Data Processing Addendum

Most of the time, we are not handling personal information on anybody's behalf. We decide what information we need, why we need it, and how long we keep it, and we answer for that ourselves. That is what our Privacy Policy describes. This page is for the narrower situation where you give us personal information about other people, such as your employees, your contractors or your own customers, and ask us to process it for you on your instructions. It sets out what we may do with that information, what we may not do with it, what we owe you, and how you put it in place. It supplements our Terms of Service and it applies only where section 1 says it applies. If you buy from us as an individual, for your own company formation, your own tax return or your own trademark, this page almost certainly does not apply to you and the Privacy Policy is the document you want.

1. What this Addendum is and when it applies

1.1 The short version

This Addendum applies when all of the following are true. You are a business customer. You give us personal information about people other than yourself, or you give us access to a system that holds it. You ask us to do something specific with that information as part of a service you bought from us. And you, not us, decide why that information is being processed.

We follow your instructions. In that arrangement you are the Business and we are your Service Provider, and this Addendum is the written contract that arrangement legally requires.

1.2 Where we act for ourselves instead

For most of what we sell, we are not anyone's Service Provider. When you buy a company formation, an EIN registration, a tax return, a trademark application or a brand identity, we decide how the work is done, we exercise our own judgment, we keep records because our own legal and professional obligations require it, and we set our own retention periods. That makes us a Business and a Controller in our own right for that information, and this Addendum does not apply to it. Section 4 sets out the position service by service. We would rather say that plainly than sign a document that describes us as a processor for work where we are not one.

1.3 What this Addendum never covers

• Information about you as our customer, including your own contact details, your account and your billing information. The Privacy Policy covers that.
• Tax Return Information. Federal tax law governs what we may do with it, and no contract between us can widen that. Section 17 explains.
• Information we collect from visitors to our own website at https://blugency.co, which is ours to answer for.
• Information a person gives directly to a Third Party, including a bank, a government agency or an independent professional we referred you to.
• The handling of money. This Addendum is about information. Whether, when and how any funds move is dealt with in your order and in the Terms of Service, not here.

The application at https://app.blugency.co is not on that list. It runs on separate infrastructure and it has accounts, uploads and payments, but it has no separate data processing terms of its own. This Addendum covers Customer Personal Information you give us through the application in exactly the same way as information you send us any other way. What decides whether this Addendum applies is section 1.1, which is about whose information it is and who decides why it is processed, not about which system it arrived through.

1.4 We are not a law firm, and this Addendum is not advice

We are not a law firm and we are not a licensed CPA firm in any state. We do not provide legal advice or legal representation, and we are not your attorney. Some of what we sell is delivered by licensed professionals engaged by us as contractors, including attorneys admitted to practice before the United States Patent and Trademark Office for trademark and intellectual property filings, and Certified Public Accountants for tax filings. Our Legal Disclaimer explains what that does and does not mean. Buying a tax or accounting service from us does not make this document tax advice either, and it does not create the relationship you would have with a lawyer or with an accountant you engage directly.

This Addendum is a contract. Where it mentions a legal deadline or a legal duty, it does so to explain why a clause exists, not to tell you how the law applies to your business. Deciding which privacy, employment or tax laws apply to you, and what they require of you, is your decision to make with a lawyer or a credentialed tax professional you choose.

2. How this Addendum is entered into

2.1 It supplements our Terms of Service

This Addendum forms part of your agreement with us. It does not stand alone, and it does not replace the Terms of Service, the Purchasing Terms or the Privacy Policy.

2.2 When it starts applying

It applies automatically, from the first day we process Customer Personal Information for you, whether or not either of us has signed anything. You do not have to ask for it to get the protection in it. If you want a countersigned copy for your records or for your own compliance file, section 20 tells you how to get one.

2.3 Which document wins

Where this Addendum and the Terms of Service disagree about how we handle Customer Personal Information, this Addendum wins for that processing. Everything else in the Terms of Service continues to apply in full, including the limitation of liability, which this Addendum does not change or expand. Where this Addendum and a separate signed agreement between us disagree, the signed agreement wins. The Terms of Service contains the order of precedence for our whole legal set, and that order settles any conflict this section does not.

