Get Squillo Consigue Squillo Obtenez Squillo

Data Processing Agreement

Squillo, Inc. — U.S. Data Processing Addendum

Last Revised: July 31, 2026

This U.S. Data Processing Addendum (“Addendum”) is between Squillo, Inc. (“Squillo”) and the entity subject to the Terms of Service governing our free and paid services (“Company”), each a “Party” collectively, the “Parties”.

WHEREAS, Company and Squillo are parties to the Squillo, Inc. Terms of Service (the “Agreement”); and

WHEREAS, this Addendum is incorporated into the Agreement to describe the additional terms under which Squillo will handle any Personal Information under its obligations outlined in the Agreement and in compliance with Applicable Privacy Laws (as defined below). Capitalized terms used in this Addendum which are not defined in this Addendum have the meanings ascribed to them in the Agreement.

NOW, THEREFORE, for good and valuable consideration, the receipt and sufficiency of which is hereby acknowledged, the Parties agree as follows:

1. Definitions.

  1. “Applicable Privacy Laws” means as applicable and binding on the Parties any federal, state or local laws of the United States, or regulations governing the protection or privacy of Personal Information.

  2. “Business Contact Information” means business related contact details of a Party’s personnel, such as name, business address, business email address, business telephone number, job title, and other similar information used for ordinary business communications between the Parties.

  3. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household (“data subject”), or that is otherwise deemed personal information under Applicable Privacy Laws, and has been provided by or on behalf of Company to Squillo in performance of the Services under the Agreement.

  4. “Process” or “Processing” means any operation or set of operations which is performed on Personal Information or on sets of Personal Information whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

  5. “Security Incident” means any unauthorized access to or disclosure or acquisition of Personal Information. Security Incident includes, but is not limited to, any “breach of the security of the system”, “breach of personal data”, or “loss of personal data” as defined under Applicable Privacy Laws.

  6. “Subcontractors” means any third party engaged by Squillo to Process any Personal Information relating to this Addendum and/or the Agreement (including the term “Sub-processor” or a similarly defined terms as defined in Applicable Privacy Laws).

2. Roles.

The Parties agree that for purposes of compliance with the Applicable Privacy Laws, Company operates as a “controller” or “business” as those terms are defined in Applicable Privacy Laws and Squillo operates as a “processor” or “service provider” as those terms are defined in the Applicable Privacy Laws.

Notwithstanding anything to the contrary in this Addendum, the Parties acknowledge and agree that: (a) Squillo and Company each act as an independent controller, business, or equivalent term under Applicable Privacy Laws with respect to Business Contact Information of the other Party’s personnel; and (b) each Party shall Process such Business Contact Information only for legitimate business purposes relating to the Agreement and this Addendum, including maintaining the commercial relationship, communicating about the Services, and meeting each Party’s own legal and regulatory obligations.

3. Compliance.

Squillo shall comply with Applicable Privacy Laws and Process all Personal Information consistent with the restrictions and obligations on Processors set forth in Applicable Privacy Laws. Company shall, in its use of the Services, comply with all Applicable Privacy Laws.

4. Permissible Processing.

Squillo shall Process Personal Information only (i) for the purposes set forth in the Addendum, (ii) in accordance with the terms and conditions of the Agreement and any other documented instructions provided by Company, and (iii) in compliance with Applicable Privacy Laws. Company hereby instructs Squillo to Process Personal Information in accordance with the Agreement (“Company’s Business Purpose”). Squillo may aggregate, de‑identify, and/or anonymize Personal Information it Processes on behalf of Company, and may use and disclose such aggregated, de‑identified, and/or anonymized data for its lawful business purposes, provided that such data does not identify, and is not reasonably capable of being linked to, Company, any consumer, household, or device.

5. Prohibited Uses of Personal Information.

Squillo may retain, use or disclose Personal Information as allowed by Applicable Privacy Laws. However, Squillo shall not: (i) sell or share (as defined under the California Consumer Privacy Act) Personal Information; (ii) collect, retain, use, or disclose Personal Information outside of the direct business relationship between Company and Squillo; or (iii) combine Personal Information with Personal Information that Squillo obtains from other sources or that Squillo collects itself, except as permitted under Applicable Privacy Laws. Squillo acknowledges that the Personal Information Company discloses is provided for a “business purpose” (as defined under Applicable Privacy Laws). Squillo understands that upon notice, Company may exercise any right of a controller or “business” under Applicable Privacy Laws including, but not limited to, any right that (a) permits Company to take reasonable and appropriate steps to ensure that Squillo uses Personal Information consistent with Company’s business purpose (b) stops or remediates Squillo’s unauthorized use or misuse of Personal Information, upon written notice to Squillo. Without unreasonable delay, Squillo shall notify Company if it can no longer meet its obligations under the Applicable Privacy Laws to the extent required under Applicable Privacy Laws and such laws are applicable to the Parties. Squillo certifies that it understands and shall comply with the Processing restrictions set forth in this Addendum.

