This Data Processing Addendum (“DPA”) is part of the Terms of Service between ShopNSign LLC (“SHOPNSIGN,” the “Service Provider”) and the subscribing repair shop (the “Shop,” the “Business”). It applies to personal information about the Shop’s customers and other individuals that the Shop or its users enter into the Service (“Shop Personal Information”). It is intended to meet the service-provider and processor contract requirements of the California Consumer Privacy Act (Cal. Civ. Code §1798.100(d), §1798.140(ag); Cal. Code Regs. tit. 11, §7051) and the other U.S. state privacy laws that require processor contracts.

1. Roles and instructions

• The Shop is the business/controller and determines the purposes of processing. SHOPNSIGN is a service provider/processor.
• SHOPNSIGN processes Shop Personal Information only to provide, secure, support and improve the Service as described in the Terms, the Privacy Policy and the Shop’s use and settings, which together are the Shop’s documented instructions. Nature and purpose: hosting and processing of repair estimates, inspections, signatures, messages, appointments and payments. Types of data: as listed in Section 2 of the Privacy Policy. Duration: the subscription term plus the deletion period in Section 7.

2. Restrictions (CCPA)

SHOPNSIGN will not: (a) sell or share Shop Personal Information; (b) retain, use or disclose it for any purpose other than the business purposes in this DPA, including any commercial purpose other than providing the Service; (c) retain, use or disclose it outside the direct business relationship with the Shop; or (d) combine it with personal information received from other sources, except as permitted by the CCPA. SHOPNSIGN will comply with applicable obligations under the CCPA, provide the same level of privacy protection required of businesses, and notify the Shop if it determines it can no longer meet its obligations. The Shop may take reasonable steps to stop and remediate unauthorized use.

3. Confidentiality and personnel

Persons authorized to process Shop Personal Information are bound by confidentiality and access it only as needed.

4. Security

SHOPNSIGN maintains reasonable administrative, technical and physical safeguards appropriate to the nature of the data, including encryption in transit, encryption at rest by its cloud provider, role-based access controls, database security rules isolating each Shop’s data, least-privilege administrative access, audit logging, and backups.

5. Subprocessors

The Shop authorizes the subprocessors listed in Annex 1. SHOPNSIGN binds each subprocessor by written contract to data-protection obligations no less protective than this DPA and remains responsible for their performance. SHOPNSIGN will update the list at least 30 days before adding a new subprocessor that will process Shop Personal Information (except in an emergency); the Shop may object on reasonable data-protection grounds by email, and if the objection cannot be resolved, may cancel the affected Service.

6. Assistance; consumer requests

SHOPNSIGN provides tools for the Shop to access, export, correct and erase a customer’s personal information (while keeping the financial record), and will reasonably assist the Shop in responding to consumer requests and data-protection assessments. Requests received directly by SHOPNSIGN about Shop Personal Information will be forwarded to the Shop.

7. Return and deletion

When the subscription ends, the Shop may export its data for 30 days. SHOPNSIGN then deletes or de-identifies Shop Personal Information within a reasonable time, except where retention is required by law, in backups until they expire, or to establish or defend legal claims.

8. Security incidents

SHOPNSIGN will notify the Shop without undue delay, and in any event within five (5) business days after confirming a security incident affecting Shop Personal Information, with the information then reasonably available, and will cooperate with the Shop’s notifications required by state breach-notification laws.

9. Audits

On reasonable written request no more than once per year, SHOPNSIGN will provide information reasonably necessary to demonstrate compliance with this DPA, such as written responses to a security questionnaire.

10. De-identified data

Any de-identified data SHOPNSIGN creates will be kept in de-identified form, with reasonable measures against re-identification, as required by law.

11. Order of precedence

For Shop Personal Information, this DPA controls over the Terms if they conflict.

Annex 1 — Subprocessors

SHOPNSIGN uses the following service providers (“subprocessors”) to host and deliver the Service. Each is bound by a written agreement to protect personal information and to use it only to provide services to us. See our Data Processing Addendum.

Not subprocessors: WhatsApp/Meta (a shop sends WhatsApp messages from its own phone; SHOPNSIGN does not send or store them) and a shop’s own connected Stripe account (a direct relationship between the shop and Stripe).

We will update this page at least 30 days before adding a new subprocessor that processes shop customer data. To be notified, email contact@shopnsign.com with the subject “Subprocessor updates.”

Esta es una traducción/resumen en español para su comodidad. Si hay alguna diferencia, la versión en inglés es la que rige.

Este Anexo forma parte de los Términos y aplica a los datos personales de los clientes del taller.

• El taller es el responsable; SHOPNSIGN es su proveedor de servicio y solo procesa esos datos para dar el Servicio.
• SHOPNSIGN no vende ni comparte esos datos, no los usa para otros fines ni los combina con otras fuentes (CCPA).
• Seguridad: cifrado, acceso por roles, reglas que separan los datos de cada taller, registros de auditoría y respaldos.
• Subprocesadores: los de la lista publicada; avisamos 30 días antes de agregar uno nuevo y el taller puede objetar.
• Herramientas para acceder, exportar, corregir y borrar datos de un cliente; ayudamos con las solicitudes de privacidad.
• Al terminar: 30 días para exportar, luego se borra o anonimiza.
• Incidentes de seguridad: aviso al taller sin demora indebida y a más tardar en cinco (5) días hábiles desde su confirmación.

Anexo 1 — Subprocesadores

Proveedores que usamos para operar el Servicio, todos con contrato de protección de datos:

WhatsApp no es subprocesador: el taller envía desde su propio teléfono. Avisamos 30 días antes de agregar un proveedor nuevo.