3. Definitions

These words carry the following meanings wherever they appear with a capital letter in this Addendum. Words defined in the Terms of Service keep their meaning here unless this section says otherwise.

• Addendum means this Data Processing Addendum, including Annex A and Annex B.
• Blugency, we, us and our mean Blugency LLC, a New Mexico limited liability company with its registered address at 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States.
• Business means the company that decides why and how Personal Information is processed. California law uses this word. For Customer Personal Information, you are the Business.
• Consumer means an individual whose Personal Information is processed. Some laws call this person a data subject.
• Contractor means, under California law, a company that a Business makes Personal Information available to for a business purpose under a written contract containing the restrictions in section 6. Where the law treats us as a Contractor rather than a Service Provider, the same commitments apply.
• Controller means the same role as Business under the privacy laws of states other than California, and under European law.
• Covered Service means a service listed in Annex A.
• Customer, you and your mean the business that buys a service from us and gives us Customer Personal Information.
• Customer Personal Information means Personal Information about someone other than you that you give us, or that you instruct us to collect, so that we can perform a Covered Service on your instructions. It does not include the information described in section 1.3.
• Government Body means a government agency or office we deal with for you, including a Secretary of State or state Department of State, a state tax or revenue department, the Internal Revenue Service, the United States Patent and Trademark Office, and the Financial Crimes Enforcement Network. This is the same meaning the term carries in our Terms of Service.
• Personal Information means information that identifies, relates to, describes or could reasonably be linked with a person or a household. Some laws call it personal data. We treat the two as the same thing.
• Privacy Laws means the privacy and data protection laws that apply to processing under this Addendum, including the California Consumer Privacy Act and the comprehensive privacy laws of other states.
• Processor means a company that processes Personal Information on behalf of a Controller. Most state laws outside California use this word for the role California calls Service Provider.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of, or access to, Customer Personal Information held by us or by a Subprocessor.
• Sell means disclosing Personal Information to a Third Party for money or for other valuable consideration.
• Sensitive Personal Information means the narrower group of Personal Information that Privacy Laws single out for extra protection. For Customer Personal Information that means Social Security numbers, ITINs, driver's license and passport details, financial account numbers, log-in credentials, and citizenship or immigration status where a tax form requires it. Our Privacy Policy uses the term in the same sense.
• Service Provider means a company that processes Personal Information on behalf of a Business under a written contract containing the restrictions in section 6. California law uses this word.
• Services means the services we sell across our five service lines: Business Formation, Business Essentials, Compliance & Changes, Tax & Accounting, and Studio, as described in our Terms of Service.
• Share means disclosing Personal Information to a Third Party for cross-context behavioral advertising, whether or not anything comes back in return.
• Subprocessor means a company we engage to process Customer Personal Information as part of performing a Covered Service.
• Tax Return Information has the meaning given in 26 C.F.R. section 301.7216-1, and in plain terms means the information given to us in connection with preparing a tax return, together with the return itself and anything derived from it.
• Terms of Service means our Terms of Service.
• Third Party means anyone who is not you, not us, and not a Service Provider, Contractor or Subprocessor acting under a written contract of the kind this Addendum requires.

4. Our role in each service

4.1 Why the label matters

The role is not a matter of preference. It follows from who decides why the information is processed. Calling ourselves a processor for work where we exercise our own judgment would be inaccurate, and an inaccurate description of our own practices is a problem in itself. So we have set out the honest position below, and we will tell you if we think a particular piece of work does not fit the row it appears in.

4.2 The position service by service

4.3 If we disagree about the role

If either of us thinks a piece of work has been placed in the wrong row, say so in writing to support@blugency.co and we will work it out before the processing continues. What decides the answer is what actually happens to the information, not what either of us calls it.

5. Your instructions and your responsibilities

5.1 What counts as your instructions

Your documented instructions are: this Addendum including Annex A, the order or engagement you placed with us, and anything else you tell us in writing, including by email to support@blugency.co. We process Customer Personal Information only to perform the Covered Services on those instructions, and for the limited purposes in section 6.

