Data processing addendum
How BudAlly processes personal information on a customer’s behalf. It forms part of the terms of service; a countersigned copy is available on request.
1. Roles
For personal information in customer data, the customer is the business (controller) and BudAlly, Inc. is its service provider (processor). This addendum applies whenever BudAlly processes that information to provide the service.
2. Instructions and limits
BudAlly processes personal information only to provide the service under the terms of service and the customer's documented instructions given through the product. It will not sell or share it, will not use or keep it for any other purpose, and will not combine it with personal information from other sources except as the service requires. BudAlly will tell the customer if it believes an instruction breaks the law, and if it can no longer meet its obligations under applicable privacy law.
3. Confidentiality of personnel
Only people who need access to provide the service have it, and each is bound to keep the information confidential.
4. Security measures
As described on the security page: encryption in transit and at rest, third-party credentials kept in a vault, role-based access, audit logging, backups retained for 28 days, and hosting in the United States. BudAlly will keep these measures at least as protective as they are when the customer signs up.
5. Sub-processors
The customer authorises the sub-processors listed on the security page. BudAlly will give at least 30 days' notice by email before adding or replacing one. The customer may object on reasonable data-protection grounds; if the parties cannot resolve it, the customer may end the affected service and receive a refund of prepaid fees for the remaining period. BudAlly holds each sub-processor to obligations at least as protective as these and is responsible for their performance.
6. Helping with requests
BudAlly will help the customer answer requests from individuals to see, correct or delete their information, and will pass on any such request it receives directly rather than answering it itself.
7. Breach notification
BudAlly will notify the customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting the customer's personal information. The notice will say what happened, what information is affected, and what BudAlly is doing about it, and BudAlly will update it as it learns more.
8. Deletion and return
When the agreement ends, the customer has 30 days to export its data. BudAlly then deletes it from the live service, and backup copies age out within 28 days, except for records the law requires BudAlly to keep, which are kept only for that purpose.
9. Audit
On request, once a year, BudAlly will answer a reasonable written security questionnaire and provide the information needed to show it meets this addendum. Any further audit is by agreement, on reasonable notice, at the customer's cost, and subject to confidentiality.
10. Where data is processed
Customer data is hosted in the United States. BudAlly will not move its primary storage outside the United States without the customer's written agreement.
Trademarks
BudAlly and the BudAlly mark are trademarks of BudAlly, Inc. Dutchie, Treez, Flowhub, Cova, BLAZE, Metrc, Headset, QuickBooks, Weedmaps and Leafly are trademarks of their respective owners; BudAlly is an independent product and is not endorsed by or affiliated with them. BudAlly is not affiliated with Ally Financial.