1.1 What this Addendum covers

This Addendum applies to personal information in the data Clickr reads from, or writes to, your connected systems and holds on your behalf ("Customer Personal Data"). It forms part of the Terms and Conditions (the "Agreement"). Our Privacy Policy covers the information we hold for our own purposes, such as your account and billing details.

1.2 Roles

You decide which systems to connect, which records are synced and where they are sent. For Customer Personal Data you are the controller, or the business, and we are your processor, or service provider, as those terms are used in the privacy laws that apply.

1.3 Your responsibilities

You are responsible for having the right to hold Customer Personal Data and to share it with us, for any notices and consents the law requires you to give, and for the accuracy of the instructions you give us.

2.1 Subject matter and purpose

We process Customer Personal Data to provide the service: signing into your connected systems, keeping your datasets in sync, performing the actions you request, and delivering data through the access paths you configure.

2.2 Duration

We process Customer Personal Data for the term of the Agreement and until it is deleted under clause 8.

2.3 Whose data and what kind

The data is whatever your connected-system account can see and you choose to sync. It typically relates to your clients, leads, staff, subcontractors and suppliers, and includes:

• names, email addresses, phone numbers and postal or site addresses;
• job, project, schedule, task and daily log records, and files attached to them;
• estimates, proposals, invoices, bills, purchase orders and other financial records; and
• staff records such as user accounts and time clock entries.

2.4 Sensitive information

The service is not designed for health information, government identifiers or other sensitive categories of personal information. Do not sync a dataset that contains them without telling us first.

3.1 Your instructions

We process Customer Personal Data only on your documented instructions, which are the Agreement, this Addendum and the way you configure and use the service. We will tell you if we believe an instruction breaks the law.

3.2 Limits on our use

We do not sell Customer Personal Data, share it for advertising, combine it with data from other sources for our own purposes, or use it for anything other than providing the service to you. We do not use it to train AI models.

3.3 Confidentiality

Access is limited to the people who need it to run and support the service, and they are bound by obligations of confidentiality.

4.1 Measures

We maintain technical and organisational measures appropriate to the risk, including:

• encryption at rest for the credentials you give us for connected systems;
• encryption of data in transit;
• scoping of every dataset, run and credential to the account that owns it;
• access controls that limit production access to authorised personnel; and
• logging and monitoring of the service, with alerts to our team when a run fails.

4.2 Incidents

If we become aware of unauthorised access to, or loss or disclosure of, Customer Personal Data, we will notify you without undue delay. We will tell you what happened, what data is affected and what we are doing about it, as that information becomes available, and help you meet your own notification obligations.

5.1 Current subprocessors

You authorise us to use the following providers to process Customer Personal Data:

• Amazon Web Services: application hosting, file storage and queues, in Sydney, Australia;
• MongoDB Atlas: database hosting;
• Stripe: payment processing;
• Twilio SendGrid: sending email, including emails your pipelines send; and
• Telnyx and Twilio: phone numbers that receive sign-in verification codes.

5.2 Changes

We will give you at least 30 days' notice before a new subprocessor starts processing Customer Personal Data. If you object on reasonable grounds and we cannot resolve it, you may cancel the affected connector and we will refund the fees you prepaid for the period after cancellation.

5.3 Our responsibility

We require each subprocessor to protect Customer Personal Data to a standard consistent with this Addendum, and we remain responsible to you for what they do with it.

5.4 Destinations you choose

An AI assistant, automation tool, webhook endpoint, file store or email recipient that you connect is not our subprocessor. We send data there on your instruction and your own arrangement with that provider applies.

6.1 Requests from individuals

If a person asks us to access, correct or delete their information and it is Customer Personal Data, we will pass the request to you and will not respond to it ourselves unless the law requires us to. We will give you reasonable help to respond.

6.2 Assessments and regulators

We will give you the information you reasonably need to carry out a privacy impact assessment or to answer a regulator about our processing.

6.3 Demonstrating compliance

On written request, no more than once in any 12 months unless there has been an incident, we will answer reasonable questions and provide the information needed to show that we comply with this Addendum.

7.1 Where data is processed

Our application infrastructure runs in Sydney, Australia. Some subprocessors process data in other countries, including the United States.

7.2 Transfers from Europe and the United Kingdom

Where the law of the European Economic Area, Switzerland or the United Kingdom applies to your transfer of Customer Personal Data to us, the European Commission's Standard Contractual Clauses (Module Two, controller to processor) and, for the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner's Office are incorporated into this Addendum. You are the data exporter, we are the data importer, and clauses 2, 4 and 5 of this Addendum supply the details those documents require.

8.1 During the Agreement

You can export your datasets at any time through the dashboard or the REST API.

8.2 After the Agreement ends

When the Agreement ends we stop syncing your connected systems. We will delete Customer Personal Data and your stored credentials within 30 days of a written request to support@clickr.cloud, except for copies the law requires us to keep, which stay protected by this Addendum.

9.1 Liability

The limits and exclusions of liability in the Agreement apply to this Addendum.

9.2 Order of precedence

If this Addendum and the rest of the Agreement differ on the handling of Customer Personal Data, this Addendum prevails. Where the documents in clause 7.2 apply and differ from this Addendum, they prevail.

9.3 Contact

Send questions and notices about this Addendum to support@clickr.cloud.