Data Processing Agreement (DPA)

Sets out Wooli's obligations as a service provider (processor) for Personal Information processed on a Customer's behalf.

Wooli Data Processing Agreement This Data Processing Agreement ("DPA") is between Wooli, Inc., a Delaware corporation ("Wooli"), and each customer that holds a Subscription under the Wooli Terms of Service ("ToS") (the "Customer"). This DPA is part of the ToS. Capitalized terms not defined in this DPA have the meanings given in the ToS.

The Subscription Service supports the upload, storage, and management of diverse data (including documents, personal information, and information on others) and features (such as task assignment, file sharing, and team coordination). Wooli sells and bills all Subscriptions, which may include content or features provided by affiliated organizations, such as Wooli Safety, Inc.

Table of Contents

1 Scope and Roles

This DPA applies to Personal Information in User Content that Wooli processes on the Customer's behalf in providing the Subscription Service. For that information, the Customer is the controller and Wooli is its service provider (processor). This DPA does not apply to Personal Information that Wooli collects for its own purposes, such as Account, billing, Explore, and website data, which the Privacy Policy covers.

Wooli processes Personal Information only on the Customer's documented instructions, unless law requires otherwise. The Customer's instructions are the ToS, the Order Form, this DPA, and the Customer's use of the Subscription Service's settings and Features. The Customer is responsible for the lawfulness of its instructions and of the Personal Information it provides, including giving required notices and obtaining required consents. Section 2 of the ToS explains how this DPA ranks against the ToS.

Partners are not Subprocessors. When the Customer links an External Partner to its Account, any Personal Information shared with that External Partner is disclosed at the Customer's direction, and the External Partner's handling of it is outside this DPA.

2 Definitions

2.1 Personal Information

Information that identifies, relates to, or could reasonably be linked to an identified or identifiable individual and that Wooli processes on the Customer's behalf under this DPA.

2.2 Sensitive Personal Information

Categories of Personal Information that require additional protection under applicable law, such as health or biometric data or government-issued identifiers.

2.3 Processing

Any operation performed on Personal Information, such as collection, storage, use, disclosure, or deletion.

2.4 Data Subject

An individual whose Personal Information is processed under this DPA.

2.5 Subprocessor

A third party that Wooli engages to process Personal Information on the Customer's behalf.

2.6 Security Event

Unauthorized access to, acquisition of, or use of Personal Information that requires notification under applicable law.

3 Processing Details

Subject matter: Processing Personal Information to provide the Subscription Service under the ToS and the Order Form.

Duration: The term of the Subscription, plus the export and deletion period in Section 11.

Nature and purpose: Hosting, storing, processing, transmitting, and displaying User Content; enabling Features, including any AI Features the Customer chooses to use; providing support; and keeping the Subscription Service secure.

Types of Personal Information: Whatever Personal Information the Customer and its Users choose to include in User Content, which may include:

  1. Identification and contact data (e.g., names, email addresses, phone numbers, job titles).
  2. Employment and business information (e.g., roles, assignments, training or inspection records).
  3. Personal Information about the Customer's clients, contractors, or other third parties.
  4. The contents of documents, tasks, files, comments, and messages.
  5. Signatures (images of drawn or typed signatures), signing audit trails (e.g., names, email addresses, IP addresses, and timestamps), and completion certificates.
  6. Inputs submitted to AI Features.
  7. Sensitive Personal Information, only as the AUP permits. Protected Health Information under HIPAA is prohibited.

Categories of Data Subjects: Users (e.g., employees and contractors), including Guests with limited access, third parties whose Personal Information the Customer uploads (e.g., clients), individuals who interact with the Customer in an employment or business context, and other individuals who sign, or are named in, documents sent for signature.

4 Processor Obligations

Wooli will:

  1. Process Personal Information only on the Customer's documented instructions, unless law requires otherwise, and notify the Customer if it believes an instruction violates applicable law.
  2. Not sell or share Personal Information; not retain, use, or disclose it for any purpose other than providing the Subscription Service to the Customer or as applicable law permits a service provider; and not combine it with personal information Wooli receives from other sources, except as applicable law permits.
  3. Implement appropriate technical and organizational measures to protect Personal Information, as described in Section 6.
  4. Ensure that personnel authorized to process Personal Information are bound by confidentiality obligations, and allow Wooli personnel and Partners to view or access Personal Information only with the Customer's permission or through Wooli's controlled access process described in Section 7.6 of the ToS.
  5. Notify the Customer if Wooli determines it can no longer meet its obligations under this DPA or applicable law, and allow the Customer to take reasonable steps to stop and remediate unauthorized processing.
  6. Assist the Customer with individual rights requests as described in Section 8.
  7. Make available information reasonably necessary to demonstrate its compliance with this DPA, as described in Section 10.

