Data Processing Addendum

This DPA forms part of the Terms at https://metricanic.com/terms between BushWell Inc. and the customer. It governs personal data processed on the customer's behalf (Customer Personal Data). The customer acts as controller or as an authorized processor for its own client. Metricanic acts as processor or subprocessor. Requirements referring to applicable data protection law apply only to the data and processing covered by that law.

We will process Customer Personal Data only on documented customer instructions unless law requires otherwise. Instructions consist of this agreement, supported service settings and authorized integrations. Further processing outside the agreed services requires a separate written agreement. We may refuse unlawful instructions and will notify the customer if we believe an instruction violates applicable data protection law. If law requires different processing, we will inform the customer unless legally prohibited.

The customer is responsible for the lawfulness, accuracy and source of Customer Personal Data, its instructions, required permissions and notices, and the legal basis for processing. A customer acting for another controller warrants that it has authority to engage us and provide instructions on that controller's behalf. The customer must select settings and data appropriate to its lawful purposes. We do not undertake to assess the customer's legal basis or provide compliance advice. This does not affect our duty to notify the customer of instructions we believe are unlawful.

The liability exclusions, single aggregate liability limit and customer indemnity in the Terms apply to this DPA to the extent permitted by law. This DPA does not create a separate liability allowance. These provisions do not restrict statutory rights of individuals, regulatory powers or responsibilities that applicable data protection law does not permit the parties to exclude.

The subject and purpose are providing the customer-selected tracking, reporting, routing, hosting and integration services. Processing includes collection, recording, analysis, storage, transmission and deletion for the service period and the return or deletion period below.

Data subjects are visitors, prospects and customers associated with customer campaigns and people whose data the customer lawfully includes in its content. Data may include IP addresses, online identifiers, device and browser information, approximate location, referring URLs, campaign details, activity, conversion data and customer-supplied content. Sensitive personal data is prohibited under the Terms.

We will maintain technical and organizational measures appropriate to the processing risks, including access restrictions and protection of data in transit. People authorized to process Customer Personal Data must be bound by confidentiality obligations.

We will not sell Customer Personal Data or share it for cross-context behavioral advertising. We will not use it outside the specified services or our direct business relationship, or combine it with data from other sources except as permitted by applicable law. We will comply with applicable obligations in our role as processor or service provider. Where the California Consumer Privacy Act applies to this processing, we will provide the same level of privacy protection it requires of businesses for Customer Personal Data.

We will notify the customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and provide available information and reasonable cooperation as required by applicable data protection law. The customer is responsible for notices to its clients, affected individuals and regulators where the law places that duty on the customer. A breach notice or assistance does not by itself admit fault or liability.

The customer authorizes subprocessors listed at https://metricanic.com/subprocessors. We will bind subprocessors to equivalent data protection obligations and remain responsible for their performance as required by law. Where required by applicable data protection law or an existing agreement, we will give notice of additions or replacements and an opportunity to object on reasonable data protection grounds before they process Customer Personal Data.

International transfers must comply with applicable data protection law and use a valid transfer mechanism where required.

As required by applicable data protection law, and taking account of the processing and information available to us, we will reasonably assist with individual rights requests, security obligations, breach notifications, data protection impact assessments and regulatory consultations.

Where required by that law, we will provide compliance information and allow reasonable audits, including inspections, by the customer or its independent auditor. Audits require reasonable prior notice and must avoid unnecessary disruption and protect other customers, subject to mandatory inspection rights and confidentiality safeguards. We will notify the customer if we can no longer meet applicable obligations. The customer may take reasonable steps to verify compliance and stop and remedy unauthorized processing.

The customer bears the cost of its own auditor unless applicable law requires otherwise. Additional assistance beyond the agreed services and our legal obligations requires a separate agreement on scope and fees. A fee discussion does not limit or delay assistance required by law.

At the end of the services, we will, at the customer's choice, return or delete Customer Personal Data and delete remaining copies unless law requires retention. Retained data remains protected under this DPA. Send instructions and data protection enquiries to privacy@metricanic.com.