5.2 What you are responsible for

You are the Business and the Controller for Customer Personal Information. That means you are responsible for:

• having a lawful reason to collect the information and to give it to us;
• giving the people concerned whatever privacy notice the law requires, before the information reaches us;
• obtaining any consent the law requires, including consent to process Sensitive Personal Information where a state law requires it;
• the accuracy, quality and completeness of what you send us;
• responding to requests those people make about their own information, with our help under section 11; and
• carrying out any data protection assessment your own law requires of you.

5.3 What you promise us

You promise that you have the authority to give us the information and the instructions you give us, and that following your instructions will not put us in breach of a Privacy Law. You also promise not to send us:

• more information than the Covered Service actually needs, and if you do, to tell us so we can delete the excess;
• information about anyone under 16, unless that person is your employee and bookkeeping requires it, in which case tell us so that we handle it correctly;
• health information, biometric information, or information about a person's race, ethnicity, religion, union membership, sexual orientation or immigration status, unless we have agreed in writing beforehand that a Covered Service requires it; or
• Sensitive Personal Information by ordinary email, when we have given you a different route to send it.

5.4 Instructions we cannot follow

If we believe an instruction breaks a Privacy Law, breaks federal tax law, or requires us to do something we are not qualified or licensed to do, we will tell you promptly and we may pause that part of the work until it is resolved. We are not obliged to follow an instruction that would make either of us break the law. If an instruction is unusual, or would take substantially more work than the Covered Service you bought, we will tell you before we do it and we will agree the position with you in writing.

To be concrete, we will not send a message to a list you have no permission to message, we will not remove or hide an unsubscribe or opt-out mechanism, and we will not write, buy, incentivize on condition of a particular sentiment, or suppress a customer review or testimonial for you, because the Federal Trade Commission's rule on consumer reviews and testimonials, 16 C.F.R. Part 465, prohibits that conduct. We will not buy followers, bots or engagement for you either. Asking us to do any of these is not an instruction we have to follow.

5.5 Contact lists, email and text messages

This subsection applies where a Covered Service involves us sending messages to your contacts, or handling a list, an audience file or an account that you control.

The list is yours and the messages are yours. You are responsible for having the consent and the lawful basis that the law requires for each person on it, including prior express written consent where a text message or an automated call needs one, and for the accuracy of the list you give us. You confirm that people on the list have not asked you to stop contacting them.

We will build the messages we send for you to meet the CAN-SPAM Act, which means accurate sender and header information, a subject line that is not deceptive, identification of the message as an advertisement where it is one, your valid physical postal address, and a working opt-out. You supply the postal address to use. Opt-outs must be honored no later than 10 business days after they are made, and we will process the ones that reach the tools we operate for you. If you keep a separate list or send from a separate tool, honoring the opt-out there is yours to do. Telling us "another company sent it" is not a defense either of us can rely on.

If you instruct us to upload a list you own into your own advertising account, email tool or social media account, we do that as your Service Provider on your instruction. What happens to the information after it arrives inside a platform you control is governed by your agreement with that platform, and you remain responsible for the notices, consents and opt-outs that the transfer and the advertising require.

6. What we commit to as your service provider

This section contains the commitments that California law requires a Service Provider or Contractor to make in writing. They apply to all Customer Personal Information, in every state, whether or not California law applies to you.

