Data Processing Addendum

In short: You control your customers' data; we process it for you.

This addendum is part of the Customer Agreement and applies when Sunwell processes personal data for you, such as your customers' contact details, addresses, job notes, photos and messages. For this processing you are the controller or business, and Sunwell is the processor, service provider or contractor.

In short: We use it only to run the services in your order.

Sunwell processes personal data only to provide, secure and support the services in your order, on your documented instructions through the agreement, your settings and written directions. We will tell you if an instruction appears to break the law, unless the law prohibits telling you.

• Subject matter: providing the services in your order.
• Duration: the term of the order plus the export window.
• Data subjects: your customers, leads, contacts, staff and subcontractors.
• Data types: contact details, property addresses, job and estimate details, photos, communications, invoices and payment status.

In short: Need-to-know access under confidentiality.

Access is limited to personnel who need it for the services and are bound by confidentiality. Sunwell maintains appropriate technical and organizational measures, described in the Security Overview, covering access control, encryption in transit, logging, backups and secure deletion.

In short: 30 days notice before a new provider touches your data.

You authorize the subprocessors listed in the Privacy Policy. We keep that list current, give at least 30 days notice before adding a subprocessor that processes your data, and let you object on reasonable privacy or security grounds. We impose written data-protection terms on each subprocessor and remain responsible for their work.

In short: We help you answer your customers' requests.

We help you respond to verified requests from individuals, forward requests we receive, and do not answer them for you unless you ask or the law requires it. We reasonably help with assessments, records and regulator questions about the services.

In short: Notice within 72 hours where practicable.

We notify you without undue delay, and within 72 hours where reasonably practicable, after confirming a breach of security affecting your personal data. Notice includes what we know about the nature and scope, the data and people affected, likely consequences, containment, remediation and a contact. We preserve evidence and help with legally required notices. Notice is not an admission of fault.

In short: Export, then deletion on schedule.

At the end of processing you can export your data during the export window. Then we delete it as the Customer Agreement describes, unless the law requires us to keep it, in which case it stays protected and is deleted when that duty ends. We confirm completion on request.

In short: We show our work on reasonable request.

On reasonable request we provide information needed to show compliance with this addendum. Further review is reserved for a material incident, a regulator request or a verified gap, and must protect other customers.

In short: No selling or sharing; processed in the United States.

For California personal information, Sunwell will not sell or share it, will not use or disclose it outside the direct business relationship and the purposes above, and will not combine it with other data except as the law permits. We will tell you if we can no longer meet these duties. Personal data is processed in the United States. Transfers from other regions need a transfer mechanism agreed in writing before they start.

In short: For personal data, this addendum wins.

This addendum controls over the Customer Agreement for personal data processing. The agreement's liability terms apply except where mandatory law requires otherwise.