Check Terminal Data Processing Addendum

Definitions

• “Customer Personal Data” means personal information in Customer Data that we process on your behalf. It does not include information we handle for our own purposes, as our Privacy Policy describes.
• “Data Protection Laws” means the privacy and data protection laws that apply to that processing. These may include the EU General Data Protection Regulation (GDPR), the UK GDPR, the Swiss Federal Act on Data Protection, and US state laws such as the California Consumer Privacy Act.
• “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR. Where US state laws apply, “controller” includes “business” and “processor” includes “service provider”.
• “Subprocessor” means a third party we engage to process Customer Personal Data.
• “Security Incident” means a breach of our security, or of our Subprocessors’ security, leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data on systems that we or our Subprocessors control. It does not include unsuccessful attempts that do not compromise that data, such as pings, port scans or failed sign-in attempts. It also does not include access or loss that results from you or your team not keeping logins, devices or downloaded files secure, or from information you or your team send outside the Service.

Roles and instructions

You are the controller of Customer Personal Data, and we are your processor. If you are a bookkeeper or accountant using the Service for a client, you may be that client’s processor. In that case we are your subprocessor, and you are responsible for passing on your client’s instructions and for having its authorization.

We process Customer Personal Data only on your documented instructions. Your instructions are these Terms, this DPA, your settings in the Service and the actions you and your team take in it. We may also process it where the law requires us to. In that case we will tell you first, unless the law forbids it.

We will tell you if we believe an instruction breaks Data Protection Laws. We are not required to follow that instruction.

You are responsible for the lawfulness of the processing you instruct, including having a legal basis for it, giving the notices and getting the consents the law requires, and the accuracy of Customer Personal Data.

Details of the processing

• Subject matter and purpose: providing the Service under the Terms, including creating, approving, printing and tracking checks, building Positive Pay files and exports, syncing with QuickBooks Online when you connect it, sending notifications and reports, and securing and supporting the Service.
• Nature of the processing: collecting, storing, organizing, retrieving, using, transmitting, displaying and deleting.
• Duration: for as long as we provide the Service to you, and afterwards until the data is deleted as described in the Terms.
• Categories of data subjects: your team members and users; your payees, vendors and employees paid by check; people whose signatures you upload; and, for bookkeepers and accountants, your clients’ personnel.
• Types of personal data: names, email addresses, phone numbers, postal addresses, payment amounts, dates, memos and invoice numbers, bank details you enter, signature images, the contents of attachments you upload, and records of activity in the Service.
• Special categories of data: none are intended. The Terms forbid putting sensitive data such as Social Security numbers, health information or payment card numbers into the Service.

Our personnel

We make sure that everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality, and that they access it only as needed to provide, secure and support the Service or to comply with law.

Security

We maintain technical and organizational measures designed to protect Customer Personal Data, taking into account the state of the art, the cost, and the nature, scope, context and purposes of the processing and its risks. They include:

• encryption of data in transit (HTTPS) and field-level encryption of bank routing and account numbers, EINs and QuickBooks access tokens in our database;
• private file storage reachable only through links that expire;
• role-based permissions that you control, and authentication through our sign-in provider;
• activity logs that record changes and cannot be edited;
• rate limiting and protection against duplicate requests; and
• keeping our software and dependencies updated for security fixes.

We may update these measures over time, as long as the overall level of protection does not decrease. You are responsible for the security measures in your control, such as user access, permissions, devices and the files you download.

Subprocessors

You give us general authorization to use Subprocessors. Our current Subprocessors are listed in our Privacy Policy at checkterminal.com/privacy, under “How we share information”.

Before we add or replace a Subprocessor, we will update that list and notify account administrators by email or in the Service at least 15 days before the new Subprocessor processes Customer Personal Data. You may object on reasonable data protection grounds within that period by emailing support@checkterminal.com. If we cannot reasonably address your objection, you may cancel your subscription as described in the Terms, and we will refund the fees you prepaid for any period after the new Subprocessor begins processing your Customer Personal Data. This is your only remedy for an objection. If we must replace a Subprocessor urgently, for example because it stops providing its service or for security reasons, we may do so without advance notice, and we will notify you as soon as reasonably practical. Your objection period then starts from that notice.

