Data Processing Addendum

1. Scope and roles

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Intralyn LLC (“Intralyn”) and the business that uses Intralyn (“Customer,” “you”). It applies to personal information contained in Customer Data that Intralyn processes for you, such as details about your customers, their contacts, your vendors and your employees (“Customer Personal Data”).

For Customer Personal Data, you are the business (controller) that decides why and how it is processed, and Intralyn is your service provider (processor). Terms used here, such as “business,” “service provider,” “controller,” “processor” and “personal information,” have the meanings given in applicable U.S. privacy laws. If this DPA and the Terms conflict about Customer Personal Data, this DPA controls.

Back to top

2. Processing on your instructions

Intralyn processes Customer Personal Data only to provide, secure and support the Service, and only on your documented instructions. Your instructions are these Terms and this DPA, and the choices you make when you use the Service (for example, creating a record, sending an invoice or connecting an integration).

• Nature and purpose: hosting, storing, displaying, sending and backing up records so you can run your business.
• Types of data: names, contact details, addresses, billing and payment records, appointment and task details, notes, documents and files you upload.
• People involved: your customers and their contacts, your vendors, your employees and team members.
• Duration: while your account is open, and then until deletion as described below.

We will tell you if we believe an instruction violates the law. You are responsible for your instructions being lawful and for giving any required notices and getting any required consents.

Back to top

3. Service provider commitments

Intralyn will not:

• sell Customer Personal Data, or share it for cross-context behavioral advertising;
• keep, use or disclose it for any purpose other than providing the Service to you, or as the law allows a service provider to;
• keep, use or disclose it outside our direct business relationship with you;
• combine it with personal information we receive from others, except as the law allows a service provider to.

We will follow the privacy laws that apply to us as your service provider, give the same level of protection they require, and tell you if we can no longer meet these obligations. You may take reasonable steps to stop and fix unauthorized use of Customer Personal Data, including closing your account. We understand and will comply with these restrictions.

Back to top

4. Confidentiality and access

Only authorized Intralyn personnel who need access to run or secure the Service, investigate abuse, comply with law, or answer a support request you send us can access Customer Personal Data. They are bound by confidentiality duties.

Back to top

5. Security measures

Intralyn maintains reasonable administrative, technical and physical safeguards appropriate to the nature of the data, including:

• encryption of data in transit (HTTPS) and at rest by our hosting provider;
• separation of each business’s records, enforced on our servers;
• salted password hashing, optional two-step verification, short-lived sessions and sign-in rate limits;
• restricted, logged staff access, including a time-limited, read-only “view as customer” mode for support;
• regular backups kept for a limited time;
• an audit history of important account changes.

You are responsible for the security of your own sign-ins, devices, team access and the data you choose to enter.

Back to top

6. Subprocessors

You authorize Intralyn to use the following subprocessors. Each is bound by written terms that protect the data at least as much as this DPA requires, and Intralyn remains responsible for their work.

We will update this list at least 30 days before adding a new subprocessor, except in an emergency. If you object on reasonable privacy grounds, tell us at admin@intralyn.com; if we cannot address your concern, you may close your account and we will refund prepaid fees for the unused period.

Back to top

7. Help with people’s requests

If someone asks you to see, correct, delete or get a copy of their information, you can do this yourself in the Service: edit or delete their records, and download data from Settings → Your data. If you need more help, email admin@intralyn.com and we will provide reasonable help. If we receive a request directly from one of your customers or employees, we will refer them to you and will not respond ourselves, unless the law requires it.

Back to top

8. Security incidents

If we become aware of a breach of security that leads to unauthorized access to, or loss, change or disclosure of, Customer Personal Data, we will notify the account owner without undue delay and as required by law. We will describe what happened as far as we know, what data was involved, and what we are doing about it, and we will give reasonable help so you can meet your own notice duties. Notifying you is not an admission of fault.

Back to top

9. Return and deletion

You can download Customer Data at any time while your account is open. After your account is closed, we keep Customer Data for 30 days so you can reopen the account or ask for a copy, then delete or de-identify it no later than 90 days after closing. Encrypted backup copies expire within 30 days after deletion. We may keep data longer only where the law requires it, and we keep protecting it while we do.

Back to top

10. Information and reviews

On reasonable written request, no more than once a year, Intralyn will answer written questions and provide information reasonably needed to show that it meets this DPA, subject to confidentiality. On-site audits are not offered unless required by law or agreed in writing, at your expense.

Back to top

11. Where data is processed

Intralyn serves U.S. businesses. Customer Personal Data is processed in the United States and in other locations where our subprocessors operate data centers. If you need terms for personal information from outside the United States, contact us before entering it.

Back to top

12. Liability and term

This DPA lasts as long as Intralyn processes Customer Personal Data for you. Each party’s liability under this DPA is subject to the limitation of liability and other terms in the Terms of Service.

Back to top

13. Contact

Questions about this DPA, or need a countersigned copy for your records? Email admin@intralyn.com or write to us:

Back to top