THIS DATA PROCESSING ADDENDUM forms part of, and is incorporated into, the Bitlync MSP Connect Terms accepted by the MSP (the "Principal Agreement") and takes effect on the date of that acceptance (this "Addendum").
Between:
1 Bitlync, Inc., a Delaware-registered corporation with offices located at c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713 ("Bitlync" or the "Processor"), and
2 The managed service provider or other organization which has accepted the Principal Agreement ("MSP" or the "Controller"),
(each a "Party" and together, the "Parties").
Recitals
(A) Under the Principal Agreement, the MSP connects its business systems to the Service and Bitlync synchronizes and holds MSP Data, which contains Personal Data, on the MSP's behalf and serves it to ISVs at the MSP's direction.
(B) The Parties wish to record the terms on which Bitlync processes Personal Data on behalf of the MSP, in order to comply with Data Protection Laws.
AGREED TERMS
Interpretation:
1. The definitions and rules of interpretation in this paragraph apply in this Addendum.
1.1 Capitalized terms used but not defined in this Addendum have the meanings given in the Principal Agreement. In addition:
Business, Business Purpose, Consumer, Sell, Share and Service Provider: have the meanings given in the CCPA.
CCPA: means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing and Supervisory Authority: have the meanings given in the GDPR or, where the GDPR does not apply, the closest equivalent meanings under applicable Data Protection Laws (so that "Controller" includes a Business and "Processor" includes a Service Provider or processor under US State Privacy Laws), and "Personal Data Breach" includes any "breach of security", "breach of the security of the system" or equivalent event as defined in US Breach Notification Laws.
Data Protection Laws: means all Applicable Laws relating to the Processing of Personal Data, including (to the extent applicable) US State Privacy Laws, the GDPR, the UK GDPR, the UK Data Protection Act 2018 and the Swiss Federal Act on Data Protection.
Deidentified Data: means data that meets the definition of "deidentified" in the CCPA or of "de-identified data" under other US State Privacy Laws.
EU SCCs: means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission by Implementing Decision (EU) 2021/914, as set out in Schedule 3.
GDPR: means Regulation (EU) 2016/679 (the General Data Protection Regulation).
Grant Instruction: means the MSP's approval of a Permission Summary in respect of an ISV, which constitutes the MSP's documented instruction to Bitlync to disclose MSP Data to that ISV within the scope of the resulting Grant.
MSP Personal Data: means Personal Data contained in MSP Data and Credentials which Bitlync Processes on behalf of the MSP under the Principal Agreement, as further described in Schedule 1.
Restricted Transfer: means a transfer of MSP Personal Data which is subject to the GDPR, the UK GDPR or Swiss law to a country which is not the subject of an adequacy decision under the relevant law.
Sensitive Data: means "sensitive personal information" as defined in the CCPA, "sensitive data" as defined in other US State Privacy Laws, and special categories of personal data and personal data relating to criminal convictions and offences under the GDPR and the UK GDPR.
Sub-processor: means any third party engaged by Bitlync to Process MSP Personal Data on Bitlync's behalf, excluding ISVs.
Sub-processor List: means the list of Sub-processors published by Bitlync at https://www.bitlync.com/legal/subprocessors, the version current at the date of this Addendum being set out in Schedule 2.
UK Addendum: means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as set out in Schedule 3.
UK GDPR: has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the DPA 2018.
US Breach Notification Laws: means all federal and state laws and regulations of the United States requiring notification to individuals, regulators or other persons of a breach of security involving personal information, including Cal. Civ. Code § 1798.82.
US State Privacy Laws: means the CCPA and all other comprehensive state consumer privacy laws of the United States in force from time to time, including, without limitation, those of Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Kentucky, Maryland, Minnesota and Rhode Island, in each case together with their implementing regulations.
1.2 Paragraph and Schedule headings shall not affect the interpretation of this Addendum. A reference to a company shall include any company, corporation or other body corporate, wherever and however incorporated or established. Unless the context otherwise requires, words in the singular shall include the plural and in the plural shall include the singular, and a reference to one gender shall include a reference to the other genders.
1.3 A reference to a statute or statutory provision is a reference to it as amended, extended or re-enacted from time to time and shall include all subordinate legislation made from time to time under that statute or statutory provision.