6.1 The limits on what we may do

• Purpose limitation. We process Customer Personal Information only to perform the Covered Services set out in Annex A and for the specific business purposes described there. We do not use it for any other commercial purpose.
• Only what the work needs. We ask for and keep only what is reasonably necessary and proportionate to perform the Covered Service you asked for. If you send us more than that, section 5.3 applies and we delete the excess.
• No selling and no sharing. We do not Sell Customer Personal Information and we do not Share it. We do not put it through any advertising or ad targeting technology of our own, and we do not disclose it to anyone for advertising purposes.
• Not a sale by you either. Because we act as your Service Provider or Processor under this Addendum, giving Customer Personal Information to us is not itself a Sale or a Share by you.
• Nothing outside our relationship with you. We do not retain, use or disclose Customer Personal Information outside the direct business relationship between you and us, or for any purpose other than the purposes in Annex A, except where a Privacy Law permits it.
• No combining. We do not combine Customer Personal Information with Personal Information we receive from anyone else, or that we collect from our own dealings with a Consumer. The only exception is where the California regulations specifically allow combining, which in practice means detecting security incidents or protecting against fraudulent or illegal activity.
• Not for our own purposes. We do not use Customer Personal Information to build, improve or market our own products, to train any model, or to develop any dataset, unless you instruct us to in writing for your own benefit.
• No deidentified data products. We do not create deidentified or aggregated datasets from Customer Personal Information for our own use. If you ask us to deidentify information for you, we will keep it deidentified, we will not try to reidentify it, and we will require anyone we pass it to on your instruction to do the same.
• No use for our marketing. We do not add the people in your data to any list of ours, and we do not contact them about our services.
• The same level of protection. We comply with the obligations that apply to us as a Service Provider, Contractor or Processor under Privacy Laws, and we give Customer Personal Information the same level of privacy protection that those laws require of you.
• Only the tools on the list. Customer Personal Information goes into the providers named on our Subprocessors page and nowhere else. A tool that is not named there is a tool your information should not be going into, and section 10 sets out what we put in place before any provider handles it.
• AI tools. One AI provider is named on our Subprocessors page: Anthropic PBC, whose model powers Blu, the assistant on our website; it receives what a visitor writes in that chat and nothing else. We do not enter Customer Personal Information into any AI tool or into any other tool that is not named on our Subprocessors page. That applies without exception to tax return information, identity documents, Social Security numbers and ITINs. This bullet exists because it is the question a security review asks first, and because the commitments above about not training a model and not using Customer Personal Information for our own purposes are only worth what the tools behind them allow. There is no undisclosed tool behind them, so there is no third party's terms cutting across what we have promised you here.

6.2 Sensitive Personal Information

Where Customer Personal Information includes Sensitive Personal Information, we use and disclose it only to perform the Covered Services you asked for, to prevent and detect fraud, to keep our systems secure, and to comply with the law. We do not use it to infer characteristics about anyone, and we do not put it through any marketing or data enrichment tool.

6.3 Our certification

We certify that we understand the restrictions in this section 6 and that we will comply with them. This certification is given for the purposes of the California Consumer Privacy Act and the regulations made under it.

6.4 If we can no longer meet these commitments

If we determine that we can no longer meet our obligations under a Privacy Law in respect of Customer Personal Information, we will tell you in writing without undue delay. You may then instruct us to stop the processing, and we will follow that instruction.

6.5 Your right to check and to stop unauthorized use

You may take reasonable and appropriate steps to satisfy yourself that we use Customer Personal Information in a way that is consistent with your obligations under Privacy Laws, using the methods in section 14. Those verification steps are at your cost, as section 14 says.

If you notify us that we, or a Subprocessor, are using Customer Personal Information in an unauthorized way, you may take reasonable and appropriate steps to stop and remediate that use. Stopping and fixing unauthorized use is our responsibility, and we bear our own cost of doing it. That is separate from the cost of a review under section 14, and nothing in section 14 lets us charge you for correcting our own error.

7. Terms required by other state privacy laws

Most state privacy laws outside California require a processor contract to contain a specific set of terms. Those terms are set out below, and they apply in addition to section 6.

• Everyone who processes Customer Personal Information for us is bound by a duty of confidentiality, as described in section 8.
• At your direction, we delete or return Customer Personal Information as described in section 13.
• We make available to you the information reasonably necessary to demonstrate that we are meeting our obligations under this Addendum, as described in section 14.
• We allow and cooperate with reasonable assessments by you or by an assessor you appoint, on the terms in section 14, and we may instead provide a report from an independent assessor where one is available.
• We engage Subprocessors only under a written contract that requires them to meet the obligations in this Addendum in respect of Customer Personal Information, as described in section 10.
• We assist you, by appropriate technical and organizational measures and taking into account the nature of the processing, in meeting your own obligations to respond to Consumer requests, to secure the processing, to notify people of a breach, and to carry out any assessment your law requires.

