Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the Terms of Service and every Service Agreement between Henderson Legacy LLC, doing business as NOVM ("NOVM") and a client ("Client"). It applies when NOVM processes personal information on the Client's behalf, such as information about the Client's customers, callers and staff ("Client Personal Data"). For that information, the Client is the business or controller and NOVM is the service provider, contractor or processor under the California Consumer Privacy Act (CCPA), the Colorado Privacy Act (CPA), other US state privacy laws, the EU General Data Protection Regulation (GDPR) and the UK GDPR ("Data Protection Laws").

1. What we process and why

• Subject matter and purpose: providing the services in the Service Agreement, such as answering calls, sending texts and emails, keeping customer records, running dashboards and briefs, and hosting websites.
• Types of data: names, phone numbers, email and mailing addresses, messages, call recordings and transcripts, job and billing records, and staff names, roles and hours.
• People: the Client's customers, prospects, callers and staff.
• Duration: for the term of the Service Agreement and the return or deletion period below.

2. NOVM's commitments

• We process Client Personal Data only on the Client's documented instructions (the Service Agreement, these terms and the Client's settings), and tell the Client if we believe an instruction breaks the law.
• We do not sell or share Client Personal Data, use it for targeted advertising, or retain, use or disclose it for any purpose other than providing the services, including outside our direct business relationship with the Client. We do not combine it with personal information from other sources except as the law allows for providing the services.
• We do not use Client Personal Data to train AI models.
• Everyone at NOVM who can access Client Personal Data is bound by confidentiality.
• We use appropriate technical and organizational security measures, including encryption in transit, encrypted storage of credentials, passkey sign-in, least-privilege access and activity logging.
• We help the Client answer requests from people using their privacy rights, and with security, breach notifications, data protection assessments and consultations with authorities, as the law requires.
• We notify the Client without undue delay, and within 72 hours where possible, after becoming aware of a breach affecting Client Personal Data, with the information the Client needs to meet its own obligations.
• We notify the Client if we can no longer meet our obligations under Data Protection Laws. The Client may then take reasonable steps to stop and fix unauthorized use.

3. Subprocessors

The Client authorizes NOVM to use these subprocessors, each bound by written terms that protect Client Personal Data at least as well as this DPA:

• Cloudflare, Inc.: hosting, security, databases and file storage (United States and global network)
• Google LLC: email and documents (United States)
• Stripe, Inc.: payments (United States)
• Twilio Inc. and Retell AI: calls and texts, when those features are used (United States)
• AI model providers used for AI features, under terms that do not allow training on Client Personal Data (United States)

We will tell Clients by email at least 30 days before adding or replacing a subprocessor. A Client may object on reasonable data protection grounds; if we can't resolve it, the Client may end the affected service without penalty.

4. International transfers

Client Personal Data is processed in the United States. Where GDPR or UK GDPR applies to a transfer, the parties agree to the European Commission's Standard Contractual Clauses (Module Two, controller to processor, or Module Three, processor to processor, as applicable), with the UK International Data Transfer Addendum, which are incorporated by reference, or rely on a valid adequacy framework such as the EU-U.S. Data Privacy Framework.

5. Audits

On written request, and no more than once a year unless required by a regulator or after a breach, NOVM will give the Client the information reasonably needed to show compliance with this DPA, and will allow and contribute to reasonable audits by the Client or an independent auditor, at the Client's cost, with reasonable notice and under confidentiality.

6. Return and deletion

When services end, NOVM will, at the Client's choice, return Client Personal Data in a common format or delete it within 90 days, unless the law requires us to keep it, in which case we keep it protected and use it for nothing else.

7. Client responsibilities

The Client is responsible for having a lawful basis and any required notices and consents for the Client Personal Data it gives NOVM or asks NOVM to collect, including consent for calls, recordings and texts, and for its own privacy policy.

8. General

If this DPA conflicts with the Terms of Service or a Service Agreement on personal data, this DPA controls, and the Standard Contractual Clauses control over this DPA where they apply. The limits of liability in the Terms of Service apply to this DPA as far as the law allows. Questions about this DPA: support@novm.co.