Data Processing Addendum

This Addendum forms part of the Terms of Service between Overlook Innovations, LLC ("we", "us") and your firm ("you"). It sets out how we handle the personal information your clients send you through Cartenda.

It applies automatically. There is nothing to sign and nothing to request — if you have an account, these terms are already in force between us.

1. Which of us is which

You decide what information to collect, from whom, why, how long it is kept and when it goes. That makes you the business — the controller — of your clients' information.

We hold and process it only to provide the Service to you. That makes us your service provider — your processor. We are not a third party to whom you have sold or shared personal information, and no part of what you pay us is consideration for personal information.

Where the Service reads your clients' documents, that is processing carried out on your instructions, for you, and for no purpose of our own.

2. What we process, and why

If one of your clients reports a problem with a form they were sent, what they write reaches us as well as you, so that we can fix the form. We read it only for that, keep it for no more than a year, never write to your client about it, and delete it with the rest when your workspace closes.

Because this product is used by financial advisors and planners, accountants and tax preparers, lenders, and real estate and insurance professionals, the documents in scope routinely include account and retirement statements, tax returns, pay stubs and bank statements, insurance and estate documents, and government identification.

3. Our undertakings as your service provider

We will:

• Process only on your instructions. Your use of the Service, and this Addendum, are those instructions. If we ever believed an instruction required us to break the law, we would tell you rather than carry it out.
• Not sell or share your clients' information, as those words are used in the California Consumer Privacy Act, and not for cross-context behavioural advertising. There is no advertising in this product and no analytics vendor in it.
• Not retain, use or disclose the information for any purpose other than providing the Service, including not combining it with information we receive from anyone else, except as the law permits a service provider to.
• Not use it to train machine-learning models, ours or anyone else's, and not permit our providers to.
• Keep it confidential, and bind everyone with access to the same duty.
• Limit access to those who need it to run or repair the Service. Every document opened through the Service is recorded in your firm's audit log — by anyone, our own staff included — where you can read it and nobody can alter it. Access to the systems beneath the Service, which our engineers need to keep it running, is bound by the confidentiality above and is not recorded in your firm's audit log.
• Help you meet a request from one of your clients, respond to an incident, and answer your own regulator, at no extra charge for anything reasonable.
• Tell you if we can no longer meet these obligations.

You may take reasonable steps to confirm we are doing the above. Ask at privacy@cartenda.com; our security page answers most of it, and we will answer a questionnaire.

4. Security

We maintain technical and organisational measures appropriate to information of this sensitivity. What they are, in specifics, is on the security page rather than described in general terms here, because a list you can check is worth more than an adjective.

5. People who work on the Service with us

You permit us to use subprocessors. Every one is named on the subprocessors page, with what it does and where.

Each is bound by written terms no less protective than these, and we remain responsible to you for what they do. If we add one, we will update that page and give notice before it starts processing your clients' information. If you object on reasonable grounds, tell us at privacy@cartenda.com and if we cannot resolve it you may cancel without penalty for the unused part of your term.

6. Tax return information

Some firms that use the Service also prepare tax returns. Where your firm is a tax return preparer and the information is tax return information, we act as an auxiliary service provider under Treasury Regulation §301.7216-2(d): we use it only to provide the Service to you, we do not disclose it further except as those rules allow, and we do not use it for any purpose of our own.

Obtaining any consent §7216 requires from your client before you use or disclose their information remains your responsibility. The Service can deliver a consent document for your client to sign, but what that document says, and whether it meets §7216 and Revenue Procedure 2013-14, is yours to decide.

7. Requests from your clients

If one of your clients contacts us directly about their information, we will not act on it ourselves. We will tell them to contact your firm, and tell you it happened. The information is yours to correct, produce or erase — you have the tools to do all three in the Service.

Erasing a client removes their documents, answers, requests and identity, with seven exceptions:

• Earlier entries in your audit log that name them remain, because that log cannot be altered by anybody, and the erasure itself is recorded without naming them.
• Their address stays on our list of addresses not to write to, which is what makes sure nobody does.
• A scrambled fingerprint of their phone number and email address stays for up to two years after you last wrote to them. It is not the number or the address and cannot be turned back into either without a key only our systems hold. It is used only so that a STOP or a bounce reaches every firm that wrote to them, and to count how many people were texted in a month.
• A signature they gave alongside someone else, such as on a spouse's account agreement, stays on that person's signed copy, with their name, how they were contacted to confirm it and where they signed from, because it is what shows the document was signed. It goes when you delete that copy.
• Accounts recorded for a client group they shared with someone else, such as a household or a business, stay with that client group without their name, because they are part of the other member's record too. They go when that client group is deleted.
• Copies of their documents that you kept in the vault of a client group that someone else is still in stay in that vault, no longer linked to them, because they are part of that client group's record. They go when you remove them or that client group is deleted.
• Their part of somebody else's request, such as a spouse's or a business partner's, stays with that request: their name and contact details on it, and the answers and documents they sent in it, because they are part of the other client's record. Their answers and documents go when that reply is deleted; their name and contact details stay as long as the request does.

8. Incidents

If we become aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorised disclosure of or access to your clients' information, we will tell you without undue delay, and in any event within 72 hours of becoming aware of it.

We will tell you what happened, which information and roughly how many people were affected, what we have done, and what we advise you to do. We will keep telling you as we learn more. Notifying the people affected and any regulator is yours to do, because the relationship is yours; we will give you what you need to do it.

If your firm is an investment adviser subject to Regulation S-P, this is the notice a service provider owes you under it, and it is written so that you can tell affected clients within the time that rule gives you.

9. Deletion and return

Documents are kept until you set a retention window. If you set one, documents are permanently deleted when it expires — genuinely deleted, not hidden or flagged — and we email you before they go.

A file you keep in a client group's vault is the other way round. You put it there to be kept, so your retention window does not reach it: it stays until you remove it, the client group is deleted, or your workspace closes, and each of those deletes it permanently. A client's document you add to a vault is a copy, so deleting the original under your window leaves the vault's copy in place.

A reply sent through a form's open link by somebody you have not confirmed as your client is the exception. You cannot read it until you confirm them, and if you have not within 30 days of its arrival it is permanently deleted, whatever your retention window.

Deleted information may remain in our encrypted backups for up to 30 days, after which the backups holding it are themselves deleted. We use backups only to recover the Service from a failure, never to bring back something you deleted on purpose, and if we ever restore one we delete again anything past your retention window before the Service is back in use.

You can export your firm's information at any time while your workspace is open. When it closes, we delete what remains within 90 days, with two exceptions: our billing records, which tax law requires us to keep and which hold nothing of your clients'; and your firm's audit log, which is append-only — nobody can alter or delete it, us included — and which names the clients your firm dealt with. Both stay subject to this Addendum for as long as we hold them.

The record of what was asked for, what arrived and what your firm decided outlives the documents themselves. That record is your firm's professional record, not your client's, and deleting a document does not erase the fact that it was requested.

10. Where the information is

The Service runs in the United States and your clients' information is processed there. We do not transfer it outside the United States.

This Addendum is written for United States law. We do not currently offer terms for information subject to the GDPR or UK GDPR; if you need them, write to legal@cartenda.com before you start collecting such information through the Service.

11. General

This Addendum is governed by the same law and heard in the same courts as the Terms of Service, and our liability under it is subject to the same limits.

If anything in the Terms conflicts with this Addendum about how we handle your clients' information, this Addendum wins.

If we transfer our business, this Addendum goes with it. Your clients' information passes to nobody who is not bound by it.