Data Processing Addendum

1. What this is and when it applies

This Addendum forms part of the Terms of Service between Untoil, Inc. (“Untoil”) and the organization using the Service (the “Customer”). It applies whenever Untoil processes personal data on the Customer’s behalf and the Customer is subject to a data protection law that requires terms of this kind. Where it conflicts with the Terms on the handling of personal data, this Addendum controls.

No signature is needed. Accepting the Terms accepts this Addendum. If your procurement process requires a countersigned copy, write to team@untoil.com.

2. Who is who

The Customer is the controller, or the business, for the personal data in its workspace. It decides which tools Untoil connects to, which people are in the directory, and what the output is used for. Untoil is the processor, or the service provider, and acts on the Customer’s documented instructions.

Those instructions are: this Addendum, the Terms, the settings the Customer chooses in the product, and anything else the Customer asks us to do in writing. Untoil will tell the Customer if an instruction appears to breach applicable data protection law.

The Customer is responsible for having a lawful basis for the processing and for giving its workforce any notice the law requires, including the electronic monitoring notices required in New York, Connecticut, Delaware and Maine. Untoil has no relationship with those individuals and cannot give that notice on the Customer’s behalf.

3. What is processed

Categories of individual

The Customer’s employees, contractors and other workforce members, including people who never use the Service but who appear in a connected directory or in content Untoil reads.

Categories of data

• Identity and employment details: name, work email, job title, department, manager, employment status.
• Compensation: an hourly rate, where the Customer connects payroll. Untoil stores the derived rate, not salary or pay history.
• Content: excerpts of messages, documents and meeting transcripts a finding came from, together with the material the Customer’s people post or attach directly, including screenshots and recordings they choose to capture.
• Usage: how people interact with the Service, and the text of requests sent to AI providers.

Purpose and duration

To provide the Service: identifying repeated work, estimating its time and cost, attributing it to the people affected, and answering questions about it. Processing lasts for the term of the Terms, plus the retention period in section 9.

4. Confidentiality and staff

Untoil keeps personal data confidential, limits access to staff who need it to run or support the Service, and binds those people to confidentiality. Staff access to a Customer workspace for support or investigation is logged, and the Customer can see that log.

5. Security

Untoil maintains technical and organizational measures appropriate to the risk, described on the security page, which forms part of this Addendum. Those measures include encryption in transit and at rest, encrypted storage of third-party access tokens, least-privilege staff access, logging of administrative access, and masking of typed input in session recordings. Untoil may change them, but not in a way that materially weakens protection during the term.

6. Subprocessors

The Customer gives general authorization for Untoil to engage the subprocessors listed on the subprocessors page. Untoil binds each one to obligations no less protective than this Addendum, and remains responsible for their performance.

• Notice. Untoil updates that page at least 30 days before a new subprocessor begins processing personal data, and emails Customers who have asked to be told. The page update is the notice, so it reaches Customers whether or not they subscribed.
• Objection. Within 30 days of the update the Customer may object on reasonable, documented data protection grounds. Silence after 30 days is authorization.
• Resolution. On a timely objection Untoil will try to avoid using that subprocessor for the Customer, take corrective steps, or offer an alternative. If none of that resolves it within 30 days, the Customer may terminate the affected part of the Service and receive a pro-rata refund of prepaid unused fees. That is the sole and exclusive remedy.
• Urgent changes. Where a change is needed for the security or availability of the Service, Untoil may make it sooner and will update the page within 7 business days.

7. Individuals’ rights

Requests from an individual run against the Customer, who decides what Untoil reads. Untoil will not respond to such a request directly, beyond telling the person to contact their employer, unless the Customer instructs otherwise or the law requires it.

Untoil will help the Customer answer, taking into account the nature of the processing, including by locating, exporting, correcting or deleting one named person’s data on the Customer’s instruction. Untoil will pass on any request it receives without undue delay.

8. Breach notification

Untoil will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer’s data, with the nature of the breach, the categories and approximate numbers involved, the likely consequences, and the measures taken. Untoil will help the Customer meet its own notification obligations. Notice is not an admission of fault.

9. Return and deletion

The Customer can export its data at any time during the term. On request, or 120 days after the Terms end, Untoil deletes the Customer’s personal data from production systems within 30 days and from backups within 120 days, except where law requires it to be kept. Attachments on deleted content are removed on the same 120 day schedule.

10. Audits

Untoil will make available the information reasonably needed to show compliance with this Addendum, including the security page, the subprocessor list, and written answers to a security questionnaire. Where that is not enough for a Customer’s legal obligation, the Customer may request an audit no more than once a year, on 30 days’ notice, during business hours, at its own cost, under confidentiality, and in a way that does not give access to another customer’s data.

11. International transfers

Untoil processes personal data in the United States. Where the Customer transfers personal data subject to European, United Kingdom or Swiss law, the parties agree to the applicable Standard Contractual Clauses, which are incorporated by reference, with Untoil as data importer and the Customer as data exporter, and with this Addendum supplying the details those clauses require. The subprocessor notice period in section 6 applies where those clauses leave a period to be agreed.

12. United States state privacy laws

Where the Customer is subject to the California Consumer Privacy Act or a comparable state law, Untoil acts as a service provider or processor and will not:

• sell or share the personal data;
• retain, use or disclose it for any purpose other than performing the Service, or outside the direct business relationship, except as the law permits;
• combine it with personal data received from another customer, except as the law permits.

Untoil certifies that it understands these restrictions and will comply with them, and will tell the Customer if it determines it can no longer meet them.

13. Liability and changes

Liability under this Addendum is subject to the limitations in the Terms. Untoil may update this Addendum to reflect a change in law or in the Service, and will give notice of a material change by the same means as a change to the Terms. A change will not reduce the protections the Customer has for personal data already being processed.

14. Contact

Untoil, Inc.
2261 Market Street STE 12903
San Francisco, CA 94114
United States
team@untoil.com