Legal · DPA
TradesKit — Field Service Management Software
This Data Processing Addendum ("DPA") forms part of the Terms of Service or other agreement (the "Agreement") between Cascade Software Solutions LLC ("Processor," "we," "us," or "our") and the customer identified in the order ("Controller," "you," or "your") for the provision of the TradesKit field service management service (the "Service"). This DPA applies whenever we process personal information on your behalf and to the extent the processing is subject to applicable data protection law.
In the event of conflict between the Agreement and this DPA on the subject of personal-information processing, this DPA controls.
Unless otherwise defined here, terms have the meaning given in the Agreement.
This DPA governs the second role. The first role is governed by our Privacy Policy.
We Process Personal Information only:
We will not Process Personal Information for any other purpose.
We do not "sell" or "share" Personal Information (as those terms are defined under Applicable Data Protection Laws), and we do not use Personal Information for cross-context behavioral advertising or for targeted advertising. We are a "Service Provider" under the CCPA/CPRA.
You will:
We will:
We implement and maintain appropriate technical and organizational measures designed to protect Personal Information against Security Incidents. These measures are described in Exhibit A and are reviewed periodically.
You acknowledge that the security measures provide protection commensurate with the nature of the Personal Information we Process and the risks to Data Subjects, subject to your obligation to configure and use the Service consistently with the measures (for example, by enabling two-factor authentication, applying role-based access controls, and not uploading Sensitive Personal Information into fields not designed for it).
We will notify you of a Security Incident affecting your Personal Information without undue delay and in any event within seventy-two (72) hours after we become aware of it. The notification will include:
We will provide reasonable assistance to you in fulfilling your obligations to notify supervisory authorities and Data Subjects.
We will document Security Incidents and our response, and make those records available to you on reasonable request, subject to confidentiality and security-information sensitivities.
You authorize us to engage Sub-processors to Process Personal Information in connection with the Service. We require each Sub-processor to be bound by contractual obligations at least as protective as those in this DPA with respect to Personal Information they Process on your behalf.
A current list of Sub-processors (names and categories) is set out in Section 7 of our Privacy Policy; additional detail (purposes and processing locations) is available on request by emailing privacy@tradeskit.io. We will notify you of changes to that list as described in Section 6.3.
We will give you at least thirty (30) days' advance notice of any new Sub-processor or material change in the role of an existing Sub-processor that Processes Personal Information on your behalf.
You may object to a new Sub-processor on reasonable grounds relating to the protection of Personal Information by written notice to us within thirty (30) days of our notice. If you object, we will use commercially reasonable efforts to (a) propose an alternative arrangement that does not require the Sub-processor, or (b) replace the Sub-processor. If we cannot do either, you may terminate the affected portion of the Service and receive a pro-rated refund of any pre-paid unused fees for the affected portion.
On reasonable written request, we will provide you with information reasonably necessary to demonstrate compliance with this DPA, including (where available) our most recent SOC 2 Type II report or equivalent third-party audit report, our published Information Security Program summary, and our subprocessor list.
If the information we provide under Section 7.1 is not reasonably sufficient to demonstrate compliance, you may, no more than once in any twelve (12) month period (unless additional audits are required by Applicable Data Protection Laws or follow a Security Incident), conduct an audit through a qualified independent third-party auditor under reasonable terms (including reasonable notice of at least thirty (30) days, scope limited to compliance with this DPA, confidentiality obligations consistent with this DPA, and reasonable cooperation by both parties).
You will pay the costs of the audit. We will reasonably cooperate. You will not have access to data of other customers, information protected by confidentiality obligations to third parties, information that would compromise security, or our trade secrets and proprietary information.
We will provide reasonable assistance to you in responding to Data Subject rights requests under Applicable Data Protection Laws, including requests for access, correction, deletion, portability, and opt-out. Where a Data Subject contacts us directly about Personal Information we Process on your behalf, we will refer the Data Subject to you (the Controller) and reasonably notify you of the request.
The Service includes tools that allow you to perform certain Data Subject rights operations directly. To the extent you can fulfill a request through Service tools, that is the expected mechanism; otherwise, contact us and we will provide reasonable assistance.
On termination or expiration of the Agreement, we will, at your written election (a) return Personal Information to you in a portable format (such as CSV or other agreed format) within a reasonable time, or (b) securely destroy Personal Information, in each case subject to:
If you do not make an election within the sixty (60) day window, we may securely destroy Personal Information in the ordinary course of business.
We may generate de-identified and aggregated data derived from Personal Information and from your use of the Service, and we may use that de-identified and aggregated data to operate, secure, improve, and develop the Service, provided that we (a) take reasonable steps to ensure the data cannot be reasonably linked to a Data Subject, (b) publicly commit to maintain and use the data in de-identified form, and (c) contractually prohibit recipients from re-identifying it.
To the extent we Process Personal Information of Data Subjects located in the European Economic Area, the United Kingdom, or Switzerland and that Processing involves a transfer to a country that has not received an adequacy decision, the parties incorporate by reference the European Commission Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (the "SCCs") and the UK Addendum issued by the UK Information Commissioner's Office, with:
Each party's liability under this DPA is subject to the limitations and exclusions in the Agreement. Claims under this DPA may be brought only between the contracting entities.
In the event of conflict between the Agreement and this DPA on the subject of personal-information processing, this DPA controls. Provisions of this DPA that by their nature should survive (including return/destruction, audits, security incident, and survival of confidentiality obligations) will survive termination of the Agreement.
This DPA is governed by the governing law of the Agreement, except that to the extent Applicable Data Protection Laws or the SCCs require otherwise, those laws govern the relevant Personal Information processing.
For DPA-related matters (including Sub-processor objections, audit requests, Security Incident notifications):
Cascade Software Solutions LLC, Attn: Privacy / DPA, 5441 S Macadam Ave, Ste N, Portland, OR 97239, USA, Email: privacy@tradeskit.io
We maintain an information-security program designed to protect Personal Information. The program includes the measures below, which we may update from time to time provided that the level of protection is not materially reduced.
This DPA forms part of the Agreement and is effective on the same date as the Agreement.