Data Processing Addendum (DPA)

This Data Processing Addendum (the “Addendum”) is incorporated into the Terms of Service (“Agreement”) between Raycast Technologies, Ltd. (“Raycast”), and you, the customer (“Customer”) that has signed up for the Services and agreed to the terms of the Agreement.

This Addendum applies where Raycast Processes Customer Personal Data (as defined below) in connection with providing the Services to Customer and such Processing is subject to Data Protection Legislation. This Addendum shall be effective for the term of the Agreement. This Addendum shall be effective for the term of the Agreement and any renewal terms.

1. Definitions
   1. For the purposes of the Addendum:
      1. “Customer Personal Data” means the Personal Data described under Section 2 of this Addendum that is subject to Data Protection Legislation, in respect of which Customer is the Controller;
      2. “CCPA” means the California Consumer Privacy Act;
      3. "Data Protection Legislation” means all applicable legislation relating to data protection and privacy including without limitation the CCPA, the GDPR, and the UK GDPR, together with any national implementing laws in any Member State of the European Union or, to the extent applicable, in any other country, as amended, repealed, consolidated or replaced from time to time;
      4. “GDPR” means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data;
      5. “Personal Data”, “Data Subject”, “Personal Data Breach”, “Process”, “Processor” and “Controller” will each have the meaning given to them in the GDPR; and
      6. “UK GDPR” means the GDPR in such form as incorporated into the laws of the United Kingdom (UK) by virtue of the European Union (Withdrawal) Act 2018 and the UK Data Protection Act 2018.
   2. Capitalized terms not otherwise defined herein shall have the meaning given to them in the Agreement.
2. Details of The Processing
   1. Categories of Data Subjects. This Addendum applies to the Processing of Customer Personal Data relating to Customer and Customer’s permitted users.
   2. Types of Personal Data. Customer Personal Data includes Personal Data, the extent of which is determined and controlled by Customer in its sole discretion, such as names, contact information, usernames, and email address.
   3. Subject-Matter and Nature of the Processing. The subject-matter of Processing of Customer Personal Data by Raycast is the provision of the Services to Customer that involves the Processing of Customer Personal Data. Customer Personal Data will be subject to those Processing activities which Raycast needs to perform in order to provide the Services pursuant to the Agreement and any applicable statement of work.
   4. Purpose of the Processing. Customer Personal Data will be Processed by Raycast for purposes of providing the Services set out into the Agreement and any applicable statement of work.
   5. Duration of the Processing. Customer Personal Data will be Processed for the duration of the Agreement, subject to Section 10 of this Addendum.
3. Processing of Customer Personal Data
   1. The provisions in this Section 3.1 shall apply to the extent Raycast’s processing of Customer Personal Data is subject to the GDPR or UK GDPR.
      1. The parties acknowledge and agree that Customer is the Controller and Raycast is the Processor of Customer Personal Data. Raycast will only Process Customer Personal Data as a Processor on behalf of and in accordance with Customer’s prior written instructions, including with respect to transfers of Customer Personal Data. Raycast is hereby instructed to Process Customer Personal Data to the extent necessary to enable Raycast to provide the Services in accordance with the Agreement.
      2. If Raycast cannot process Customer Personal Data in accordance with Customer’s instructions due to a legal requirement under any applicable laws of the European Union (EU), a relevant EU Member State or the UK, Raycast will (i) promptly notify Customer of such inability, providing a reasonable level of detail as to the instructions with which it cannot comply and the reasons why it cannot comply, to the greatest extent permitted by applicable law; and (ii) cease all Processing of the affected Customer Personal Data (other than merely storing and maintaining the security of the affected Customer Personal Data) until such time as Customer issues new instructions with which Raycast is able to comply. If this provision is invoked, Raycast will not be liable to Customer under the Agreement for failure to perform the Services until such time as Customer issues new instructions.
      3. Each of Customer and Raycast will comply with their respective obligations under the Data Protection Legislation. Customer shall ensure that Customer has obtained (or will obtain) all rights and consents (if required) which are necessary for Raycast to Process Customer Personal Data in accordance with this Addendum.
      4. Raycast will not transfer Customer Personal Data to any party in a country not deemed adequate for the transfer of Personal Data by the European Commission (for transfer concerning the EEA) and the equivalent UK authority (for transfers concerning the UK), including permitting access to Customer Personal Data from any party in such countries, without the prior written consent of the Customer, unless (i) the transfer/access is to a sub-Processor appointed in accordance with Section 6 of this Addendum; and (ii) the transfer/access is in compliance with Data Protection Legislation (including having in place appropriate transfer safeguards as applicable).
   2. To the extent Raycast’s Processing of Customer Personal Data is subject to the CCPA, Raycast shall not (1) retain, use, or disclose Customer Personal Data other than as provided for in the Agreement, as needed to perform the Services, to build or improve the quality of the Services to detect security incidents, to protect against fraudulent or illegal activity, to retain sub-Processors in compliance with Section 6, or as otherwise permitted by the CCPA; or (2) sell Customer Personal Data.
4. Confidentiality
   1. Raycast will ensure that any person whom Raycast authorizes to Process Customer Personal Data on its behalf is subject to confidentiality obligations in respect of that Customer Personal Data.
5. Security Measures
   1. Raycast will implement appropriate technical and organizational measures to protect against accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Personal Data (described under Schedul 1). The parties agree that the safeguards described in Schedule 1 to the Standard Contractual Clauses will provide an adequate level of protection for processing Personal Data in compliance with the Data Protection Legislation.
   2. Raycast will provide Customer with reasonable assistance as necessary for the fulfilment of Customer’s obligation to keep Customer Personal Data secure.
6. Sub-Processing
   1. Customer hereby consents to Raycast engaging the sub-Processors set forth at Schedule 2 below to process Customer Personal Data in order to perform specific services on Raycast’s behalf. Raycast will inform Customer of any intended changes concerning the addition or replacement of any sub-Processors and Customer will have an opportunity to object to such changes on reasonable grounds within fifteen (15) business days after being notified. If the parties are unable to resolve such objection, either party may terminate the Agreement by providing written notice to the other party.
   2. Raycast will enter into a binding written agreement with the sub-Processor that imposes on the sub-Processor the same obligations that apply to Raycast under this Addendum. Where any of its sub-Processors fails to fulfil its data protection obligations, Raycast will be liable to the Customer for the performance of its sub-Processors’ obligations.
7. Data Subject Rights
   1. Raycast will provide Customer with assistance necessary for the fulfilment of Customer’s obligation to respond to requests for the exercise of Data Subjects’ rights relating to Customer Personal Data. Except as required by law, Raycast shall not respond to such requests without Customer’s prior written consent and written instructions and Customer shall be solely responsible for responding to such requests.
8. Personal Data Breaches
   1. Raycast will notify Customer as soon as practicable after it becomes aware of any Personal Data Breach affecting any Customer Personal Data. At Customer’s request Raycast will promptly provide Customer with all reasonable assistance necessary to enable Customer to notify relevant security breaches to the competent data protection authorities and/or affected Data Subjects, if Customer is required to do so under Data Protection Legislation. Customer is solely responsible for complying with Personal Data Breach notification requirements applicable to Customer and fulfilling any third-party notification obligations related to any Personal Data Breach.
9. Data Protection Impact Assessment; Prior Consultation
   1. Raycast will provide Customer with reasonable assistance to facilitate conducting data protection impact assessments and consultation with data protection authorities, if Customer is required by Data Protection Legislation to engage in such activities, and solely to the extent that such assistance is necessary and relates to the Processing by Raycast of Customer Personal Data, taking into account the nature of the Processing and the information available to Raycast.
10. Return or Deletion of Customer Personal Data
    1. Raycast will return or delete, at Customer’s choice, Customer Personal Data to Customer after the end of the provision of Services relating to the Processing, and delete existing copies unless the applicable European Union or member state law requires storage of the data.
11. Information
    1. Raycast will, at Customer’s request, provide Customer with all information necessary to enable Customer to demonstrate compliance with its obligations under the GDPR, and allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, to the extent that such information is within Raycast’s control and Raycast is not precluded from disclosing it by applicable law, a duty of confidentiality, or any other obligation owed to a third party, and provided that such audits shall be carried out with reasonable notice during regular business hours not more often than once per year. Raycast will immediately inform Customer if, in its opinion, an instruction from Customer infringes the Data Protection Legislation.
12. Liability
    1. Each party’s liability towards the other party under or in connection with this Addendum will be limited in accordance with the provisions of the Agreement.
    2. Customer acknowledges that Raycast is reliant on Customer for direction as to the extent to which Raycast is entitled to Process Customer Personal Data on behalf of Customer in performance of the Services. Consequently Raycast will not be liable under the Agreement for any claim brought by a Data Subject arising from any action or omission by Raycast, to the extent that such action or omission resulted from Customer’s instructions or from Customer’s failure to comply with its obligations under Data Protection Legislation.
13. General Provisions
    1. With regard to the subject matter of this Addendum, in the event of inconsistencies between the provisions of this Addendum and the Agreement, the provisions of this Addendum shall prevail.