Wooli certifies that it understands and will comply with the restrictions in this Section 4.

5 Subprocessors

The Customer authorizes Wooli to engage Subprocessors to process Personal Information under written agreements at least as protective as this DPA. The current Subprocessors are listed in the Subprocessor List. Wooli will notify the Customer of new or replacement Subprocessors by email and through in-Service notifications. If the Customer has reasonable data-protection concerns about a Subprocessor, it may raise them with the Privacy Contact, and Wooli will work with the Customer in good faith to address them. Wooli remains responsible for its Subprocessors' compliance with the data protection obligations in this DPA.

6 Data Security

Wooli maintains industry-standard technical and organizational measures designed to protect Personal Information, including:

  1. Encryption of data in transit and hashed storage of passwords.
  2. Access controls that limit personnel access to those who need it.
  3. Sign-in by one-time passcode, password, or single sign-on, as the User or Workspace chooses.
  4. Security reviews, employee training, and internal security policies.
  5. Confidentiality obligations for personnel.

The Customer is responsible for the security of its own Accounts, including using strong passwords and enabling multi-factor authentication where available.

7 Breach Notification

If a Security Event occurs, Wooli will:

  1. Notify the Customer without undue delay after becoming aware of it, and within the time required by applicable law, at the email associated with the Customer's Account, with the details then available and the steps Wooli is taking.
  2. Investigate promptly, take reasonable steps to contain it, and cooperate with the Customer in notifying affected individuals where the law requires or the Customer directs.
  3. Make available information reasonably necessary to demonstrate its compliance.

The Customer must report any suspected Security Event to Wooli through the Privacy Contact without undue delay.

8 Individual Rights Requests

Taking into account the nature of the processing, Wooli will assist the Customer in responding to requests from individuals to exercise their rights under applicable data protection laws, such as access, correction, deletion, portability, and opting out. If Wooli receives such a request directly about Personal Information under this DPA, it will refer the individual to the Customer and will not respond itself except as law requires. The Customer may ask for assistance through the Privacy Contact. Wooli does not sell Personal Information.

9 Data Transfers

Wooli and its Subprocessors store and process Personal Information in the United States, except that error reports and session replays processed by Wooli's error-monitoring Subprocessor, which may include Personal Information, are processed in the European Union, as identified in the Subprocessor List. Where Personal Information is transferred across borders, Wooli implements the safeguards that applicable data protection law requires.

10 Compliance Verification

On the Customer's reasonable written request, and no more than once a year, Wooli will make available information reasonably necessary to demonstrate its compliance with this DPA, such as responses to a security questionnaire or a summary of its security practices. The Customer must keep that information confidential, and any review must not unreasonably disrupt Wooli's operations. Wooli will also cooperate with any audit or inspection that applicable law or a competent authority requires.

11 Data Return or Deletion

During the Subscription, the Customer may delete Personal Information through the Subscription Service or ask Wooli to return or delete it. For 30 days after the Subscription ends, Wooli keeps Personal Information so that the Customer can export it through the Account Management Page. After that, Wooli deletes it, except copies that the law requires Wooli to keep and copies in backups, which are deleted on Wooli's regular backup schedule. Wooli continues to protect any retained copies under this DPA. Data shared with other Users may remain in their accounts.

12 Liability and Indemnity

Wooli's liability under this DPA is subject to Section 13 of the ToS, which caps Wooli's total liability at the greater of the amounts paid in the prior 12 months or $100. The Customer's indemnification obligations under Section 10.1 of the ToS apply to claims arising from the Customer's instructions or the Personal Information it provides.

13 Termination and Survival

This DPA remains in effect for the term of the Subscription and survives termination for as long as Wooli retains Personal Information, with respect to obligations relating to data protection, confidentiality, and deletion.

14 Governing Law and Dispute Resolution

This DPA is governed by the laws of the State of Florida. Disputes are resolved as provided in Section 15.2 of the ToS, including its arbitration provisions, with venue in Lee County, Florida.

15 Miscellaneous

This DPA, together with the ToS (including the Privacy Policy and the Order Form), is the entire agreement between the parties on data processing. If any provision is held invalid, the remaining provisions remain in effect. Wooli may assign this DPA only together with the ToS. Notices to Wooli under this DPA go to the Privacy Contact or to Wooli, Inc., PO Box 39, Estero, FL 33929.

16 Reference Links

Where this DPA refers to a Wooli page, policy, or contact by name, it means the resource listed below. Wooli may update these links without changing the substance of this DPA.