Data Processing Addendum

Capitalized terms not defined here have the meaning in the Terms of Service. “Data Protection Laws” means all laws applicable to the processing of personal data, including the EU GDPR, the UK GDPR, and applicable U.S. state privacy laws. For Customer Personal Data processed under the Service, the Customer acts as controller (or processor on behalf of a third-party controller) and Wavelify acts as processor (or sub-processor). “Customer Personal Data” means personal data within Customer Data that Wavelify processes on the Customer’s behalf.

Wavelify will process Customer Personal Data only (a) to provide the Service, (b) in accordance with the Customer’s documented lawful instructions (including the configuration of the Service), and (c) as required by law, in which case Wavelify will inform the Customer unless legally prohibited. The Customer is responsible for the lawfulness of its instructions and of its collection and use of Customer Personal Data, including obtaining any required consents and providing any required notices.

The subject matter, duration, nature, and purpose of processing, the types of personal data, and the categories of data subjects are described in Annex A.

Wavelify will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and access it only as needed to provide the Service.

Wavelify will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data, as described in Annex B, taking into account the state of the art and the risks of processing.

The Customer authorizes Wavelify to engage sub-processors to support the Service (for example, cloud hosting, email delivery, and monitoring providers). Wavelify will impose data-protection obligations on sub-processors that are no less protective than those in this DPA and remains responsible for their performance. Wavelify will make available a current list of sub-processors on request and will provide notice of intended changes, giving the Customer the opportunity to object on reasonable data-protection grounds.

Taking into account the nature of the processing, Wavelify will provide reasonable assistance to enable the Customer to respond to requests from data subjects to exercise their rights, to the extent the Customer cannot do so itself through the Service’s functionality.

Wavelify will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data and will provide information reasonably available to assist the Customer in meeting its notification obligations. Notice of a breach is not an acknowledgment of fault or liability.

Wavelify will make available information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including by providing relevant third-party reports or, where required by Data Protection Laws, by permitting a reasonable, scoped audit subject to confidentiality, on reasonable prior notice, no more than once per year except as required by a supervisory authority.

Where Wavelify transfers Customer Personal Data across borders in a manner requiring a transfer mechanism under Data Protection Laws, the parties agree that the European Commission’s Standard Contractual Clauses (and the UK Addendum, where applicable) are incorporated by reference and apply to such transfers, with Wavelify as the data importer.

Upon termination of the Service, Wavelify will, at the Customer’s choice, delete or return Customer Personal Data, and delete existing copies, except to the extent retention is required by law or for routine backups that are deleted in the ordinary course.

Each party’s liability arising out of or related to this DPA is subject to the limitations and exclusions of liability set out in the Terms of Service, and any reference to a party’s liability means the aggregate liability of that party under the Terms and this DPA combined.

• Subject matter: provision of the Mapper wireless-monitoring Service.
• Duration: the term of the Service plus any legally required retention.
• Nature and purpose: collection, storage, organization, visualization, alerting, and analysis of network and RF telemetry to operate the Service for the Customer.
• Types of personal data: account and contact data of authorized users; network/RF identifiers within Customer Data (e.g., device MAC/BSSID identifiers, SSIDs); usage and log data including IP addresses.
• Categories of data subjects: the Customer’s authorized users and administrators, and individuals whose devices are present in the wireless environments the Customer chooses to monitor.

• encryption of data in transit using current TLS;
• role-based access controls and the principle of least privilege;
• multi-factor authentication for account access;
• logical tenant isolation between customers;
• network controls, firewalling, and segmented infrastructure;
• regular backups and a tested restore process;
• monitoring, logging, and alerting of infrastructure; and
• vendor management and confidentiality obligations for personnel and sub-processors.