Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Signet and the business using Signet ("you", the "shop"). It applies automatically, with no separate signature needed. If you'd like a countersigned copy, email info@signetcrm.com.

1. Scope and roles

This DPA covers personal information about your customers and other people that you, or the Service on your behalf, put into Signet ("Customer Personal Data"). For that data, you are the controller (or "business") and Signet is your processor (or "service provider"), as those terms are used in the Texas Data Privacy and Security Act, the California Consumer Privacy Act and similar US state laws ("Privacy Laws").

2. Processing on your instructions

We process Customer Personal Data only to provide the Service, on your documented instructions. Your use and configuration of the Service, and these terms, are your instructions. If we believe an instruction breaks a Privacy Law, we'll tell you. You're responsible for having a lawful basis and any required notices and consents for the data you put into Signet, including consent to text or record calls where the law requires it.

3. Details of processing

• Purpose: providing Signet — records, estimates and invoices, approvals and signatures, bookings, receipt reading, AI Front Desk calls and texts, card payment links and support.
• Duration: for as long as you use the Service, plus the return and deletion period in section 10.
• People concerned: your customers, callers, people who text or book with you, suppliers, and your staff.
• Types of data: names, contact details, addresses, vehicle and equipment details, job and payment records, photos, signatures and approval audit data (including IP address), call transcripts and summaries, text messages and opt-out status, and receipts. We don't ask for sensitive data such as health or financial account numbers, and you shouldn't put it in free-text fields.

4. What we won't do

We will not:

• sell or share Customer Personal Data, including for targeted or cross-context advertising;
• keep, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you;
• combine it with personal information from other sources or other shops, except as Privacy Laws allow for providing the Service;
• allow any AI provider to use it to train models.

We'll tell you if we can no longer meet our obligations under Privacy Laws, and you may take reasonable steps to stop unauthorized use.

5. Confidentiality

Everyone at Signet who can access Customer Personal Data is bound to keep it confidential, and has access only as needed to run and support the Service.

6. Security measures

We maintain reasonable technical and organizational measures appropriate to the risk, including:

• a separate database for every shop, so one shop's records can't be reached from another's account;
• HTTPS encryption for all traffic, and security headers on every page;
• passwords stored as one-way hashes, rate-limited sign-in, protection against cross-site request forgery, and secure session cookies;
• customer document links protected by long random tokens;
• key-based administrative access to servers, and credentials kept out of source code;
• signed and verified webhooks from our payment and phone providers;
• nightly backups of every database and uploaded file, kept for 14 days plus monthly copies for 6 months.

7. Subprocessors

You authorize us to use the subprocessors listed on our subprocessors page. Each is bound by written terms that protect the data at least as well as this DPA. We'll update that page, and email you, at least 30 days before adding or replacing a subprocessor. If you object on reasonable data-protection grounds and we can't resolve it, you may cancel the affected part of the Service and get a refund of any prepaid fees for it. We remain responsible for our subprocessors.

8. Individuals' requests

If someone asks us directly to access, correct, delete or export their information, or to opt out, we'll pass the request to you promptly and won't respond ourselves except to direct them to you or as the law requires. You can handle most requests yourself in Signet; for anything you can't, we'll help within a reasonable time. We'll also give you reasonable help with data protection assessments where Privacy Laws require them.

9. Security incidents

If we become aware of unauthorized access to, or loss of, Customer Personal Data, we'll notify you without undue delay, and within 72 hours of confirming it. We'll tell you what happened, what data was affected, what we're doing about it and how you can reduce the harm, and we'll help you meet any notice duties you have.

10. Return and deletion

When your account ends, you have 30 days to ask for an export of Customer Personal Data. After that we delete it, except where the law requires us to keep it. Backup copies are overwritten on their normal cycle and stay protected by this DPA until then.

11. Information and audits

On reasonable request, we'll give you the information needed to show we comply with this DPA and Privacy Laws, including answers to security questionnaires. If that isn't enough, and no more than once a year, we'll cooperate with a reasonable audit at your cost, with 30 days' notice and under confidentiality.

12. Where data is processed

Signet is based in the United States and stores Customer Personal Data in the United States. Some subprocessors, such as our AI providers, may process data in other locations under their own safeguards. Signet is offered to US businesses.

13. General

If this DPA and the Terms of Service conflict about personal information, this DPA wins. Liability under this DPA is subject to the limits in the Terms of Service. We may update this DPA as laws change; material changes are announced as described in the Terms.