Data Processing Addendum
Processing terms for Customer Personal Data handled through FaciliPulse.
This Data Processing Addendum ("DPA") supplements the FaciliPulse Terms of Service (the "Agreement") between Palm Technologies LLC ("Palm Technologies," "Processor") and the customer entity agreeing to these terms ("Customer," "Controller").
1. Scope and roles
- Roles of the parties. Customer is the Controller of Customer Personal Data, and Palm Technologies is the Processor processing such data solely on behalf of Customer.
- Compliance with laws. Both parties agree to comply with all applicable data protection and privacy laws, including U.S. state privacy laws and GDPR, as applicable.
2. Processing of Customer Personal Data
- Processor instructions. Palm Technologies will process Customer Personal Data only to provide, support, and maintain the Services in accordance with the Agreement, this DPA, and Customer's lawful written instructions.
- No sale or share. Palm Technologies will not "sell" or "share" Customer Personal Data, as defined under applicable privacy laws, nor retain, use, or disclose Customer Personal Data outside of the direct business relationship between Palm Technologies and Customer.
3. Video and image data handling
- Short-form video ingestion. To perform occupancy analysis, Customer's local edge client or desktop application transmits short video clips, typically up to 3 seconds, to Processor's cloud infrastructure.
- Ephemeral processing. Routine video clips transmitted for inference are processed ephemerally and deleted immediately upon calculation of numerical occupancy data. Palm Technologies does not retain routine video clips in persistent storage.
- No biometric identification. Processor's algorithms perform object detection and head/person counting only; Processor does not perform facial recognition, feature matching, or biometric identification.
4. Subprocessors
- Authorized Subprocessors. Customer grants Palm Technologies general authorization to engage third-party infrastructure and service providers, including Google Cloud / Firebase, Cloudflare, Stripe, and carrier gateways such as Twilio and Telnyx, to perform the Services.
- Obligations. Palm Technologies enters into written agreements with each Subprocessor imposing data protection terms no less protective than those in this DPA.
- Notice of changes. Palm Technologies will maintain an up-to-date list of Subprocessors and provide notice of new Subprocessors upon request.
5. Technical and organizational security measures
- Security controls. Palm Technologies implements administrative, physical, and technical safeguards designed to protect Customer Personal Data, including encryption of data in transit (HTTPS/TLS) and at rest, role-based access control, least-privilege credentials, and vulnerability management.
- Confidentiality. Palm Technologies ensures that all personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
6. Security incident management
- Incident notification. If Palm Technologies confirms a security breach resulting in unauthorized access, destruction, or disclosure of Customer Personal Data, Palm Technologies will notify Customer without undue delay, and no later than 72 hours after becoming aware.
- Remediation. Palm Technologies will take reasonable steps to mitigate the effects of the incident and assist Customer in fulfilling its notification obligations under applicable law.
7. Data subject requests and assistance
- Assistance. Considering the nature of processing, Palm Technologies will reasonably assist Customer, at Customer's expense if outside standard tools, in responding to data subjects exercising their legal rights, such as access, deletion, or correction.
- Direct inquiries. If Palm Technologies directly receives a request from a visitor or member of Customer, Palm Technologies will advise the individual to submit the request directly to Customer.
8. Deletion and return of data
Upon termination of the Agreement, Palm Technologies will delete or de-identify Customer Personal Data in accordance with its Privacy Policy retention schedules, unless required by applicable law to retain copies.