1.4 A reference to writing or anything written includes e-mail and any record made or accepted by electronic means, including a checkbox or button in the Service. Any phrase introduced by the words including, includes, in particular or for example, or any similar phrase, shall be construed as illustrative and shall not limit the generality of the related general words. References to paragraphs and Schedules are to the paragraphs and Schedules of this Addendum. A person includes a natural person, corporate or unincorporated body (whether or not having separate legal personality).
1.5 In the event of any conflict or inconsistency between this Addendum and the Principal Agreement in respect of the Processing of MSP Personal Data, this Addendum shall prevail. In the event of any conflict between this Addendum and the EU SCCs or the UK Addendum, the EU SCCs or the UK Addendum (as applicable) shall prevail.
2. ROLES OF THE PARTIES
2.1 The Parties acknowledge that, in respect of MSP Personal Data, the MSP is the Controller (or, where the MSP itself acts as a processor for its own clients, a processor) and Bitlync is the Processor acting on the MSP's behalf. Where the MSP acts as a processor for its own clients, the MSP warrants that its instructions to Bitlync are authorized by the relevant controller and that this Addendum is consistent with the MSP's obligations to that controller.
2.2 Each ISV which receives MSP Personal Data pursuant to a Grant Instruction does so as a separate recipient at the MSP's direction and is not a Sub-processor of Bitlync. The MSP is responsible for entering into such terms with each ISV as Data Protection Laws require.
2.3 Bitlync acts as an independent Controller in respect of the account, contact and Usage Data described in the Privacy Policy, which is outside the scope of this Addendum.
3. PROCESSING ON INSTRUCTIONS
3.1 Bitlync shall Process MSP Personal Data only on the documented instructions of the MSP, which are: (a) the Principal Agreement and this Addendum; (b) each Grant Instruction, including any narrowing or revocation of a Grant; (c) each write requested by an ISV within the scope of a Grant; and (d) any further written instruction given by the MSP through the MSP Portal or by e-mail, provided that it is consistent with the Principal Agreement; save where Bitlync is required to Process MSP Personal Data by Applicable Laws, in which case Bitlync shall inform the MSP of that legal requirement before Processing unless the law prohibits such information on important grounds of public interest.
3.2 Bitlync shall immediately inform the MSP if, in Bitlync's opinion, an instruction infringes Data Protection Laws, and may suspend performance of that instruction until the MSP confirms or modifies it.
3.3 The subject matter, duration, nature and purpose of the Processing, the types of Personal Data and the categories of Data Subjects are set out in Schedule 1.
4. SERVICE PROVIDER TERMS (US STATE PRIVACY LAWS)
4.1 To the extent that US State Privacy Laws apply to MSP Personal Data, Bitlync is a Service Provider or processor to the MSP, and Bitlync shall not: (a) sell or share MSP Personal Data; (b) retain, use or disclose MSP Personal Data for any purpose (including any commercial purpose) other than the Business Purposes specified in the Principal Agreement and Schedule 1, or as otherwise permitted by US State Privacy Laws; (c) retain, use or disclose MSP Personal Data outside the direct business relationship between Bitlync and the MSP; or (d) combine MSP Personal Data with Personal Data received from or on behalf of any other person, or collected from Bitlync's own interactions with Consumers, save as permitted by US State Privacy Laws.
4.2 Bitlync certifies that it understands and shall comply with the restrictions in paragraph 4.1. Bitlync shall notify the MSP if it determines that it can no longer meet its obligations under US State Privacy Laws, and the MSP may, upon reasonable notice, take reasonable and appropriate steps to stop and remediate any unauthorized use of MSP Personal Data.
4.3 Bitlync shall provide the same level of privacy protection as is required of the MSP by US State Privacy Laws, shall assist the MSP in responding to Consumer requests in accordance with paragraph 8, and shall permit the MSP to take reasonable and appropriate steps to ensure that Bitlync uses MSP Personal Data in a manner consistent with the MSP's obligations, including by means of the audit rights in paragraph 10.
4.4 The disclosure of MSP Personal Data by Bitlync to an ISV pursuant to a Grant Instruction is a disclosure made at the direction of the MSP and does not constitute a Sale or Share by Bitlync.
