Data Processing Agreement

1. Roles

For personal information in Customer Data, your company is the controller (it decides why and how the information is used) and TicketStacker is the processor (it handles the information for you). Words like "personal information," "controller," "processor" and "data subject" have the meanings given by the privacy laws that apply, including U.S. state laws such as the California Consumer Privacy Act and, where it applies, the GDPR.

2. What we process

• Subject matter and duration: providing the Service, for as long as your company uses it, plus the deletion period below.
• Nature and purpose: storing, displaying, organizing, sending and deleting information so tickets, forms, notifications and reports work.
• Kinds of data: names, email addresses, phone numbers, addresses and anything else your company or its requesters put into tickets, fields, comments and files.
• Data subjects: your company's members, requesters, customers, vendors and anyone else mentioned in Customer Data.

3. Your instructions

We process personal information only to provide the Service as described in the Terms, as your settings direct, and as you otherwise instruct us in writing, unless the law requires otherwise (in which case we'll tell you first if the law allows). We don't sell or share it for advertising, and we don't combine it with other data except as needed to provide the Service.

4. Our people

Everyone at TicketStacker who can access Customer Data is bound to keep it confidential and accesses it only as needed for the purposes above.

5. Security

We maintain technical and organizational measures appropriate to the risk, including:

• separating each company's data with access rules enforced in the database itself;
• encryption of data in transit (HTTPS/TLS) and encryption at rest by our hosting providers;
• private file storage with short-lived download links;
• two-step verification for our internal admin tools, which don't display ticket contents;
• least-privilege access for our staff and providers, and logging of administrative actions;
• limits that protect forms, sign-in and email sending from abuse.

6. Subprocessors

You authorize us to use the subprocessors below. Each is bound by written terms that protect personal information at least as well as this DPA. We'll update this list and email your company's Admins at least 30 days before adding a new subprocessor that handles Customer Data; if you object on reasonable privacy grounds, you may end your subscription and receive a refund of prepaid fees for the remaining period.

7. Helping you with requests and obligations

The Service lets you find, export, correct and delete Customer Data. If a data subject contacts us directly about Customer Data, we'll direct them to you. We'll give reasonable help with data subject requests, security questions, and any privacy assessments the law requires of you, to the extent you can't handle them yourself in the Service.

8. Security incidents

If we become aware of unauthorized access to, or loss of, your Customer Data, we'll notify your company's Admins without undue delay (and we aim to within 72 hours), describe what happened and what we're doing about it, and keep them updated with the information they need to meet their own obligations.

9. Where data is stored

Customer Data is stored in the United States. If you send us personal information from the European Economic Area, the United Kingdom or Switzerland, we'll put appropriate transfer safeguards in place (such as the European Commission's Standard Contractual Clauses) when you ask.

10. Return and deletion

When your company closes, its Admins can export Customer Data for 30 days. After that we delete it, except copies in backups that expire on their normal schedule or that the law requires us to keep, which stay protected by this DPA until they're deleted.

11. Reviews

Once a year (or after a security incident), you may ask us to answer a reasonable security questionnaire and provide documentation showing how we meet this DPA. Any on-site audit needs reasonable notice, must avoid disrupting the Service and other customers, and is at your expense.

12. Order of precedence

If this DPA and the Terms conflict about personal information, this DPA wins. Everything else in the Terms, including its limits on liability, applies to this DPA.