8. Confidentiality and our people

Customer Personal Information is your Confidential Information under the Terms of Service, and the confidentiality obligations in that document apply to it in full.

Access is limited to the people who need it to perform a Covered Service for you. Everyone with access, whether an employee or a contractor, is bound by a written confidentiality obligation that continues after they stop working with us. We tell our people what they may and may not do with customer information, and access is removed when a person leaves or moves to work that no longer requires it.

We do not disclose Customer Personal Information to a Third Party except where you instruct us to, where a Covered Service requires it and Annex A describes it, or where the law requires it. If we receive a subpoena, a court order or another legal demand for Customer Personal Information, we will tell you before we respond, unless the law prohibits us from telling you, and we will disclose only what the demand actually requires.

9. Security

We maintain administrative and technical safeguards, together with the physical safeguards that apply to the devices our team works on, designed to protect Customer Personal Information against loss, misuse and unauthorized access. Annex B describes those measures. We have written Annex B at the level we can actually evidence rather than at the level that reads best.

Because we prepare and file tax returns, federal law treats us as a financial institution under the Gramm-Leach-Bliley Act, which brings us within the FTC Safeguards Rule, 16 C.F.R. Part 314. That Rule sets out what a company in our position has to have in place, including a written information security program with one named individual responsible for it. Annex B lists the measures we actually apply, which is the version of this that is worth anything to you.

We do not operate data centers, servers or physical infrastructure of our own. The systems underneath our work belong to the providers named on our Subprocessors page, and they run their own security programs. We do not hold a SOC 2 report and we are not certified to ISO 27001. If either of those changes we will say so here. No system connected to the internet is completely secure, and nothing in this Addendum is a guarantee that Customer Personal Information can never be reached by someone who should not reach it.

10. Subprocessors

10.1 Your authorization

You authorize us to engage Subprocessors to help us perform the Covered Services. The current list, including what each provider does for us and where it operates, is on our Subprocessors page, which forms part of this Addendum and is incorporated into it by reference.

10.2 The terms we put in place

Before a Subprocessor processes Customer Personal Information, we put a written contract in place that requires it to meet obligations no less protective than this Addendum, to the extent those obligations are relevant to what it does for us. In practice that means we accept the provider's standard data processing terms, and we keep a copy of what we accepted for every provider on the Subprocessors page, so that we can show you rather than tell you. Where a Subprocessor handles information covered by federal financial privacy law or federal tax law, we also pass on the restrictions those laws require, including the written notice of the penalties under sections 7216 and 6713 of the Internal Revenue Code where that notice is required.

10.3 Changes and your right to object

Before a new Subprocessor starts processing Customer Personal Information, we update the Subprocessors page, and we email customers who have asked to be told about changes. We aim to give at least 30 days of notice, and we will always give as much as we practically can.

If you object to a new Subprocessor on reasonable data protection grounds, tell us at support@blugency.co within 15 business days of the notice, with your reasons. We will try to offer you a way of receiving the Covered Service that does not involve that provider. If we cannot, you may stop the affected Covered Service by written notice, and the Purchasing Terms decide what happens to amounts you have already paid.

If a provider fails or has to be replaced urgently for security or continuity reasons, we may make the change first and tell you immediately afterwards. Your objection right in this section still applies.

The Subprocessors page is published at /subprocessors and it is the live list rather than a sample. To be told when it changes, email support@blugency.co with "Subprocessor notifications" in the subject line and we will add you to the notification list for it. We keep that list ourselves and use it for nothing else.

10.4 Our responsibility

We remain responsible to you for a Subprocessor's acts and omissions in relation to Customer Personal Information as if they were our own, subject to section 18.