6. Company Obligations.

Company’s Processing instructions to Squillo for the Processing of Personal Information must comply with all Applicable Privacy Laws. In addition, Company shall have sole responsibility for the accuracy, quality, and legality of Personal Information Company or its affiliates provide and the means by which Company acquired the Personal Information, including providing any required notices to, and obtaining any necessary consent from, its clients, data subjects, employees or contractors who qualify as end-users for the Services. Should Company learn that it has provided Personal Information under the Agreement or this Addendum that may not be shared pursuant to a consent or data privacy notice, Company shall promptly notify Squillo in writing. Company further acknowledges and agrees that:

  1. Squillo shall not be liable for the Processing of any Personal Information in which Company failed to (i) obtain consent from or provide proper notice to the relevant data subject or (ii) possess a lawful basis to Process such Personal Information. Additionally, Company shall comply with (a) the obligations of a data controller, “business,” or equivalent term (as these terms are defined under applicable laws) under all Applicable Privacy Laws; (b) all terms of the Agreement; and (c) all terms of this Addendum; and

  2. Company’s failure to comply with the obligations under this Section shall be a material breach of this Addendum. Upon such breach, Squillo may immediately cease Processing of any Personal Information under this Addendum and the Agreement. Squillo shall also be entitled to all remedies available under Agreement, this Addendum and applicable law.

7. Information Security.

  1. Access to Personal Information. Squillo will limit access to Personal Information to: (a) those authorized persons who require Personal Information access to meet Squillo’s obligations under this Addendum and the Agreement; and (b) the part or parts of the Personal Information that those authorized persons strictly require for the performance of their duties. Squillo will ensure that all authorized persons: (i) are informed of the Personal Information’s confidential nature and use restrictions; (ii) have undertaken training on all Applicable Privacy Laws relating to handling Personal Information and how it applies to their particular duties; and (iii) are aware both of Squillo’s duties and their personal duties and obligations under the Applicable Privacy Laws, this Addendum, and the Agreement.

  2. Reasonable Security Measures. Squillo will implement and maintain administrative, technical, and physical safeguards designed to reasonably protect the confidentiality, availability, and integrity of the Personal Information.

8. Data Subject Requests.

If a known Company data subject submits a request directly to Squillo relating to Personal Information, Squillo shall notify Company, in writing, of the request no later than seventy-two (72) hours after receiving such request.

9. Assistance.

Squillo agrees to reasonably cooperate with Company in responding to any applicable data subject requests pertaining to the access, restriction, limitation or deletion of the Personal Information. Squillo shall also reasonably assist Company with meeting Company’s compliance obligations under all Applicable Privacy Laws, taking into account the nature of Squillo’s Processing and the information available to Squillo.

10. Security Incident and Response Procedures.

  1. Notification. Squillo will notify Company of a confirmed Security Incident as soon as reasonably practicable, but no later than five (5) days after Squillo becomes aware of it. The notification will include, at least, the following information: (i) nature of the incident; (ii) the Personal Information compromised or involved in the Security Incident; (iii) initial recommendations to protect data subject’s rights; (iv) corrective actions initially implemented.

  2. Coordination. Following Squillo’s notification to Company of a Security Incident, the Parties will coordinate with each other, as necessary, to investigate the Security Incident and Squillo will take all actions as may be required under Applicable Privacy Laws in remediating the impacts of the Security Incident and meeting all of its obligations under such Applicable Privacy Laws.

11. Return or Disposal of Personal Information.

On the termination or expiration of the Agreement, Squillo will promptly return to Company or securely dispose of all Personal Information in its possession and notify Company that such Personal Information has been returned to Company or disposed of securely. If Squillo is not reasonably able to return or securely dispose of Personal Information, including, but not limited to, Personal Information stored on backup media, Squillo will continue to protect such Personal Information in accordance with the terms of this Addendum until such time that it can reasonably return or securely dispose of such Personal Information.

12. Audits.

Once per calendar year, upon written request by Company, Squillo shall provide Company written confirmation that it has complied with all of the requirements of this Addendum. Furthermore, Company reserves the right, upon written notice, to perform, or engage a third party to perform, an audit of Squillo as well as if necessary its affiliates, Subcontractors and third parties that Process Company Personal Information pursuant to this Addendum to ensure that technical organizational measures and security controls are operating adequately. The audit, assessment, or inspection shall be conducted using appropriate and accepted control standards or frameworks and audit procedures. A request for an audit or inspection under this Section may be satisfied by the provision of a recent third-party attestation addressing relevant controls (e.g., ISO 27001 or SOC 2 report) or a completed due diligence questionnaire, unless such mechanisms are insufficient to comply with Applicable Privacy Laws. Squillo shall reasonably cooperate and assist Company in the completion of Company’s cybersecurity audit and risk assessment as required by Applicable Privacy Laws.

13. Subcontractors.

Company hereby expressly consents to Squillo engaging Subcontractors to Process Personal Information provided that:

  1. Squillo imposes data protection terms on any Subcontractor it engages no less protective as the terms contained in this Addendum; and

  2. Squillo remains fully liable for any breach of this Addendum or the Agreement that is caused by an act, error, or omission of such Subcontractor.

14. Conflicts; Severability; Expiration.

In the event of any conflicts between the Agreement and this Addendum as it relates to the Processing of Personal Information, this Addendum shall govern. Should any provisions of this Addendum be invalid or unenforceable, then the remainder of this Addendum shall remain valid and in force. The invalid or unenforceable provision shall be either (i) amended as necessary to ensure its validity and enforceability, while preserving the Parties’ intentions as closely as possible or, if this is not possible, (ii) construed in a manner as if the invalid or unenforceable part had never been contained herein. This Addendum shall expire upon the later of (a) the termination of the Agreement, (b) cessation of any processing of Personal Information by Squillo on behalf of Company pursuant to the provision of the Services, or (c) delivery of written notice of termination of the Agreement from one Party to the other.