Data Processing Addendum

1. Parties and scope

This Addendum is between JCA Operations, LLC, doing business as LossHQ (“LossHQ”), and the customer that has accepted the Terms of Service (“Customer”). It applies to personal information contained in Customer Data that LossHQ processes for Customer (“Customer Personal Data”). Customer is the business (or controller) and LossHQ is the service provider (or processor), as those terms are used in applicable U.S. state privacy laws. If this Addendum conflicts with the Terms on the protection of Customer Personal Data, this Addendum controls.

2. Details of the processing

3. Customer’s instructions

LossHQ processes Customer Personal Data only on Customer’s documented instructions, which are the Terms, this Addendum, and Customer’s use of the service, unless the law requires otherwise (in which case LossHQ will tell Customer first, unless the law forbids it). LossHQ will tell Customer if it believes an instruction violates applicable law.

4. Service-provider commitments

LossHQ will not:

• sell or share Customer Personal Data, including for cross-context behavioral advertising;
• keep, use, or disclose it for any purpose other than providing the service, or outside the direct business relationship with Customer;
• combine it with personal information from other sources, except as the law permits for a service provider; or
• use it to build profiles, ratings, or assessments of any person, or to train AI models.

LossHQ will comply with the privacy laws that apply to it as a service provider, provide the same level of protection those laws require, and notify Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and remedy unauthorized use. LossHQ certifies that it understands and will comply with the restrictions in this section.

5. Confidentiality and personnel

Only people who need access to operate or support the service may access Customer Personal Data, and they are bound by confidentiality obligations. LossHQ does not read case content except to resolve an issue Customer has asked about, to keep the service secure, or where the law requires.

6. Security

LossHQ maintains reasonable technical and organizational measures, including:

• encryption in transit, and encryption at rest for the primary database and file storage;
• separate encryption, with a key held outside the database, for connected-mailbox credentials;
• database-level isolation of each customer’s data;
• an append-only record of case events and communications that users cannot edit or delete through the service;
• least-privilege access to production systems; and
• vendor selection that requires equivalent written protections from subprocessors.

7. Subprocessors

Customer authorizes LossHQ to use the subprocessors listed on our Subprocessors page. LossHQ binds each one by written agreement to protections no less protective than this Addendum and remains responsible for their performance. LossHQ will give at least 30 days’ notice by email and on that page before adding or replacing a subprocessor. If Customer objects on reasonable data-protection grounds and the parties cannot resolve it, Customer may terminate the affected service and receive a refund of prepaid fees for the unused period.

8. Security incidents

LossHQ will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a breach of security that results, or is reasonably believed to result, in unauthorized access to, acquisition of, or loss or disclosure of Customer Personal Data. The notice will describe what happened, the data and people likely affected, and the steps taken, and LossHQ will update Customer as it learns more. LossHQ will reasonably help Customer meet any legal obligation to notify affected people or regulators, which remains Customer’s decision as the controller of the record.

9. Return and deletion

Customer may export its records at any time while its account is active. For 30 days after the subscription ends, LossHQ will provide an export on request. LossHQ deletes Customer Personal Data on request, and in any event within 90 days after the subscription ends, except data under a legal hold or that the law requires LossHQ to keep. Encrypted backups are overwritten on their normal rolling schedule. On request, LossHQ will confirm deletion in writing.

10. Assistance

• Requests from individuals. If a person asks LossHQ to access, correct, or delete Customer Personal Data, LossHQ will pass the request to Customer and not respond on its own, except to say it has done so. LossHQ will help Customer respond, including through the service’s export and editing tools.
• Legal demands. Handled as described in section 10 of the Terms: notice first where the law allows, an opportunity to object, and production of only what is compelled.
• Assessments. LossHQ will provide reasonable information Customer needs for a privacy or risk assessment of the processing.

11. Audits

On written request, no more than once a year, LossHQ will answer a reasonable security questionnaire and provide information showing its compliance with this Addendum. Any further audit must be agreed in advance, at Customer’s expense, on reasonable notice, during business hours, and without access to other customers’ data.

12. Location

Customer Personal Data is stored and processed in the United States. Network traffic may pass through Cloudflare's global network in transit.

13. Liability and term

Each party’s liability under this Addendum is subject to the limits in the Terms. This Addendum lasts as long as LossHQ processes Customer Personal Data. Questions: support@losshq.com, or by mail to JCA Operations, LLC, 5900 Balcones Dr, Ste 100, Austin, TX 78731.