This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Warm'd LLC (“Processor”) and the Customer (“Controller”). It applies where Processor processes Personal Data on Controller’s behalf and is effective without separate signature. Where a signed copy is required for your records, contact admin@warmd.ai.
Capitalized terms not defined here have the meaning given in the Terms or in applicable Data Protection Law, meaning the EU GDPR, the UK GDPR, the Swiss FADP, the California Consumer Privacy Act as amended, and other US state comprehensive privacy laws, as applicable.
1. Roles and scope
Controller determines the purposes and means of processing Personal Data about its leads. Processor processes it only on Controller’s documented instructions. The Terms, this DPA, and Controller’s configuration and use of the Service constitute those instructions.
Under the CCPA, Processor is a “service provider.” Processor does not sell or share Personal Data, does not retain, use, or disclose it for any purpose other than performing the Service, and does not combine it with Personal Data from other sources except as permitted for a service provider. Processor certifies that it understands and will comply with these restrictions.
Processor will notify Controller if it determines it can no longer meet its obligations, and Controller may take reasonable steps to stop or remediate unauthorized processing.
2. Details of processing
| Subject matter | Provision of AI-driven lead contact, qualification, and appointment booking |
|---|---|
| Duration | The term of the Terms, plus the retention periods in Section 8 |
| Nature and purpose | Collection, storage, transmission, analysis by AI models, retrieval, and deletion, to contact and qualify leads and record compliance evidence |
| Categories of data subjects | Controller’s leads and prospective customers; Controller’s own authorized users |
| Categories of Personal Data | Name, phone number, email address, contact history, message content, qualification answers, appointment details, consent records, IP address |
| Special category data | Not requested or required. Controller must not configure qualification questions that solicit special category data, and is responsible if leads volunteer it in free-form conversation |
3. Processor obligations
Processor will:
- process Personal Data only on documented instructions, including for international transfers, unless required otherwise by law, in which case it will inform Controller first unless legally prohibited;
- ensure personnel authorized to process Personal Data are bound by confidentiality;
- implement the technical and organizational measures in Section 5;
- respect the conditions in Section 4 for engaging subprocessors;
- assist Controller, by appropriate technical and organizational measures and insofar as possible, in responding to data subject rights requests;
- assist Controller with data protection impact assessments and prior consultations, taking into account the nature of processing and the information available;
- make available the information necessary to demonstrate compliance with Article 28 and allow for audits as described in Section 7.
4. Subprocessors
Controller provides general written authorization for Processor to engage subprocessors. The current list is published at /legal/subprocessors.
Processor will give at least 30 days’ notice before adding or replacing a subprocessor, by email to the Controller’s account address or by updating that page with a notification mechanism Controller may subscribe to. Controller may object on reasonable data-protection grounds within that period; the parties will work in good faith toward a resolution, and if none is reached Controller may terminate the affected Service without penalty for the remainder of the prepaid term.
Processor imposes data protection obligations on each subprocessor no less protective than this DPA and remains fully liable for their performance.
5. Security measures
Taking into account the state of the art, cost, and the nature and risk of processing, Processor implements measures including:
- encryption of Personal Data in transit and at rest;
- tenant isolation enforced at the database layer by row-level security, scoped per request, so a query cannot reach another tenant’s rows even if application logic errs;
- encryption of third-party credentials with AES-256-GCM and one-way hashing of API keys;
- role-based access control, least-privilege internal access, and authentication through a dedicated identity provider;
- append-only, database-enforced immutability for consent and compliance records;
- rate limiting, egress filtering on outbound requests, signature verification on inbound webhooks, and audit logging;
- regular restoration testing of backups and a documented incident response process.
6. Personal data breach
Processor will notify Controller without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Controller’s Personal Data. The notification will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point, in each case to the extent known, with further information supplied as it becomes available.
7. Audits
On reasonable written request, no more than once per twelve months (unless required by a supervisory authority or following a breach), Processor will make available information necessary to demonstrate compliance, including relevant third-party audit reports or security documentation where available. Where that is insufficient, Controller may conduct an audit at its own expense, during business hours, with at least 30 days’ notice, under confidentiality obligations, and in a manner that does not disrupt the Service or compromise other customers’ data.
8. Deletion and return
On termination, Controller may export Personal Data for 30 days, after which Processor deletes it from production systems, with backups expiring on their normal cycle.
Exception for compliance records. Consent records and compliance audit events are retained for 5 years and are stored append-only. They are the evidence that a contact was authorized, and they are retained to meet recordkeeping obligations and to defend claims. Article 28(3)(g) permits retention where Union or Member State law requires it, and the equivalent legal-obligation exception applies under US state law. These records remain subject to the security measures in Section 5 for the whole retention period.
9. International transfers
Where Controller transfers Personal Data subject to the GDPR to Processor in the United States, the parties incorporate the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), by reference, with: Clause 7 (docking) applicable; Clause 9 option 2 (general written authorization) with the 30-day notice period in Section 4; Clause 11 optional redress language excluded; Clause 17 governed by Irish law; Clause 18(b) forum in Ireland; Annex I populated from Section 2 and the parties’ account details; Annex II populated from Section 5; and Annex III from the subprocessors page.
For UK transfers, the UK International Data Transfer Addendum applies to those Clauses. For Swiss transfers, references to the GDPR are read as references to the FADP and the Swiss Federal Data Protection and Information Commissioner is the competent authority.
10. Liability and precedence
Each party’s liability under this DPA is subject to the limitations of liability in the Terms. In the event of conflict, this DPA controls over the Terms as to the processing of Personal Data, and the Standard Contractual Clauses control over this DPA.
Data protection contact: admin@warmd.ai.