Data Protection Addendum

1. Roles and scope

This addendum applies whenever Rawi Studios LLC ("Rawi", "we") builds, hosts or maintains a platform for you ("the client", "you") and in doing so handles personal data about your customers, leads or other contacts. You decide why and how that data is processed, so you are the controller. Rawi processes it on your behalf, so we are the processor, as those terms are used in the New Jersey Data Privacy Act and similar state privacy laws.

Those laws only apply to businesses above certain thresholds (in New Jersey, for example, controllers handling the data of 100,000 or more consumers, or 25,000 or more while earning revenue from selling data). We offer this addendum to every client regardless of size, because it describes how we work.

2. Instructions and purpose

We process your customers' personal data only to provide the services in your signed estimate: building, hosting, operating, supporting and securing your platform, and delivering the email and notifications it sends. Your instructions are the estimate, this addendum, and anything you ask of us in writing later. If we believe an instruction would break the law, we will tell you rather than follow it.

3. Types of data and data subjects

Depending on what your platform does, the people and data involved may include:

• Leads and inquirers: name, email, phone number, event or project details, and the messages they send you.
• Past and current clients of yours: contact details, bookings, documents and correspondence you keep in the platform.
• Newsletter recipients: name, email address, subscription status and basic delivery records such as opens and bounces.
• Your team: names and sign-in details for the people who use your platform.

We do not ask you to collect sensitive data through the platform. If you need to, tell us first so we can agree on extra safeguards.

4. Duration

This addendum lasts for as long as Rawi processes personal data for you, and continues until that data is deleted or returned under section 10.

5. Confidentiality

Everyone at Rawi who can access your customers' data is bound by a duty of confidentiality, and only people who need access to do the work have it.

6. Security measures

We use technical and organizational measures suited to the data we handle, including:

• Encryption in transit and at rest, managed by our hosting providers.
• Access limited to Rawi personnel, each signing in with 2-step verification.
• Least privilege: people and services get only the access their work needs.
• Database rules that allow administrators only, with public pages served through narrow server routes.
• Keyless server credentials, so there are no long-lived secret keys to leak.
• Daily database backups, kept for up to 14 weeks.
• A record of who has accessed your data, which we will review with you on request.

7. Subprocessors

We use the following providers to run your platform. Each is bound by data protection terms that impose obligations at least as protective as this addendum. We will tell you before adding or replacing a subprocessor, so you have the chance to object.

8. Assistance with consumer requests

Your customers may have the right to access, correct or delete their personal data, or to opt out of certain processing. If one of them asks you, we will help you answer within 10 business days of your request, for example by exporting, correcting or deleting their records. If one of them contacts us directly, we will pass the request to you rather than answer it ourselves.

9. Breach notification

If we confirm a security breach affecting your customers' data, we will tell you without undue delay and within 72 hours of confirming it. We will share what happened, what data was involved, what we have done about it, and what we need from you, and we will keep you updated as we learn more.

10. Deletion and return

When our services end, we will return your customers' data to you in a usable export, or delete it, whichever you choose, within 30 days. Copies held in backups age out within 14 weeks and are never restored for any other purpose. We keep only what the law requires us to keep, such as invoices for our own accounts.

11. Demonstrating compliance and assessments

On a reasonable written request, we will give you the information you need to show that this addendum is being followed, and we will allow and contribute to reasonable assessments of our practices by you or an assessor you choose who is bound by confidentiality. We ask that these happen no more than once a year, unless a breach gives reason for another.

12. Aggregated and de-identified data

Data that has been de-identified, so it can no longer be linked to a person, is not personal data. Many providers reserve the right to create anonymous statistics from all their clients' data. We hold ourselves to a stricter rule:

• We include your data in aggregated benchmarks only if you opt in. It is off by default.
• Benchmarks never identify any person or your business, and we never try to re-identify anyone.
• We only publish figures that combine at least 5 clients.
• You can withdraw your opt-in at any time, and we will leave your data out of anything produced afterwards.

13. Case studies

We feature your project as a case study only if you opt in and approve the final wording before it is published. You can withdraw your opt-in at any time, and we will take down anything that has not yet gone out.

14. What Rawi will never do

• Sell your customers' personal data.
• Use one client's customer data for another client, or to benefit another client.
• Market to your customers, for ourselves or anyone else.
• Use your customers' data to train third-party AI models.

15. Changes to this addendum

When we change the substance of this addendum, we publish a new version with a new version number and tell existing clients before it takes effect. Each signed estimate records the version that was accepted.

16. Contact

Questions about this addendum or about your data go to hi@rawistudios.com.