Data Processing Addendum

1. Definitions

• “Data protection laws” means the privacy laws that apply to the processing: for example the EU GDPR, the UK GDPR, the Swiss FADP, Canada’s PIPEDA, Quebec’s Act respecting the protection of personal information in the private sector, and U.S. state privacy laws such as the CCPA.
• “Customer personal data” means personal data in your workspace that Cook processes for you: your clients, leads, contacts, form respondents, the people in your messages and meetings, and your team members.
• “Controller”, “processor”, “data subject”, “processing”, “business”, and “service provider” have the meanings the data protection laws give them.
• “Subprocessor” means a provider that Cook engages to process customer personal data.
• “Security incident” means a breach of security that leads to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, customer personal data.

2. Roles and scope

For customer personal data, you are the controller (or a processor acting for your own client) and Cook is your processor (or subprocessor). Cook is a separate controller only for the account, billing, and usage data its Privacy Policy describes. This DPA stays in effect for as long as Cook processes customer personal data, also after the terms end.

3. Your instructions

Cook processes customer personal data only on your documented instructions. The terms, this DPA, your settings, and the requests you and your members give to Cook and its agents are your instructions. If Cook thinks an instruction breaks the data protection laws, it tells you. Cook does not sell customer personal data, does not share it for cross-context behavioral advertising, does not use it for any purpose other than providing the service to you, and does not use it to train AI models.

4. Your responsibilities

• You have a lawful basis for the processing, and you give data subjects the notices and get the consents that the data protection laws require.
• You do not put special-category or sensitive data into Cook (for example health data, biometric data, government ID numbers, or payment card numbers) unless we agree in writing first.
• You keep your account credentials secure and configure the service, such as who has access to your workspace, in a way that suits the risk of your data.

5. Confidentiality and security

Cook makes sure that the people who can access customer personal data are bound by confidentiality. Cook keeps technical and organizational measures that are appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest, and AES-GCM encryption of integration credentials;
• access to production systems only for staff who need it for their work;
• separation of each workspace’s data, and permission checks on every request;
• daily backups kept for 14 days, and a process to restore them;
• logging and monitoring for security and debugging.

Cook may update these measures, but it will not make them less protective overall.

6. Security incidents

Cook notifies you without undue delay after it becomes aware of a security incident that affects your customer personal data. The notice describes what Cook knows at that time: what happened, the data affected, the steps Cook has taken, and the steps Cook recommends to you. Cook gives you more information as it learns it and helps you meet your own notification duties. A notice is not an admission of fault.

7. Subprocessors

You authorize Cook to use the subprocessors listed below. Cook signs a written contract with each subprocessor with data protection terms at least as protective as this DPA, and Cook is responsible for their work. Before Cook adds or replaces a subprocessor, it updates this list and gives you notice in the app or by email at least 15 days in advance. If you have a reasonable data-protection objection, tell us within that period; if we cannot resolve it, you may end the affected service and get a pro-rata refund of fees you paid in advance for it.

Providers that you connect to your own workspace (for example your CRM, your Google or Zoom account, or your messaging apps) act under your own agreement with them, not as Cook’s subprocessors.

8. Requests from data subjects

The service lets you find, export, correct, and delete customer personal data. If Cook receives a request from a data subject about your data, Cook tells you (where the law allows) and directs the person to you. Cook gives you reasonable help with requests, data protection impact assessments, and consultations with supervisory authorities, to the extent you cannot do these things with the service yourself.

9. International transfers

Cook and its subprocessors process data mainly in the United States and Canada. Where customer personal data from the EEA, the UK, or Switzerland is transferred to a country without an adequacy decision, the parties rely on the European Commission’s Standard Contractual Clauses (Module 2 controller-to-processor, or Module 3 processor-to-processor), with the UK International Data Transfer Addendum and the Swiss amendments where they apply, and those clauses are incorporated by reference. For the clauses: Clause 7 (docking) applies; Clause 9 option 2 (general authorization) applies, with the notice period in Section 7 above; the optional wording in Clause 11 does not apply; Clauses 17 and 18 select the law and courts of Ireland. The annexes of the clauses are completed by Sections 2 to 7 of this DPA and by Section 12 below.

10. Audits

On written request, Cook gives you the information you reasonably need to confirm that it meets this DPA, such as answers to a security questionnaire. If that is not enough, or a supervisory authority requires it, you may audit Cook once a year at your own cost, with 30 days’ notice, during business hours, by an auditor bound by confidentiality, in a way that does not put other customers’ data at risk.

11. Return and deletion

You can export your workspace data from Settings at any time before your account ends. When you delete your workspace or account, Cook deletes customer personal data from its live database, and copies in backups expire within 14 days. Files (uploads, generated media, workspace drive files and transcripts) are removed from storage within minutes, held in a private archive for 30 days, and then deleted permanently; course videos are deleted 30 days after the workspace or lesson is deleted. While the workspace exists, a file that no record uses any more, and an older version of a drive file, is removed 30 days after it stops being used or is replaced, and deleted permanently 30 days after that. Cook may keep data that the law requires it to keep, and protects it under this DPA for as long as it does.

12. Details of the processing

• Subject matter and purpose: providing the Cook service to you as described in the terms: AI agents, CRM, funnels and forms, messaging, bookings, and integrations.
• Nature: collection, storage, organization, analysis, generation, transmission, and deletion of data, on your instructions.
• Data subjects: your clients, leads, contacts, form respondents, people in your messages and meetings, and your team members.
• Categories of data: names and contact details, messages and content, CRM records and notes, meeting and booking details, consent records, and technical identifiers.
• Sensitive data: none, unless agreed in writing.
• Frequency and duration: ongoing, for the life of your account, then as Section 11 describes.
• Cook’s contact for data protection: Privacy Officer, [email protected], ClientAcquisition.io, 6740 Rue Briand, Montreal QC, H4E 3L5, Canada.

13. U.S. state privacy laws

Where U.S. state privacy laws apply, Cook is your service provider or processor. Cook processes customer personal data only for the business purpose of providing the service, does not combine it with data from other sources except as the service requires and the law allows, complies with those laws, and tells you if it can no longer meet its obligations under them.

14. General

The limitation of liability in the terms applies to this DPA. If this DPA conflicts with the terms, this DPA controls for the processing of customer personal data. If the Standard Contractual Clauses conflict with this DPA, the clauses control.