These terms are being finalized and may change before Headr's public launch.
This addendum is part of the Terms of Service. It covers the personal information Customer puts into Headr about its own customers, leads and crew ("Customer Data"). For Customer Data, Customer decides what's collected and why; [Legal name] ("Headr") handles it only to provide Headr to Customer. Where a state privacy law uses the terms, Customer is the "business" or "controller" and Headr is the "service provider" or "processor."
1. What Headr will do
- Use Customer Data only to provide, secure and support Headr for Customer, as Customer instructs through its use of Headr, or as the law requires (and if the law requires something else, tell Customer first unless the law forbids it).
- Never sell or share Customer Data, use it for advertising, or combine it with other companies' data.
- Make sure everyone at Headr who can reach Customer Data is bound to keep it confidential, and limit that access to what their job needs.
- Look inside Customer's account only when Customer's administrator turns on support access (or when needed to stop an active security threat), with every page viewed logged for Customer to see.
- Keep the security measures in section 3 in place.
- Help Customer answer requests from its customers to see, correct or delete their information.
- Delete or return Customer Data when the agreement ends, on the schedule in the Terms and Privacy Policy.
- Give Customer the information reasonably needed to show Headr is meeting this addendum.
2. Service providers (subprocessors)
Headr uses the service providers listed in the Privacy Policy to run Headr. Each is bound by a written agreement to protect the data at least as well as this addendum requires. Headr stays responsible for them. We'll post changes to the list at least 30 days ahead, and Customer may object; if we can't resolve it, Customer may cancel and receive a refund of prepaid fees for the unused period.
3. Security measures
| Area | What Headr does |
|---|---|
| Separation | Each company's records and files are walled off at the database level. Walls are tested before every release. |
| Sign-in | Passwords stored scrambled. Two-step sign-in required for administrators and Headr staff. |
| Permissions | Each company sets what each role can see and change; the database enforces it. |
| Encryption | In transit (HTTPS) and when stored. |
| Sensitive numbers | Card numbers and Social Security numbers are blocked from being saved. |
| Staff access | Only with Customer's support permission, read-only, time-limited, logged. |
| Keys | Database and server keys are never in the app; Headr's own accounts use two-step sign-in. |
| Backups | Regular automatic backups, kept for a limited time. |
4. If there's a breach
If Headr confirms that Customer Data was accessed or taken without permission, Headr will tell Customer without undue delay and within 72 hours, explain what happened as far as it's known, what data and how many people are affected, and what's being done. Headr will help Customer meet the notice duties that fall on it under state law, and will cover the reasonable costs of notices when the breach was caused by Headr's failure to meet this addendum.
5. Customer's part
Customer is responsible for having a lawful basis and any needed consent for the data it puts into Headr (including consent to text), for not putting prohibited data into Headr (Terms section 4), and for its own people's use of their logins.