11. Helping you with privacy rights requests

If a Consumer contacts us directly about Customer Personal Information, we will not respond to the substance of the request. We will tell them to contact you and we will pass the request on to you promptly, unless the law requires us to respond ourselves. We will tell you what we did.

We will help you respond to a request within a time that lets you meet your own deadline. Under most state privacy laws that deadline is 45 days from the day you received the request, with one extension available, but the deadline that binds you is yours to establish, not ours. Tell us the date you are working to and we will work to it. Our help includes finding, correcting, exporting or deleting Customer Personal Information in our possession, and telling you what we hold and where it came from. Where you instruct us to delete information because a Consumer asked you to, we will pass the instruction on to any Subprocessor that holds it.

We will also give you the information you reasonably need to carry out a data protection assessment or to answer a regulator, to the extent it concerns the processing we do for you. Reasonable help is included in what you already pay. If your requests go far beyond that, in volume or in complexity, we will tell you before we do the work and agree the cost with you first.

12. Security incidents

If a Security Incident affects Customer Personal Information, we will tell you without undue delay and no later than 72 hours after we become aware of it. We will not wait until we understand everything before we tell you, and we will not delay looking into a report in order to delay the clock.

Our notice will describe what we know at the time, including what happened, the categories and approximate number of people and records affected as far as we can tell, the likely consequences, what we have done to contain it, and what we recommend you do. We will keep you updated as we learn more, and we will give you the information you reasonably need to meet your own notification duties.

You are responsible for deciding whether to notify the people affected, your regulators or anyone else, because you are the Business for that information. We will not notify them on our own initiative unless the law requires us to, and if the law does require it we will tell you first.

Unsuccessful attempts that do not compromise information, such as blocked log-in attempts, port scans and filtered network traffic, are not Security Incidents and we do not report them individually. A notice under this section is not an admission of fault or liability by either of us.

Deciding that a Security Incident has occurred is Blugency's decision, and it is what starts the 72 hours. We make that decision rather than leaving it to a provider or to you, we make it as soon as the facts allow, and we would rather call something an incident early and stand it down than sit on it while a clock we control has not started. The 72 hours is an outside limit and not a target, and we can meet it at the size we are.

Our own obligations under federal and state law continue to apply and are separate from this section. They include reporting to the Federal Trade Commission no later than 30 days after we discover unauthorized acquisition of unencrypted customer information affecting 500 or more consumers. New Mexico law requires notice to affected residents, and to the New Mexico Attorney General where more than 1,000 of them are notified, no later than 45 calendar days after discovery, and it treats information regulated by federal financial privacy law differently from other information. Every other state sets its own deadlines. Where several apply at once, we work to the one that gets notice to the people affected soonest, and we do not use a technical exemption in one statute as a reason to stay quiet under another.

13. Deletion and return of Customer Personal Information

When a Covered Service ends, or at any time on your written request, we will return Customer Personal Information to you in a commonly used electronic format, delete it, or both, according to your instruction. If you do not give us an instruction within a reasonable period after the service ends, we will delete it.

There are two limits on that, and we would rather be honest about them than promise a clean deletion we cannot perform.

The first is legal retention. Tax and accounting records must be kept for periods set by federal and state law, and those obligations apply to us as well as to you. Where we are required to keep a copy, we keep only what the law requires, we stop actively processing it, we continue to protect it under this Addendum, and we delete it when the required period ends.

The second is backups. Copies can survive for a short time in routine system backups after deletion. Those are overwritten on their normal cycle and are not used for anything else in the meantime.

We will confirm deletion in writing if you ask us to.

We will not hold Customer Personal Information back as leverage. If there is a dispute between us about money, that dispute is dealt with under the Terms of Service and the Purchasing Terms, and it is not a reason for us to refuse to return or delete Customer Personal Information you have asked for.

The period we are required to keep records for is 7 years after the service ends, which is the period ordinary tax record practice works to and the period our Privacy Policy states for tax records, workpapers and client files. Where we hold a copy for that reason, the second paragraph above applies to it: we keep only what the law requires, we stop actively processing it, and we protect it under this Addendum until the period ends.

