data processing addendum (template)

status: draft for legal review — not a binding legal instrument until signed by an authorised representative of jollygig and countersigned by the customer. have your legal counsel review before executing.

blanks. the bracketed items marked "to be completed by jollygig before signature" are jollygig's own details; we fill them in when we prepare a copy for you. the items in brackets for the customer are yours.

recitals

this data processing addendum ("dpa") is entered into between:

data controller (customer): [customer legal name], [registered address], [jurisdiction] ("controller" or "customer")

data processor (jollygig): [jollygig operating entity — to be completed by jollygig before signature], [registered address — to be completed by jollygig before signature], delaware, usa ("processor" or "jollygig")

and forms part of the jollygig terms of service at jollygig.com/terms ("the agreement") for the team health and scheduling products, as used by the controller ("the service"). in the event of conflict between this dpa and the agreement, this dpa controls for matters of data protection.

1. definitions

1.1 "applicable data protection law" means, as applicable to the parties:

• (a) the eu general data protection regulation (eu) 2016/679 ("gdpr");
• (b) the uk general data protection regulation and the data protection act 2018 ("uk gdpr");
• (c) the california consumer privacy act of 2018 as amended by the cpra ("ccpa");
• (d) canada's personal information protection and electronic documents act ("pipeda") and applicable provincial equivalents;
• (e) any other privacy or data protection law that applies to the controller's use of the service.

1.2 "personal data" has the meaning given in applicable data protection law.

1.3 "special categories of personal data" has the meaning given in article 9 of the gdpr. the service is not designed to process special category data; the controller must not submit special category data.

1.4 "data subjects" means the individuals whose personal data is processed under this dpa — principally the controller's employees and contractors who use the service as managers or members.

1.5 "processing", "controller", "processor", "sub-processor", and "supervisory authority" each have the meanings given in the gdpr.

2. scope and purpose of processing

2.1 jollygig processes personal data only on documented instructions from the controller, including those in this dpa and the agreement.

2.2 the categories of personal data processed are:

2.3 survey responses are anonymous by structural design. the service does not store the identity of who submitted a survey response. the response document contains only { teamId, windowId, domain, emotion, intensity }, plus, where the team uses bands, the band chosen for each dimension it uses — no user_id, no email, no timestamp finer than the check-in window (the windowId is the date the check-in opened, the same for everyone on the team). this is enforced at the database layer, not merely in application code. jollygig treats survey responses as non-personal aggregate data because they carry no identifier; see the privacy policy at jollygig.com/privacy.

2.4 scheduling content is the controller's. the service does not derive individual performance data from estimates or actuals. where a scheduling workspace is linked to a team, each forecast run stores only a population-level snapshot of that team's aggregate signals, and only when at least 5 members responded.

2.5 the purpose of processing is the provision of the team health and scheduling services as described in the agreement.

3. controller obligations

3.1 the controller warrants that:

• (a) it has a lawful basis for providing personal data to jollygig;
• (b) it has given data subjects appropriate notice of processing as required by applicable law;
• (c) it will not submit special category personal data to the service;
• (d) it will inform jollygig promptly of any instructions that it believes would cause jollygig to violate applicable data protection law.

4. processor obligations

4.1 jollygig will:

• (a) process personal data only on the controller's documented instructions, unless required to do otherwise by applicable law (in which case jollygig will notify the controller before processing, unless prohibited by law);
• (b) ensure that personnel authorised to process personal data are subject to appropriate confidentiality obligations;
• (c) implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access (see schedule 2 for a summary of current measures);
• (d) assist the controller, to the extent reasonably possible and at the controller's cost, with subject access requests, data portability requests, erasure requests, and other requests from data subjects exercising rights under applicable data protection law;
• (e) notify the controller without undue delay (and in any event within 72 hours) after becoming aware of a personal data breach affecting controller data;
• (f) on termination of the agreement, meaning deletion of the organization by the customer, delete the personal data immediately and purge it from backups within 14 days; while the subscription is cancelled but the organization exists, retain the data read-only for the customer, who can export or delete it at any time. jollygig will return the data (an export) at the controller's request before deletion, unless applicable law requires longer retention;
• (g) provide the controller with information reasonably necessary to demonstrate compliance with this dpa, and allow and contribute to audits conducted by the controller or its auditor, provided that the controller gives at least 30 days' written notice and the audit does not unreasonably disrupt jollygig's operations.