4.5 Nothing in paragraph 4.1 prevents Bitlync from retaining, using or disclosing MSP Personal Data to the extent that a Service Provider or processor is permitted to do so by US State Privacy Laws (including Cal. Code Regs. tit. 11, § 7050), including: (a) to build or improve the quality of the Service, provided that Bitlync does not use MSP Personal Data to build or modify household or consumer profiles for use in providing services to another business, or to correct or augment data acquired from another source; (b) to detect, prevent or investigate security incidents or fraudulent, malicious or illegal activity; (c) to comply with Applicable Laws, or to comply with or respond to a civil, criminal or regulatory inquiry, investigation, subpoena or summons; and (d) for Bitlync's internal operational purposes in providing the Service to the MSP.
4.6 If Bitlync creates Deidentified Data from MSP Personal Data, Bitlync shall: (a) take reasonable measures to ensure that the data cannot be associated with an individual or household; (b) publicly commit to maintain and use the data only in deidentified form and not to attempt to reidentify it, except as permitted by US State Privacy Laws in order to test the effectiveness of its deidentification; and (c) contractually obligate any recipient of the data to comply with the same requirements.
4.7 The MSP shall: (a) comply with its own obligations under US State Privacy Laws as a Business or controller, including providing any notice and obtaining any consent or authorization required for the Processing described in Schedule 1; (b) not direct the synchronization or other Processing of Sensitive Data; and (c) ensure that its instructions, including each Grant Instruction, comply with Data Protection Laws. The Parties acknowledge that the CCPA applies to Personal Data relating to employees, contractors and business contacts, and that the MSP is responsible for determining whether it is a Business subject to the CCPA or a controller subject to any other US State Privacy Law.
5. CONFIDENTIALITY AND PERSONNEL
5.1 Bitlync shall ensure that all persons authorized by it to Process MSP Personal Data are bound by written obligations of confidentiality or are under an appropriate statutory obligation of confidentiality, have received appropriate training in data protection, and Process MSP Personal Data only to the extent necessary to perform the Service.
5.2 Bitlync's support personnel shall have read-only access to the Audit Log for diagnostic purposes and shall not be able to change the MSP's configuration, act as the MSP in any Connected System or use any Credential.
6. SECURITY
6.1 Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of Processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, Bitlync shall implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as a minimum the measures set out in Schedule 4.
6.2 Bitlync may update the measures in Schedule 4 from time to time provided that such updates do not materially reduce the overall level of security of MSP Personal Data.
7. SUB-PROCESSORS
7.1 The MSP grants Bitlync general written authorization to engage Sub-processors in accordance with this paragraph 7. The Sub-processors engaged at the date of this Addendum are those listed in Schedule 2.
7.2 Bitlync shall give the MSP not less than thirty (30) days' prior notice of the addition or replacement of any Sub-processor by updating the Sub-processor List and notifying the e-mail address registered on the MSP's account. The MSP may object on reasonable grounds relating to data protection by written notice within that period. If the Parties are unable to resolve the objection in good faith within thirty (30) days, the MSP may terminate the Principal Agreement in respect of the affected Service by written notice, without penalty.
7.3 Bitlync shall enter into a written agreement with each Sub-processor imposing data protection obligations no less protective than those in this Addendum, to the extent applicable to the services provided by that Sub-processor, and shall remain fully liable to the MSP for the performance of each Sub-processor's obligations.
8. DATA SUBJECT REQUESTS
8.1 Bitlync shall, taking into account the nature of the Processing, assist the MSP by appropriate technical and organizational measures, insofar as this is possible, in fulfilling the MSP's obligation to respond to requests by Data Subjects or Consumers to exercise their rights under Data Protection Laws, including requests under US State Privacy Laws to know or access, delete, correct or obtain a copy of MSP Personal Data, or to opt out of or limit its Processing. The MSP Portal provides the MSP with the means to view, and to direct the deletion of, MSP Personal Data held in the sync store, and the MSP shall use those functions in the first instance. Assistance beyond those self-service functions is subject to paragraph 14.
8.2 If Bitlync receives a request from a Data Subject or Consumer relating to MSP Personal Data, Bitlync shall not respond substantively, but may acknowledge receipt, inform the individual that Bitlync acts as a Service Provider or Processor on behalf of the MSP and cannot itself act on the request, and refer the individual to the MSP; and Bitlync shall notify the MSP of the request within five (5) Business Days (or any shorter period required by Data Protection Laws).
