Data processing addendum

This addendum is part of the Terms of service between Digital Mundo LLC ("Digital Mundo") and the Customer. It applies whenever Digital Mundo processes personal information contained in Customer Data on the Customer's behalf.

For Customer Data, the Customer is the business (or controller) that decides why and how it is processed, and Digital Mundo is the Customer's service provider (or processor). Where the Customer is a financial institution under the Gramm-Leach-Bliley Act, Digital Mundo is its service provider for that law's purposes.

Digital Mundo processes Customer Data only on the Customer's documented instructions, which are the Terms, this addendum and the Customer's use and configuration of the service. Digital Mundo will not sell or share Customer Data, use it for its own commercial purposes (including to compete with the Customer or to market to its merchants), combine it with data from other sources except to provide the service, or retain, use or disclose it outside the direct business relationship with the Customer. Digital Mundo will tell the Customer if it believes an instruction breaks the law, or if it can no longer meet its obligations under applicable privacy law.

Digital Mundo gives access to Customer Data only to personnel who need it to run and support the service, who are bound by confidentiality obligations. Staff access to a Customer's workspace is recorded in its audit log.

Digital Mundo maintains administrative, technical and physical safeguards appropriate to the sensitivity of Customer Data, as described on the Security page. They include:

• Field-level encryption (AES-256) of Social Security numbers, dates of birth, driver's licence numbers, EINs and bank account and routing numbers.
• Masked display of those values, with reveal limited by permission and recorded in an audit log.
• Role-based access control and tenant isolation, covered by automated tests.
• Encryption in transit (HTTPS) for all traffic to the service.
• Private document storage, served only after a permission check.
• An append-only audit log of changes, exports, downloads and sign-ins.
• Rate limiting and abuse protection on sign-in and public endpoints.

Digital Mundo may update these measures as long as the overall level of protection does not decrease.

The Customer authorizes Digital Mundo to use the subprocessors below. Digital Mundo has a written agreement with each one that protects Customer Data at least as well as this addendum, and remains responsible for their performance. Digital Mundo will update this list at least 30 days before a new subprocessor starts processing Customer Data; the Customer may object on reasonable data protection grounds, and if we cannot resolve the objection, the Customer may end the affected service.

If Digital Mundo receives a request from an individual about Customer Data (for example to access or delete their information), it will pass the request to the Customer and not respond itself except to say it has done so. The service lets the Customer find, correct, export and delete records; Digital Mundo will give reasonable further help where the Customer cannot do so itself.

Digital Mundo will notify the Customer without undue delay after becoming aware of a breach of security that leads to unauthorized access to, or loss or disclosure of, the Customer's Customer Data. The notice will describe what happened, the data involved as far as known, and the steps taken, and Digital Mundo will update it as it learns more and help the Customer meet its own notification obligations.

The Customer can export Customer Data at any time while its account is active, and for 30 days after it ends. After that, Digital Mundo will delete Customer Data from the service within a reasonable period, unless the law requires it to keep some of it, in which case it stays protected under this addendum.

On request, Digital Mundo will provide information reasonably needed to show it complies with this addendum, including answering a reasonable security questionnaire once a year. Digital Mundo does not currently hold a SOC 2 or ISO 27001 certification.

Digital Mundo and its subprocessors process Customer Data in the United States.

If this addendum conflicts with the Terms on the processing of personal information, this addendum controls.