5. sub-processors

5.1 the controller grants general authorisation for jollygig to use the sub-processors listed at jollygig.com/subprocessors ("the sub-processor list"), as updated from time to time. at the date of this template they are:

5.2 jollygig will:

• (a) notify the controller at least 30 days before adding or replacing a material sub-processor;
• (b) impose data protection obligations on sub-processors that are equivalent to those in this dpa;
• (c) remain liable to the controller for the acts and omissions of sub-processors as if they were jollygig's own.

5.3 if the controller objects to a new sub-processor, it must notify jollygig in writing within 30 days of the notice. the parties will work in good faith to resolve the objection. if resolution is not possible, either party may terminate the agreement on 30 days' written notice without penalty.

6. international data transfers

6.1 where processing involves a transfer of personal data from the eea, uk, or another jurisdiction with transfer restrictions to a country not recognised as providing adequate protection, the transfer is made subject to standard contractual clauses ("sccs") as incorporated in schedule 3, unless another valid transfer mechanism applies.

6.2 for transfers to google / firebase: google's data processing addendum (including sccs) is accepted at account creation. details at cloud.google.com/terms/data-processing-addendum.

6.3 for transfers to stripe: stripe's dpa (including sccs) is available at stripe.com/legal/dpa.

6.4 for transfers to mailchimp transactional (the email delivery provider): mailchimp's data processing addendum (including sccs) is available at mailchimp.com/legal/data-processing-addendum.

6.5 godaddy provides dns only and receives no personal data of the controller or its members.

7. confidentiality

7.1 each party will keep the other's confidential information confidential and will not disclose it to third parties without prior written consent, except as required by law or as permitted under this dpa.

8. liability

8.1 each party's liability under this dpa is subject to the limitation of liability clause in the agreement, except where applicable data protection law does not permit such limitation (for example, where the processor's liability to data subjects cannot be excluded by contract).

9. term and termination

9.1 this dpa is effective from the date both parties execute it and remains in force until the agreement terminates or all processing of controller personal data by jollygig ceases, whichever is later.

10. governing law and jurisdiction

10.1 this dpa is governed by the laws of the state of delaware, usa, without regard to conflict- of-laws principles.

10.2 for eea/uk customers, to the extent required by applicable data protection law, the supervisory authority of the controller's principal establishment has jurisdiction over complaints relating to this dpa.

schedule 1 — details of processing

schedule 2 — technical and organisational measures

the following is a summary of jollygig's current technical and organisational security measures. this schedule may be updated from time to time provided the overall level of protection is not materially reduced.

access control

• magic-link only sign-in (no passwords stored). session cookies are httponly, secure, samesite=strict.
• firebase security rules enforce row-level access; no client can read another user's account data.
• production firebase credentials are held only in the hosting environment's encrypted config; not in source code or version control.

data isolation and anonymity

• survey response collection has no user_id field. client-side writes to this collection are blocked by firestore security rules.
• strata breakdowns are suppressed below 5 respondents (structural rule, enforced server-side).

infrastructure

• all data stored on google cloud firestore in the nam5 multi-region (iowa, south carolina); the application and its scheduled jobs run in us-central1 (iowa).
• all traffic over tls 1.2 or higher; no http-only endpoints.
• firebase app hosting (cloud run) provides automated container isolation and no persistent disk.

incident response

• server-side errors logged with structured jsonpayload to cloud logging; no user content is logged.
• breach notification to controller within 72 hours of discovery (see section 4.1(e)).

employee / contractor access

• only personnel who need access to production data for support or development purposes are granted it, and only with documented justification.
• contractors are bound by confidentiality obligations at least as stringent as those in section 7.

schedule 3 — standard contractual clauses

[if applicable, attach the relevant eu commission scc module (controller-to-processor, module 2) or uk addendum here. for most customers in the eea and uk, jollygig's data flows to google and stripe are already covered by those processors' own sccs. this schedule is needed when the controller itself is transferring personal data to jollygig from the eea/uk and jollygig is acting as processor.]

placeholder — to be completed by legal counsel with the appropriate scc text for the controller's jurisdiction.

signatures

signed for and on behalf of [customer legal name]:

signed for and on behalf of jollygig:

this document was last reviewed on [date — to be completed by jollygig before signature]. legal review by jollygig's counsel is outstanding.