9. PERSONAL DATA BREACH
9.1 Bitlync shall notify the MSP without undue delay, and in any event within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting MSP Personal Data or Credentials. The notification shall, to the extent then known, describe the nature of the breach, including the categories and approximate number of Data Subjects and records concerned, the name and contact details of Bitlync's point of contact, the likely consequences of the breach, and the measures taken or proposed to address it and mitigate its effects. Where it is not possible to provide all such information at the same time, Bitlync shall provide it in phases without undue further delay. Bitlync shall also provide such further information in its possession as the MSP reasonably requires in order to meet its obligations under US Breach Notification Laws, including, where known, the identity and state or country of residence of affected individuals and whether the affected MSP Personal Data was encrypted or otherwise rendered unreadable.
9.2 Bitlync shall co-operate with the MSP and take such reasonable commercial steps as are directed by the MSP to assist in the investigation, mitigation and remediation of each Personal Data Breach. Bitlync shall not notify any Supervisory Authority, regulator or Data Subject of a Personal Data Breach on the MSP's behalf, or make any public statement identifying the MSP, without the MSP's prior written consent, unless required to do so by Applicable Laws. The allocation of the costs of responding to a Personal Data Breach is set out in paragraph 14.
10. ASSISTANCE, AUDIT AND RECORDS
10.1 Bitlync shall provide reasonable assistance to the MSP with any data protection impact assessment, data protection assessment (including under US State Privacy Laws) and prior consultation with a Supervisory Authority or other regulator which the MSP is required to carry out under Data Protection Laws in relation to the Processing of MSP Personal Data, taking into account the nature of the Processing and the information available to Bitlync, and subject to paragraph 14.
10.2 Bitlync shall make available to the MSP all information reasonably necessary to demonstrate compliance with this Addendum, including the Audit Log relating to the MSP's Connections and Grants, Bitlync's security overview, and (when available) its SOC 2 report or other third-party attestation, and shall allow for and contribute to audits, including inspections, conducted by the MSP or an independent auditor mandated by the MSP, subject to paragraph 10.3.
10.3 The MSP shall exercise its audit rights by first reviewing the information provided under paragraph 10.2. Where that information is insufficient to demonstrate compliance, the MSP may conduct an audit not more than once in any twelve (12) month period (save where required by a Supervisory Authority or following a Personal Data Breach), on not less than thirty (30) days' written notice, during normal business hours, without unreasonable disruption to Bitlync's business, subject to reasonable confidentiality obligations, and at the MSP's own cost, which shall include reimbursement of Bitlync's reasonable costs of allowing and contributing to the audit in accordance with paragraph 14 (save that, where the audit reveals a material breach of this Addendum by Bitlync, Bitlync shall bear its own costs of the audit). Bitlync may object to an auditor who is a competitor of Bitlync or who is not bound by confidentiality obligations.
11. INTERNATIONAL TRANSFERS
11.1 Bitlync is established in the United States and Processes MSP Personal Data there and in the locations of its Sub-processors. The MSP acknowledges that any MSP Personal Data which it or its clients transfer to Bitlync from the European Economic Area, the United Kingdom or Switzerland constitutes a Restricted Transfer.
11.2 In respect of each Restricted Transfer: (a) where the GDPR applies, the EU SCCs (Module Two: controller to processor, or Module Three: processor to processor, as applicable) shall apply and are incorporated by reference, completed as set out in Schedule 3; (b) where the UK GDPR applies, the EU SCCs as amended by the UK Addendum shall apply, completed as set out in Schedule 3; and (c) where Swiss law applies, the EU SCCs shall apply with the modifications set out in Schedule 3. The Parties agree that by accepting the Principal Agreement they are deemed to have executed the EU SCCs and the UK Addendum.
11.3 Bitlync has no establishment in the European Union or the United Kingdom and, therefore, has not, at the date of this Addendum, appointed a representative under Article 27 of the GDPR or Article 27 of the UK GDPR. Bitlync shall appoint such a representative if and when it is required to do so under the GDPR or the UK GDPR, including if it begins to offer the Service to organizations established in the European Economic Area or the United Kingdom, and shall notify the MSP of the representative’s identity and contact details.
