

Protected health information governed by HIPAA is also subject to our Business Associate Agreement once you have signed it. Where both documents apply to the same data, each applies, and the more protective requirement governs.

15. Liability, duration and precedence

Each party's liability under this DPA is subject to the limitations in the Terms, except where the SCCs or Data Protection Laws do not allow this. This DPA lasts for as long as we process Customer Personal Data. If this DPA conflicts with the Terms, this DPA prevails with respect to Customer Personal Data.

Annex 1: Details of the processing

Annex 2: Technical and organizational security measures

• Sign-in and access: email one-time-code sign-in with no passwords; optional time-based two-step verification, which account owners can require for their team; automatic sign-out after 15, 30 or 60 minutes of inactivity, as configured by the Customer; owner, admin, member and viewer roles.
• Encryption: data in transit protected with TLS 1.2 or higher and HTTP Strict Transport Security; fax documents encrypted at rest with AES-256 in Cloudflare R2 storage.
• Logging: an append-only audit log of views, downloads, sends and settings changes, which the Customer can export to CSV.
• Integrity: a SHA-256 fingerprint stored for each fax.
• Minimizing copies: our fax provider is instructed not to store outbound fax documents, and inbound documents are deleted from the provider after we copy them to our storage. New-fax alerts never contain document contents.
• Retention and deletion: Customer-set retention periods with automatic purge; data export; account closure that deletes fax documents and personal data.
• Personnel access: access to production systems limited to authorized personnel using two-step verification.
• Payments: card data handled by Stripe, a PCI DSS Level 1 processor; we never store full card numbers.
• Subprocessor management: written contracts with each Subprocessor, and business associate agreements in place before any Subprocessor processes protected health information.
• Incident response: personal data breach notification to Customers within 72 hours of becoming aware, and a Vulnerability Disclosure policy for security researchers.

Annex 3: Subprocessors

These are the Subprocessors that may process Customer Personal Data. Each is bound by a written contract that requires it to protect the data and use it only to provide its service to us.

The carrier's legal name and contract details are available to customers on request at privacy@faxtofax.com. We will have a business associate agreement in place with each Subprocessor that handles protected health information before it processes any.

When a fax travels to or from an external fax machine, it also passes over the public telephone network and arrives at equipment chosen by the recipient. Those telephone carriers and recipients are not our Subprocessors and are not under our control.