When you ask for your records back, you get them as PDF for statements and tax returns, and as CSV for ledgers. Those are the formats a business customer can actually load into another system, which is the point of the promise.

14. Audits and evidence of compliance

We know that your own compliance obligations mean you have to be able to check on us. Here is how that works, and it is deliberately proportionate to the size of the company you are dealing with.

Once in any 12-month period, you may send us a written questionnaire about how we handle Customer Personal Information, and we will answer it within a reasonable period. We will also give you any current third-party security documentation we hold and have the right to share, including documentation published by the providers on our Subprocessors page.

If a Security Incident has affected your Customer Personal Information, or a regulator formally requires an assessment, you may ask for one more review in the same period.

The following conditions apply to any review under this section. It is at your cost. It happens on reasonable written notice and during normal business hours. Everything you receive is Confidential Information under the Terms of Service. It must not disrupt our work for other customers, and it must not give you access to another customer's information, to our internal security program in a form that would itself create a risk, or to anything we are contractually prohibited from disclosing. We do not operate premises or systems of our own that can be inspected in person, and we cannot authorize you to scan, probe or test systems that belong to our providers, because their terms do not permit it.

15. Where processing happens

We are a United States company and we operate from the United States. Customer Personal Information is processed in the United States, and every provider named on our Subprocessors page processes and stores it there. Where a provider offers a choice of region, we have chosen a United States one.

That page records what each provider does for us and where its processing takes place, and it is the source we keep current. If a change would move any part of that processing outside the United States, it is a change to this Addendum's protections and section 19 applies to it, which means you hear about it in advance rather than afterwards.

Where a Covered Service involves tax filings and any person working on your file is located outside the United States, federal tax law requires a separate written consent before Tax Return Information is disclosed to them. Section 17 explains, and we will not make that disclosure without the consent that law requires.

16. If European or United Kingdom law applies to you

We are a United States company with no establishment, office, branch or appointed representative in the United Kingdom or the European Union. We do not hold ourselves out as having one.

If you are established in the United Kingdom, the European Economic Area or Switzerland, or the Customer Personal Information you give us concerns people located there, and your own compliance position requires European style processor terms, email us at support@blugency.co before you send us the information. We will agree a written annex with you covering the matters Article 28 of the GDPR requires, and we will agree a transfer mechanism with you in writing before processing begins.

We are not going to assert a transfer mechanism we have not adopted. To be completely plain about it: Blugency has not self certified to the EU-US Data Privacy Framework, and it has not signed the Standard Contractual Clauses with any customer. We do not rely on either as a standing position and you should not assume that we do. If you need one, we agree it with you first, in writing, and then it applies.

17. Tax and financial privacy rules that apply on top of this Addendum

Two federal regimes apply to parts of our work regardless of what this Addendum says, and neither can be widened by agreement between us.

Tax return information. Under 26 U.S.C. section 7216 and 26 C.F.R. section 301.7216-3, we may not use or disclose Tax Return Information for any purpose other than preparing and filing the return, except where the law specifically permits it or where a separate written consent has been signed. That consent is a standalone form with a format set by the IRS. It is never this Addendum, never our Terms of Service, and never a checkbox. Signing one is always voluntary, and declining does not change the price, the availability or the speed of tax preparation. Nothing in this Addendum authorizes a use or disclosure that section 7216 prohibits. Where this Addendum and federal tax law differ, the stricter rule applies.

Financial privacy. Because we prepare and file tax returns, we are a financial institution under the Gramm-Leach-Bliley Act. Customers who buy tax or bookkeeping services receive our GLBA Privacy Notice, which we deliver to them directly and which describes what we do with the information those services involve. That notice and this Addendum work together, and where they cover the same information, the stricter protection applies.

18. Liability

Each party's liability under this Addendum is subject to the exclusions and to the cap on liability in the Terms of Service. This Addendum does not create a separate head of liability, and it is not uncapped. Claims arising out of the processing described here count towards the same aggregate cap as every other claim.

