Data Processing Agreement
Innabox, Inc. DBA CharacterQuilt
Last Updated: March 26, 2024
Data Processing Agreement
Key Terms
The key legal terms of the DPA are as follows:
Agreement
This DPA is the standard DPA used by Innabox, Inc.
Approved Subprocessors
List of Subprocessors available at characterquilt.com/subprocessors
Provider Security Contact
bhairav@innabox.ai, bhairav@characterquilt.ai
5 Walnut Court, Matawan, NJ 07747
Security Policy
As defined in the Agreement.
Service Provider Relationship
To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq (“CCPA”) applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement, which constitutes a business purpose. Provider will not sell any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph.
Restricted Transfers
Annex I(A) List of Parties
Data Importer
Name: Provider
Address: 5 Walnut Court, Matawan NJ 07747
Contact Person:
Name: Bhairav Mehta
Position: CEO
Address: 5 Walnut Court, Matawan NJ 07747
Activities relevant to transfer: See Annex 1(B)
Role: Processor
Annex I(B) Description of Transfer and Processing Activities
Service
CharacterQuilt Marketing Platform
Categories of Data Subjects
[x] Customer’s end users or customers
[x] Customer’s employees
Categories of Personal Data
[ x ] Name
[ x ] Contact information such as email, phone number, or address
[ x ] User activity and analysis such as device information or IP address
Special Category Data
Is special category data Processed?
( ) Yes (x) No
Frequency of Transfer
[ x ] Continuous
Nature and Purpose of Processing
Provider will Process Customer Personal Data as instructed in Section 3.2 of the DPA Standard Terms. The nature of processing includes:
[ x ] Receiving data, including collection, accessing, retrieval, recording, and data entry
[ x ] Holding data, including storage, organization, and structuring
[ x ] Using data, including analysis, consultation, testing, automated decision making, and profiling
[ x ] Updating data, including correcting, adaptation, alteration, alignment, and combination
[ x ] Protecting data, including restricting, encrypting, and security testing
[ x ] Sharing data, including disclosure, dissemination, allowing access, or otherwise making available
[ x ] Returning data to the data exporter or data subject
[ x ] Erasing data, including destruction and deletion
Duration of Processing
Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws.
Annex I(C)
Competent Supervisory Authority
The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.
Annex II
Technical and Organizational Security Measures
[ x ] See Security Policy
Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above.