Data Processing Addendum

This addendum is part of the Terms of Service between Big Freight Life LLC ("SessionLayer") and the business that operates a SessionLayer workspace ("Customer"). It applies when SessionLayer processes personal information for the Customer, such as its clients' names, contact details, and booking details.

The Customer decides why and how that information is used. SessionLayer processes it on the Customer's behalf, as its service provider (also called a processor).

SessionLayer will process the Customer's personal information only to provide the service described in the Terms: scheduling, payments coordination, notifications, calendar and video integrations, support, security, and AI-assisted drafting. The Terms, this addendum, and the Customer's use of the product settings are its instructions. The processing lasts as long as the Customer uses SessionLayer, plus the retention periods in the Privacy Policy.

People who can access the Customer's personal information on SessionLayer's behalf are bound by confidentiality obligations.

SessionLayer uses reasonable technical and organizational measures to protect personal information, described on our Security page. The Customer is responsible for its own account security and for deciding what it collects, including not collecting the sensitive data the Terms prohibit.

The Customer agrees that SessionLayer may use the providers listed on the Services we use page. SessionLayer updates that page before a new provider processes the Customer's personal information, and emails customers who have asked to be notified of changes. Those providers process information under their own standard terms. SessionLayer remains responsible for choosing them with care and for its own obligations under this addendum.

If an individual asks SessionLayer to access, correct, delete, or export information held for the Customer, SessionLayer will refer them to the Customer. Taking into account the nature of the processing, SessionLayer will reasonably help the Customer respond, including through the in-product export and deletion tools.

If SessionLayer learns of a security incident that affects the Customer's personal information, it will tell the Customer without undue delay and share the information it reasonably has to help the Customer meet its own notice duties.

When the Customer ends its use of SessionLayer, it has 30 days to export its data. After that, SessionLayer deletes or anonymizes it as described in the Privacy Policy, except where the law requires it to keep certain records.

To show compliance with this addendum, SessionLayer will answer a reasonable written security and privacy questionnaire from the Customer, no more than once a year.

To the extent laws such as the California Consumer Privacy Act (as amended by the CPRA) apply, SessionLayer is the Customer's service provider and:

• will not sell or share the personal information;
• will not retain, use, or disclose it for any purpose other than the business purposes in this addendum and the Terms, or outside its direct business relationship with the Customer, except as the law allows;
• will not combine it with personal information from other sources, except as the law allows;
• will tell the Customer if it can no longer meet its obligations under these laws; and
• certifies that it understands these restrictions and will follow them.

The Customer may take reasonable steps to confirm SessionLayer uses the information consistently with these laws, and to stop unauthorized use.

Liability under this addendum is subject to the limits in the Terms. If this addendum conflicts with the Terms about the processing of personal information, this addendum controls; otherwise the Terms control.

Portions adapted from the Common Paper Data Processing Agreement, licensed CC BY 4.0 (commonpaper.com/standards).