11.4 Bitlync is not, at the date of this Addendum, certified under the EU-U.S. Data Privacy Framework. If Bitlync becomes so certified, it may notify the MSP that it will rely on that certification as an alternative transfer mechanism, without prejudice to the continued application of the EU SCCs as a fallback.
12. DELETION AND RETURN
12.1 Upon termination of the Principal Agreement, or upon deletion of a Connection or revocation of all Grants on it, Bitlync shall delete the affected Credentials and MSP Personal Data from the Vault and the sync store within ninety (90) days, and shall delete copies held in encrypted backups in the ordinary course of backup rotation (not exceeding thirty-five (35) days), unless Applicable Laws require the retention of the Personal Data, in which case Bitlync shall isolate and protect it from further Processing.
12.2 Bitlync may retain the Audit Log, including records that a deletion occurred, for the period stated in the Privacy Policy, pseudonymized where practicable, as a security and accountability record.
12.3 Prior to deletion, the MSP may export MSP Data from its Connected System directly, and Bitlync shall provide reasonable assistance on request to enable the MSP to verify that deletion has occurred.
13. LIABILITY
13.1 Each Party's liability arising out of or in connection with this Addendum, including under the EU SCCs and the UK Addendum, shall be subject to the exclusions and limitations of liability set out in the Principal Agreement, save that nothing in this paragraph 13 shall limit either Party's liability to Data Subjects under Clause 12 of the EU SCCs or any liability which cannot be limited under Data Protection Laws.
14. COSTS AND CHARGES
14.1 Bitlync provides the self-service functions described in this Addendum (including the MSP Portal, the Audit Log and the deletion, export and verification functions referred to in paragraphs 8.1 and 12.3) at no additional charge, and shall perform at its own cost those obligations which Data Protection Laws require Bitlync to perform without charge.
14.2 To the extent permitted by Data Protection Laws, the MSP shall pay Bitlync's reasonable and documented costs and expenses (including personnel time at Bitlync's then-current professional services rates or, if none are published, at a reasonable hourly rate) of providing assistance or performing work at the MSP's request or on the MSP's behalf which goes beyond the self-service functions referred to in paragraph 14.1 and beyond what Data Protection Laws require Bitlync to provide without charge, including: (a) manual assistance in responding to requests from Data Subjects or Consumers under paragraph 8, including searching for, retrieving, compiling, redacting or exporting MSP Personal Data; (b) assistance with data protection impact assessments, data protection assessments and consultations with Supervisory Authorities or other regulators under paragraph 10.1; (c) responding to requests for information and audits under paragraphs 10.2 and 10.3, other than the provision of the Audit Log, Bitlync's security overview and any then-current third-party attestation report; (d) the investigation, mitigation and remediation of, and co-operation in connection with, a Personal Data Breach to the extent that it was not caused by Bitlync or its Sub-processors, including where it was caused by the MSP, a client of the MSP, an ISV, a Connected System or the compromise of a Credential outside Bitlync's systems; (e) the retention of MSP Personal Data beyond the periods set out in paragraph 12 at the MSP's request, including for the purposes of a legal hold; (f) assistance with the export, return or verification of deletion of MSP Personal Data beyond that described in paragraph 12.3; and (g) responding to any subpoena, court order, or regulatory or law-enforcement request relating to MSP Personal Data, to the extent that recovery of such costs is not prohibited by Applicable Laws.
14.3 Where practicable, Bitlync shall provide the MSP with a good-faith estimate before incurring costs under paragraph 14.2 which are expected to exceed US$500 in respect of any single request or matter, and shall not incur costs materially in excess of that estimate without the MSP's approval (which may be given by e-mail). Bitlync shall invoice such costs in accordance with the invoicing and payment terms of the Principal Agreement.
14.4 Nothing in this paragraph 14: (a) entitles Bitlync to charge any Data Subject or Consumer for the exercise of their rights, or to charge the MSP for anything which Data Protection Laws require Bitlync to provide to the MSP free of charge; (b) entitles Bitlync to recover the cost of any work to the extent that the need for it arises from a breach of this Addendum or of Data Protection Laws by Bitlync or its Sub-processors; (c) makes the performance of any obligation of Bitlync under this Addendum, the EU SCCs or the UK Addendum conditional on the payment of any charge; or (d) affects the allocation of liability under paragraph 13. If and to the extent that any charge under this paragraph 14 is unenforceable under Data Protection Laws, it shall apply only to the extent enforceable and the remainder of this paragraph 14 shall be unaffected.
