Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the CommuniQueue Terms of Service between you ("Customer") and Battle Line Productions LLC ("CommuniQueue"). It applies automatically whenever CommuniQueue processes personal data on Customer's behalf that is subject to the EU GDPR, the UK GDPR, or the Swiss Federal Act on Data Protection ("Data Protection Law"). Words such as controller, processor, personal data, and personal data breach have the meaning Data Protection Law gives them.

1. Roles and Instructions

"Customer Personal Data" means personal data in the Customer Content that CommuniQueue processes for Customer. Customer is its controller, or a processor acting for its own clients, and CommuniQueue is Customer's processor or sub-processor. CommuniQueue processes Customer Personal Data only on Customer's documented instructions, which are the Terms, this DPA, and Customer's configuration and use of the service. If the law requires other processing, CommuniQueue will tell Customer first unless the law forbids it. CommuniQueue will tell Customer if it believes an instruction breaks Data Protection Law.

2. Details of the Processing (Annex I)

• Subject matter and purpose: storing Customer's templates and recipient data, rendering and sending the messages Customer requests, recording their delivery and engagement events, and supporting Customer.
• Duration: for the term of the Terms, and then until deletion under section 9.
• Data subjects: recipients of Customer's messages, members of Customer's distribution lists, and Customer's own users.
• Categories of personal data: contact details such as email addresses and names, any other personal data Customer places in templates, variables, or lists, and the delivery and engagement events of each message.
• Special categories: none intended. Customer must not send them unless Data Protection Law allows it and Customer has judged the service's safeguards appropriate.
• Frequency: continuous, while Customer uses the service.

3. Confidentiality

CommuniQueue ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality.

4. Security (Annex II)

CommuniQueue keeps technical and organizational measures appropriate to the risk, including: encryption of data in transit, including connections to its database; encryption at rest of stored provider credentials and other secrets; workspace-scoped access control, so that a user reaches only the workspaces they belong to; access to production systems limited to the people who run the service; and logging of production activity. CommuniQueue may change these measures as long as the overall protection does not decrease.

5. Sub-processors

Customer gives general written authorization for the sub-processors listed under "Sub-processors for customer data" in section 5 of our Privacy Policy. CommuniQueue will update that list and email Customer's account owner at least 30 days before a new sub-processor processes Customer Personal Data. Customer may object on reasonable data protection grounds within that period; if the objection cannot be resolved, Customer may end the affected service and receive a refund of the unused part of any prepaid period. CommuniQueue puts data protection obligations on each sub-processor that are no less protective than this DPA, and remains responsible for their performance.

6. Data Subject Requests

CommuniQueue helps Customer, by appropriate technical and organizational measures, to respond to requests from data subjects. If CommuniQueue receives such a request about Customer Personal Data, it passes it to Customer and does not answer it except as Customer instructs.

7. Personal Data Breaches

CommuniQueue notifies Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. It gives Customer the information Customer reasonably needs to meet its own obligations as that information becomes available, and takes reasonable steps to contain the breach.

8. Assistance

Taking into account the nature of the processing and the information available to it, CommuniQueue helps Customer with data protection impact assessments and prior consultations with supervisory authorities about the service.

9. Deletion and Return

When Customer's account ends, Customer may ask for a copy of Customer Personal Data within 30 days. After that, CommuniQueue deletes Customer Personal Data, except where the law requires CommuniQueue to keep it. Copies in database backups are removed as those backups expire, within 7 days.

10. Audits

CommuniQueue makes available the information Customer needs to verify compliance with this DPA. CommuniQueue may first answer an audit request with a written summary of its measures or a third-party report. If that is not enough to show compliance, then on 30 days' written notice, and no more than once a year unless a personal data breach or a supervisory authority requires it, Customer or an independent auditor bound by confidentiality may audit that compliance, at Customer's cost, during business hours, and without access to other customers' data.

11. International Transfers

CommuniQueue processes Customer Personal Data in the United States. Where Data Protection Law requires a transfer mechanism:

• European Economic Area: the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 are incorporated by reference, Module Two where Customer is a controller and Module Three where Customer is a processor, with Customer as data exporter and CommuniQueue as data importer. Clause 7 applies; under clause 9(a), option 2 applies with the notice period in section 5; the optional language in clause 11 does not apply; under clauses 17 and 18, the clauses are governed by the law of Ireland and disputes go to the courts of Ireland; the competent supervisory authority is the one clause 13 determines; and sections 2 and 4 of this DPA are Annexes I and II.
• United Kingdom: the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the Information Commissioner (version B1.0, the "UK Addendum") applies to those clauses, with its tables completed from this DPA; for Table 4, neither party may end the UK Addendum when the Information Commissioner changes it.
• Switzerland: the clauses above apply with the Swiss Federal Data Protection and Information Commissioner as the competent authority, references to the GDPR read as references to the Swiss Federal Act on Data Protection, and "member state" including Switzerland.

12. Liability and Precedence

Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Law or the Standard Contractual Clauses do not allow it. If this DPA conflicts with the Terms, this DPA prevails; if it conflicts with the Standard Contractual Clauses, the clauses prevail.

13. Contact

Questions about this DPA? Contact us at privacy@battlelineproductions.com, or write to Battle Line Productions LLC, 20507 Gaukler St, Saint Clair Shores, MI 48080, United States.