Schedule 1

Security Measures

All customer data is transferred securely using TLS v1.2 via HTTPS. Raycast does not operate intermediary servers to process or store your data. We use OAuth for authentication and authorization where possible and access as little information as necessary. Our databases are stored encrypted on our customers local hard drive. The credentials for third party services are stored securely in users Keychain. And, all data of an extension gets deleted when users log out.

Schedule 2

List of subprocessors:

Name of processor	Description of processing
Amplitude Inc., 501 2nd Street, Suite 100, San Francisco, CA 94107, USA	Analysis of in-product behaviour
Google Ireland (Google Drive), Gordon House, Barrow Street, Dublin 4, Ireland	Cloud storage for documents
Google Ireland (Google Mail), Gordon House, Barrow Street, Dublin 4, Republic of Ireland	Cloud-based email client
Notion, 2948 20th St, Apt. 300 San Francisco, CA 94110, USA	Documentation and notes storage software
Sendgrid, 1801 California Street, 1801 California St, Denver, CO 80202	Email marketing automation software
Sentry 132 Hawthorne St, San Francisco, CA 94107	Application stability monitoring software
Slack, 500 Howard Street, San Francisco, CA 94105, USA	Team communication and collaboration software
TYPEFORM SL, C/Bac de Roda, 163 (Local), 08018 – Barcelona (Spain)	Survey software
Zoom Video Communications, Inc., 55 Almaden Blvd. Suite 600, San Jose, CA 95113, USA	Video conferencing software