We will impose data protection obligations on each Subprocessor that are at least as protective as those in this DPA. Where Data Protection Laws require it, we remain responsible to you for our Subprocessors’ performance of those obligations, subject to the limitation of liability in the Terms.

Requests from individuals

If we receive a request from an individual about Customer Personal Data, we will pass it to you and will not respond ourselves, except to tell the individual to contact you. Taking into account the nature of the processing, we will give you reasonable help to respond, including through features of the Service and by email at support@checkterminal.com.

Security incidents

We will notify you without undue delay after we become aware of a Security Incident. We will send the notice to the email address on your Account. As information becomes available, we will tell you what happened, the categories and approximate number of individuals and records affected, the likely consequences and the steps we have taken or propose to take.

We will take reasonable steps to contain and investigate a Security Incident and reduce its effects. You are responsible for any notifications that Data Protection Laws require of the controller. Our notice of, or response to, a Security Incident is not an admission of fault or liability.

Impact assessments and consultations

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments and prior consultations with regulators that Data Protection Laws require of you about the Service. We may charge a reasonable fee for help that takes significant effort.

Deletion and return

You can export Customer Data as described in “Exporting and deleting your data” in the Terms. We do not delete Customer Personal Data automatically. At your choice, after your Account ends you may export it as described in the Terms, ask us to delete it, or both. When you ask us in writing to delete it, we will do so within 30 days of verifying the request. We may keep copies the law requires us to keep, activity logs and billing records as described in the Terms and our Privacy Policy, and copies in routine backups until they are deleted in the normal course. We will keep protecting anything we keep under this DPA.

Information and audits

On request, we will make available the information reasonably necessary to show that we meet our obligations under this DPA, for example by answering a written security questionnaire once a year. If that information is not enough to satisfy a requirement of Data Protection Laws or a regulator, you may audit our compliance at your own cost, and you will reimburse our reasonable costs of supporting the audit. You must give us at least 30 days’ notice, agree the scope with us in advance, keep everything you learn confidential, and avoid disrupting our business or other customers’ data. You may audit no more than once in any 12 months, unless a regulator requires it or after a Security Incident.

International transfers

We store Customer Personal Data in the United States, and our Subprocessors may process it in other countries. Where the GDPR, the UK GDPR or Swiss law restricts a transfer of Customer Personal Data to us, the transfer is made under the Standard Contractual Clauses adopted by the European Commission in Decision 2021/914 (the “SCCs”), which are incorporated into this DPA by reference:

• Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor.
• Clause 7 (docking clause) does not apply. Under Clause 9, option 2 (general written authorization) applies, with the notice period in “Subprocessors”. The optional wording in Clause 11 does not apply.
• Under Clauses 17 and 18, the SCCs are governed by the laws of Ireland, and disputes go to the courts of Ireland.
• Annex I is completed by “Details of the processing” and the parties named in this DPA, with you as data exporter and us as data importer. Annex II is completed by “Security”. Annex III is our Subprocessor list.
• For transfers from the UK, the UK International Data Transfer Addendum to the SCCs applies, completed with the information above, and either party may end it as its Section 19 allows.
• For transfers from Switzerland, references to the GDPR mean the Swiss Federal Act on Data Protection, and the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority.

If the SCCs conflict with this DPA or the Terms, the SCCs control.

US state privacy laws

Where US state privacy laws apply, we act as your service provider or processor and follow the commitments in “Data processing” in the Terms, including that we do not sell or share Customer Personal Data, or keep, use or disclose it for any purpose other than providing the Service.

Liability and term

Our liability arising out of or relating to this DPA is subject to “Disclaimers” and “Limitation of liability” in the Terms, including the exclusions listed there and the single total limit, which applies to all claims arising out of or relating to the Service, the Terms and this DPA together, except where Data Protection Laws or the SCCs do not allow it to be limited. Nothing in this DPA limits your obligations under “Indemnification” in the Terms, or any right that a data subject has directly under Data Protection Laws.

This DPA lasts as long as we process Customer Personal Data for you. We may update it as described in “Changes to the Service and to these Terms” in the Terms, but we will not reduce the protection it gives Customer Personal Data unless the law requires us to.

Contact us

For questions about this DPA or our Subprocessors, email support@checkterminal.com with “DPA” in the subject line.