15. GENERAL
15.1 This Addendum shall remain in force for so long as Bitlync Processes MSP Personal Data on behalf of the MSP. Paragraphs 9, 12, 13 and 14 shall survive termination.
15.2 Bitlync may amend this Addendum from time to time to reflect changes in Data Protection Laws or in the Service, in accordance with the amendment procedure in the Principal Agreement, provided that no amendment shall materially reduce the protection afforded to MSP Personal Data.
15.3 This Addendum and any dispute or claim arising out of or in connection with it shall be governed by and construed in accordance with the law of the State of Delaware, and the Parties submit to the exclusive jurisdiction of the state and federal courts located in the State of Delaware, save that the EU SCCs and the UK Addendum shall be governed by the law and subject to the jurisdiction specified in Schedule 3.
SCHEDULE 1
DESCRIPTION OF PROCESSING
| Item | Description |
|---|---|
| Subject matter | The provision of the Service under the Principal Agreement: custody of Credentials, synchronization of MSP Data from Connected Systems, service of MSP Data to ISVs pursuant to Grants, delivery of writes, operation of the AI Assistant (where enabled), and maintenance of the Audit Log. |
| Duration | The term of the Principal Agreement and the deletion period in paragraph 12. |
| Nature and purpose | Collection (from Connected Systems), storage, organization, structuring, retrieval, consultation, disclosure by transmission (to ISVs at the MSP's direction), alignment and erasure, for the Business Purpose of enabling ISV products chosen by the MSP to interoperate with the MSP's Connected Systems. |
| Categories of Data Subjects | Employees, contractors and agents of the MSP; employees, contractors and agents of the MSP's clients (end customers) whose records exist in the Connected System; and, to the extent recorded in tickets, other individuals who correspond with the MSP. |
| Types of Personal Data | Names, business e-mail addresses, business telephone numbers, job titles, employer, user identifiers; ticket contents, notes and time entries; device names, assignments and installed applications; company and contact records; agreement and project references. Credentials (API keys and tokens) of the MSP's integration users. |
| Special categories of data and Sensitive Data | None intended. The MSP shall not direct the synchronization of special category data or Sensitive Data (including Social Security or other government identification numbers, financial account or payment card numbers, precise geolocation, health information, or Personal Data of a child under 16). Documentation passwords and credential objects held in Connected Systems are never synchronized. |
| Frequency of transfer | Continuous, for the duration of each Connection. |
| Recipients | ISVs holding a Grant (at the MSP's direction); Sub-processors listed in Schedule 2. |
| Retention | As set out in paragraph 12 and the Privacy Policy. |
SCHEDULE 2
SUB-PROCESSORS AT THE DATE OF THIS ADDENDUM
| Sub-processor | Purpose | Location | Data affected |
|---|---|---|---|
| Microsoft Corporation (Microsoft Azure) | Hosting of the API, Vault and sync store | United States | MSP Personal Data and Credentials (Credentials encrypted at rest) |
| Render Services, Inc. | Hosting of the public Sandbox | United States | Demonstration data only; no MSP Personal Data |
| Formsubmit | Delivery of Contact us form submissions | Not published by Formsubmit (may be outside the United States) | Business contact details of persons submitting the form; no MSP Personal Data |
| GitHub, Inc. (GitHub Pages) | Hosting of www.bitlync.com | United States | Web server logs; no MSP Personal Data |
| Stripe, Inc. | Invoicing and payment collection from ISVs | United States | ISV billing data; no MSP Personal Data |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | United States | Error reports and performance traces, with Credentials and secrets scrubbed before sending |
| Microsoft Corporation (Azure OpenAI Service) | AI processing of public ISV website text for guided setup | United States | Public ISV website text; no MSP Personal Data |
| Plus Five Five, Inc. (Resend) | Transactional and sign-in e-mail delivery | United States | Recipient e-mail addresses and e-mail content (sign-in links, account notices and alerts) |
| TypeSafe | AI classification of ISV setup text | To be confirmed | ISV setup text; no MSP Personal Data |
SCHEDULE 3
INTERNATIONAL TRANSFER TERMS
1. EU SCCs. The EU SCCs are incorporated by reference and completed as follows: (a) Module Two (controller to processor) applies where the MSP is a Controller, and Module Three (processor to processor) applies where the MSP is a processor for its own clients; (b) in Clause 7, the optional docking clause applies; (c) in Clause 9, Option 2 (general written authorization) applies with a notice period of thirty (30) days; (d) in Clause 11, the optional language does not apply; (e) in Clauses 17 and 18, the law and courts of Ireland apply; (f) Annex I.A (parties) is completed with the details of the Parties as identified in the Principal Agreement, the MSP being the data exporter and Bitlync the data importer; (g) Annex I.B (description of transfer) is completed by Schedule 1; (h) Annex I.C (competent supervisory authority) is the authority determined in accordance with Clause 13; and (i) Annex II (technical and organizational measures) is completed by Schedule 4 and Annex III (sub-processors) by Schedule 2.
