Data Processing Addendum
This Data Processing Addendum (“DPA”) forms part of the Terms of Service between WhoLayer, Inc. (“WhoLayer”) and Customer. It applies automatically when Customer accepts the Terms. Customers who need a countersigned copy can request one from legal@wholayer.com.
1. Definitions
“Data Protection Laws” means all privacy and data protection laws that apply to the processing of personal information under the Terms, including the California Consumer Privacy Act as amended (“CCPA”), other US state privacy laws, and, where applicable, the EU and UK GDPR. “Customer Personal Data” means personal information in Customer Data that WhoLayer processes on Customer's behalf. Terms such as “controller,” “processor,” “service provider,” “sell,” and “share” have the meanings given in Data Protection Laws.
2. Roles
- Customer Personal Data. For personal information Customer sends to the Service, such as tag events from Customer's website and records Customer uploads, Customer is the business or controller and WhoLayer is the service provider or processor.
- Output Data. For identity and contact data that WhoLayer supplies to Customer from its own database, WhoLayer and Customer are each independent businesses or controllers, and each is responsible for its own compliance.
3. Processing instructions
WhoLayer will process Customer Personal Data only to provide the Service under the Terms, on Customer's documented instructions (including through Customer's configuration of the Service), and as required by law. The subject matter, nature, purpose, categories of data, and categories of data subjects are described in Annex 1. WhoLayer will tell Customer if it believes an instruction violates Data Protection Laws.
4. CCPA service provider terms
With respect to Customer Personal Data, WhoLayer will not:
- sell or share it;
- retain, use, or disclose it for any purpose other than the business purposes in the Terms, including for its own commercial purposes or to build or improve profiles for other customers;
- retain, use, or disclose it outside the direct business relationship with Customer;
- combine it with personal information WhoLayer receives from other sources, except as the CCPA permits to perform the business purposes for Customer.
WhoLayer will comply with the CCPA, provide the same level of privacy protection the CCPA requires, notify Customer if it can no longer meet its obligations, and allow Customer to take reasonable steps to stop and remediate unauthorized use. WhoLayer certifies that it understands these restrictions.
5. Confidentiality and personnel
WhoLayer will ensure that anyone authorized to process Customer Personal Data is bound by confidentiality obligations and receives appropriate privacy and security training.
6. Security
WhoLayer will maintain the technical and organizational measures in Annex 2 and may update them as long as protection is not materially reduced.
7. Subprocessors
Customer authorizes WhoLayer to use the subprocessors listed on our subprocessors page. WhoLayer will impose data protection terms on each subprocessor that are at least as protective as this DPA and remains responsible for their performance. We will give at least 30 days' notice of a new subprocessor by updating that page and emailing customers who subscribe to updates. Customer may object on reasonable data protection grounds; if we cannot resolve the objection, Customer may terminate the affected Service and receive a prorated refund.
8. Consumer requests
WhoLayer will help Customer respond to requests from individuals exercising their privacy rights, taking into account the nature of the processing. If WhoLayer receives a request about Customer Personal Data, it will direct the individual to Customer unless the request also concerns WhoLayer's own data, in which case WhoLayer will handle that part directly. Opt-outs and deletions WhoLayer receives are added to its global suppression list across all customers.
9. Security incidents
WhoLayer will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data. The notice will describe the incident, the data affected, the likely consequences, and the measures taken, and WhoLayer will update Customer as more information becomes available. Notice is not an admission of fault.
10. Audits
On request no more than once a year, WhoLayer will provide its most recent third-party security audit report or, until one is available, a completed security questionnaire. If that is not enough to show compliance, Customer may conduct an audit on 30 days' notice, during business hours, at its own cost, under confidentiality terms, and without access to other customers' data.
11. International transfers
WhoLayer stores and processes data in the United States. Person-level identification is not provided for visitors outside the United States. Where company-level identification involves personal data from the EEA, UK, or Switzerland, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor), with the UK Addendum and Swiss amendments as applicable, which are incorporated by reference. Customer is responsible for obtaining any consent required before such data is collected.
12. Deletion and return
Within 30 days after the Terms end, WhoLayer will delete Customer Personal Data, except copies it must keep by law, which remain protected by this DPA. Customer may export its data before termination.
13. Customer responsibilities
Customer is responsible for providing the notices and obtaining the consents Data Protection Laws require for WhoLayer to process Customer Personal Data, including a privacy policy that discloses use of WhoLayer and a mechanism to opt out of sale and sharing that suppresses the WhoLayer tag.
Annex 1: Description of processing
| Data subjects | Visitors to Customer websites; individuals in records Customer submits; Customer's users. |
|---|---|
| Categories of data | IP address, cookie and device identifiers, browser and device type, pages viewed, referrer, timestamps; names, email addresses, phone numbers, job titles and companies in submitted records; user account details. |
| Sensitive data | None. Customer must not send sensitive data or install the tag on sensitive pages. |
| Purpose | Identifying website visitors, enriching and verifying records, delivering results to Customer's tools, and operating and securing the Service. |
| Duration | The term of the Terms, plus the deletion period in section 12. Tag events are kept up to 13 months. |
| Frequency | Continuous. |
Annex 2: Security measures
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
- Single sign-on and multi-factor authentication for all staff access to production systems; least-privilege access reviewed quarterly.
- Hashing of email addresses used for suppression and matching.
- Logical separation of each customer's data.
- Centralized logging of administrative access, retained 12 months.
- Automated dependency and vulnerability scanning; critical vulnerabilities patched within 7 days.
- Daily encrypted backups with point-in-time recovery; restore tested at least twice a year.
- Vendor security review before onboarding any subprocessor.
- A written incident response plan tested at least once a year.
- A SOC 2 Type II audit program, with the audit currently in progress.
Questions
Email legal@wholayer.com or write to WhoLayer, Inc., 1309 Coffeen Avenue, Suite 1200, Sheridan, WY 82801. For privacy requests, use our privacy request page.