Data Processing Addendum

• Customer Personal Data means personal information in Your Data that we process on your behalf, such as the names of your customers, vendors and employees, the hours and labor cost on time entries, descriptions and memos typed into QuickBooks, and the email addresses of team members and brief recipients you add.
• Data Protection Laws means the United States federal and state privacy and data security laws that apply to that processing, such as the California Consumer Privacy Act and other state consumer privacy laws, to the extent they apply.
• Subprocessor means a service provider we engage that processes Customer Personal Data.
• Security Incident means a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Personal Data.

You decide why and how Customer Personal Data is processed, and we process it for you as your service provider or processor. You are responsible for having the right to give us that data and for any notices or consents the law requires you to give the people it concerns. If you are a bookkeeping or accounting firm using the Service for your clients, you may yourself be processing their data for them; you are responsible to them, and we act on your instructions as the account holder.

We process QuickBooks data for you, not on Intuit’s behalf.

We process Customer Personal Data only to provide, secure, support and improve the Service for you as the Terms describe, following the settings and choices you make in the Service and any other written instructions we agree to, and as the law requires. If the law requires other processing, we will tell you first unless the law forbids it. If we believe an instruction breaks a Data Protection Law, we will tell you. Improving the Service may include creating aggregated or de-identified information that does not identify you, your business or any person.

We will not:

• sell or share Customer Personal Data, as Data Protection Laws use those words;
• keep, use or disclose it for any purpose other than the business purposes in this Addendum, including for targeted or cross-context behavioral advertising, or outside our direct business relationship with you; or
• combine it with personal information we receive from anyone else or collect ourselves, except as Data Protection Laws allow.

We will comply with the obligations Data Protection Laws place on us as a service provider or processor, give Customer Personal Data the level of protection those laws require, and tell you if we can no longer meet these commitments. You may then take reasonable steps to stop and remedy any unauthorized use, including by contacting us or suspending your use of the Service. We certify that we understand these restrictions and will comply with them.

Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality. Contractors who help with our outreach and sales have no access to the Service’s data.

You authorize us to use these Subprocessors for these purposes:

We have a written agreement with each Subprocessor that requires data protection and security at least as protective as this Addendum, and we are responsible for their work as if it were our own. Before a new Subprocessor starts processing Customer Personal Data, we will update this list and email the address on your account at least 30 days ahead, unless an urgent change is needed to keep the Service running or secure, in which case we will tell you as soon as we can. If you object on reasonable data protection grounds, tell us; if we can’t resolve it, you may cancel, and we will refund any amount you prepaid for the period after cancellation.

We use administrative, technical and physical safeguards appropriate to the risk, including those our Security page describes: HTTPS for all traffic, QuickBooks tokens and company IDs encrypted before they are stored, hashed passwords, server-side checks that every request for financial data comes from the account that owns it, and error logs that leave out raw QuickBooks responses. We do not hold SOC 2, ISO 27001 or similar certifications, and the Security page says so.

If we confirm a Security Incident affecting your Customer Personal Data, we will tell you without undue delay, and within any deadline the law sets for us. We will describe what happened and the data involved as far as we know it, take reasonable steps to contain it and reduce harm, and give you the information and help you reasonably need to meet your own notification obligations.

The Service lets you correct settings and job details, delete a company’s data and delete your account. Where that is not enough for a request from a person whose information is in Customer Personal Data, we will help you respond, taking into account what the Service does and the information we have. If such a person asks us directly, we will refer them to you. We will also give you information you reasonably need for a data protection assessment the law requires of you.

You can export reports such as the WIP schedule from the Service at any time. If you need a copy of other Customer Personal Data we hold, ask us before you delete it and we will provide it in a common format within 30 days where reasonably practical.

When you delete a company’s data or your account, we delete the related Customer Personal Data. When a company is disconnected from QuickBooks (including from your Intuit account), we stop processing its data and delete it 30 days later unless you reconnect it first, as the Terms (Section 3) describe. Deleted data may remain in database backups until they are overwritten on their normal schedule, and we keep only what the law requires us to keep.

Once a year, and after a Security Incident, we will answer your reasonable written questions about how we protect Customer Personal Data, and share any security summaries our Subprocessors make available to us. This Addendum does not give a right to inspect our premises or systems.

Customer Personal Data in the Service is stored and processed in the United States, except that our providers may access it from other countries for their own safety review, support and incident response, as Section 10 of our Privacy Policy describes. Emails you send us are kept in Google Workspace, which may store them outside the United States.

This Addendum lasts as long as we process Customer Personal Data for you. It is subject to the limitation of liability in Section 12 of the Terms. If it conflicts with the Terms about the processing of Customer Personal Data, this Addendum controls. We may update it as Section 18 of the Terms describes. Questions go to support@jobprofitai.com, or by mail to: