Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms Of Use between IDE Solutions LLC ("we", the "processor") and the customer using TroubleFree WP ("you", the "controller"). It applies whenever we process personal information on your behalf that is protected by data protection law, including the EU and UK General Data Protection Regulation and US state privacy laws. If you act for your own clients, we are your subprocessor and this DPA covers that too. If this DPA and the Terms disagree about personal information, this DPA wins.

1. What We Process For You

• Purpose: providing TroubleFree WP as described in the Terms: managing, updating, checking and reporting on your WordPress sites.
• People involved: your clients and their contacts, your sites' administrators, your team members, and visitors whose information appears on pages we screenshot.
• Information: report recipients' email addresses and the reports sent to them; site administrators' names, usernames and email addresses when you use Log Into Site; screenshots of your sites' pages; team members' names and email addresses; and activity records.
• Sensitive information: we don't ask for it. Don't put it on pages we screenshot unless you need to.
• Duration: for as long as you use TroubleFree WP, and as set out in section 8.

2. Your Instructions

We process this information only on your documented instructions: the Terms, this DPA, and the settings and actions you choose in TroubleFree WP. We'll tell you if we think an instruction breaks data protection law. You're responsible for having a lawful basis and any notices or consents needed for the information you give us.

3. Confidentiality

Everyone we authorize to process this information is bound to keep it confidential.

4. Security

We keep appropriate technical and organizational measures in place, including:

• HTTPS for all connections to TroubleFree WP and to your sites;
• encryption of access tokens, email server passwords, and two-factor secrets, and of database backups;
• hashed passwords and recovery codes, two-factor sign-in, and single-use, short-lived login links;
• private storage of screenshots, shown only to people with access to the site;
• role-based access for your team, and access to production systems limited to the people who run TroubleFree WP;
• daily backups, kept for a limited time, and monitoring of the service.

5. Service Providers

You authorize us to use the service providers on our Service Providers page. We'll update that page and email you at least 30 days before adding or replacing one. If you object on reasonable data protection grounds and we can't address it, you may stop using the affected part of TroubleFree WP or cancel, and we'll refund the unused part of any period you've paid for. We bind each provider to data protection terms at least as protective as this DPA and remain responsible for them.

6. Helping You

Taking into account what we can see, we'll help you respond to people exercising their rights, and with security, breach notifications, data protection impact assessments and consultations with authorities. If someone contacts us directly about information we process for you, we'll pass it on to you rather than answer it ourselves, unless the law requires otherwise.

7. Breaches

If we become aware of a breach of security affecting this information, we'll tell you without undue delay, and within 72 hours where we can, with what we know about it and what we're doing, and keep you updated.

8. Deletion

When you remove a site or delete your account, we delete the related information right away. Copies in our encrypted backups are deleted within 30 days. You can download your data in Account Settings before you leave.

9. Information And Audits

On request, we'll give you the information you reasonably need to show compliance with this DPA, such as answers to security questionnaires. If that isn't enough, you may audit our compliance once a year, with at least 30 days' notice, at your cost, during business hours, under a confidentiality agreement, and without access to other customers' information.

10. International Transfers

• We process information in the United States.
• For transfers of personal data protected by the EU GDPR, the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 are incorporated into this DPA: Module Two (controller to processor), or Module Three (processor to processor) where you act for your own clients. Clause 7 (docking) applies. Under clause 9, option 2 (general authorization) applies, with the notice period in section 5. The optional wording in clause 11 doesn't apply. Under clauses 17 and 18, the law and courts of Ireland apply. Annex I is section 1 of this DPA, with you as data exporter and us as data importer. Annex II is section 4. Annex III is our Service Providers page.
• For transfers from the UK, the International Data Transfer Addendum issued by the UK Information Commissioner applies to those clauses. Table 1 is completed with the parties' details here, Tables 2 and 3 with the choices above, and in Table 4 either party may end the Addendum as allowed by its section 19.
• For Switzerland, the same clauses apply, with references to the GDPR read as the Swiss Federal Act on Data Protection.

11. US State Privacy Laws

Where US state privacy laws, such as the California Consumer Privacy Act, apply to information we process for you, we act as your service provider or processor. We won't sell or share it, keep or use it for any purpose other than providing TroubleFree WP to you, or combine it with other information except as those laws allow.

12. Liability

Each party's liability under this DPA is subject to the limits in the Terms, except where the Standard Contractual Clauses or the law don't allow that.

13. Contact

Questions, or need a countersigned copy? Email support@troublefreewp.com or write to IDE Solutions LLC, 2945 West Peterson Avenue, Suite 103, Chicago, IL 60659, USA.