2. UK Addendum. For transfers subject to the UK GDPR, the EU SCCs as completed above apply as amended by the UK Addendum, with: Table 1 completed by the Parties' details as identified in the Principal Agreement; Table 2 referring to the EU SCCs as completed in paragraph 1 of this Schedule; Table 3 completed by Schedules 1, 2 and 4; and Table 4 providing that either Party may end the UK Addendum as set out in section 19 of the UK Addendum.
3. Switzerland. For transfers subject to Swiss law, the EU SCCs apply with the following modifications: references to the GDPR are to be read as references to the Swiss Federal Act on Data Protection; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; the term "Member State" shall not be interpreted so as to exclude Data Subjects in Switzerland from suing for their rights in Switzerland; and the EU SCCs also protect the data of legal entities until the entry into force of the revised Act.
SCHEDULE 4
TECHNICAL AND ORGANIZATIONAL MEASURES
| Measure | Description |
|---|---|
| Encryption of Credentials | Credentials are encrypted at rest using AES-256-GCM with encryption keys maintained on a per-tenant basis, and are never disclosed to ISVs. |
| Encryption in transit | All connections to the Service, the API and Connected Systems use TLS. |
| Tenant isolation | Structural tenant isolation: at authorization time, another organization's tenant is indistinguishable from a non-existent one. Machine (API key) access and human console sessions are never merged. |
| Access control and least privilege | ISVs receive scoped, revocable Grants rather than possession of Credentials; each permission is tested before a Grant goes live; the MSP may narrow or revoke at any time. Bitlync support access is read-only. |
| Logging and audit | Append-only Audit Log of API calls, writes, logins, acceptances and Grant changes, visible to the MSP in the MSP Portal. |
| Write safety | Preview (dry_run) then commit; idempotency keys where supported; deletion of records in a Connected System and synchronization or disclosure of documentation passwords or credential objects refused by policy; close-with-resolution disabled by default; updating of companies and agreements, creation or updating of contacts, projects and custom fields, and device and documentation changes, disabled unless enabled by the MSP; billing writes limited to updating the quantity on a billing record which the MSP has matched to the ISV. The Service currently does not create companies or customers, agreements or contracts, or billing records in the MSP's professional services automation system. Any additional write types will be available only with the MSP's explicit authorization. |
| Data minimization | Documentation passwords and credential objects held in Connected Systems are never synchronized. Only objects within an approved Grant are served to an ISV. |
| Rate governance | Bitlync paces its calls to each Connected System to a fraction of the vendor's published per-tenant limit to avoid service disruption to the MSP. |
| AI Assistant | Where enabled: structurally read-only (no write tool), tenant-pinned, grounded-or-escalate, spend-capped; MSP Data is not used to train generally available models. |
| Personnel | Confidentiality obligations and data protection training for all personnel with access to MSP Personal Data. |
| Vulnerability management | Regular patching and vulnerability assessment of the Service. |
| Business continuity | Encrypted backups rotated within thirty-five (35) days; connection health and incident reporting published in the MSP Portal. |
| Assurance | SOC 2 examination in progress; no completed report is claimed until confirmed in writing. Report to be made available under paragraph 10.2 when issued. |
| Deletion | Secure deletion of Credentials and MSP Personal Data within ninety (90) days of termination, deletion or revocation, subject to backup rotation. |