Nothing in this section limits or excludes either party's liability for fraud, for fraudulent misrepresentation, for willful misconduct, for gross negligence, or for anything else that the law does not allow to be limited. The state-specific terms in the Terms of Service, including the terms that apply to North Carolina consumers, apply to this Addendum too, and where a state's law does not permit a limitation or exclusion we rely on here, that limitation does not apply to you. The indemnities in the Terms of Service are unchanged by this document.

19. Term and changes

This Addendum starts on the earlier of the day we first process Customer Personal Information for you and the day we countersign a copy for you under section 20. It continues for as long as we hold Customer Personal Information, and the obligations in sections 6, 8, 9, 12, 13 and 18, together with Annex B, survive the end of your agreement with us until the information has been deleted or returned.

We may update this Addendum where the law changes, where our providers change, or where we can make it clearer. When we do, we publish it with a new version number and effective date. If a change materially reduces the protection you get, we will tell you by email at least 30 days before it takes effect, and if you do not accept it you may stop the affected Covered Service, with the Purchasing Terms deciding what happens to amounts already paid. Where we have countersigned a copy for you, a material change needs the same notice, and either of us may ask for an updated countersigned copy.

Every period this Addendum commits to is one we can meet at the size we are: at least 30 days notice before a new Subprocessor starts work, 15 business days for you to object, one questionnaire in any 12-month period answered within a reasonable time, and 30 days notice before a change that materially reduces protection. They are commitments rather than aspirations, and if we ever cannot meet one we will tell you rather than let the date pass.

Governing law, venue and dispute resolution for this Addendum are the same as for the Terms of Service, which includes an arbitration agreement and a class action waiver.

20. How you accept this Addendum

You do not have to do anything for this Addendum to protect you. It applies automatically under section 2.2. The routes below exist for customers who need a signed document in their compliance file.

Accepting it online. If we present this Addendum to you with a button or a checkbox that says you accept it, clicking it accepts it for the customer named in that flow.

Getting a countersigned copy. Email support@blugency.co with the subject line "DPA request" and tell us your full legal entity name, your entity type and state, the services this covers, and the name, title and email address of the person signing for you. An authorized signatory of Blugency countersigns it, and we send back a copy signed by both of us. We keep the signed copy on file so that we can produce it later if you lose yours or your own compliance review asks for it. It takes effect on the date of our signature or on the day we started processing Customer Personal Information for you, whichever is earlier.

Signatures. An electronic signature, a typed name or a click of an acceptance button has the same effect as a handwritten signature. We do not require a wet ink signature, a notarized document or a power of attorney.

Your own paperwork. If your compliance team needs us to sign your data processing agreement rather than ours, send it to support@blugency.co. We will read it, and we will either sign it, propose changes, or explain why we cannot sign it. We will not sign a document that describes security controls we do not have or a role we do not perform, and if that is the sticking point we will tell you exactly which clause it is.

21. Annex A: description of the processing

This annex describes the processing and is part of your documented instructions.

21.1 The Covered Services

• Bookkeeping, where the records you give us contain Personal Information about your employees, contractors or customers.
• Website Design, where we operate a form or a system on your website that collects information from your visitors and we can reach that information.
• SEO & GEO, Paid Ads and Social Media, where you give us a contact list or an audience file, or access to your email tool or your social media account.
• Any other work where you give us Personal Information about other people and instruct us to process it for you, other than the services that section 4.2 lists as ours to answer for and other than Tax Return Information, which section 17 governs.

21.2 Categories of Consumers

• Your employees, current and former.
• Your contractors, freelancers and other people you pay for work.
• Your officers, owners and directors, where you give us their details for bookkeeping.
• Your customers, subscribers, leads and business contacts.
• People who submit a form on a website we built or maintain for you.

21.3 Categories of Personal Information

21.4 Sensitive Personal Information

Where the categories above include Sensitive Personal Information, we use and disclose it only to perform the Covered Services, to prevent and detect fraud, to keep our systems secure, and to comply with the law. We do not use it to infer characteristics about anyone. This is the limit described in section 6.2 and we hold ourselves to it.

21.5 Purposes of the processing

• Keeping your books, reconciling accounts and producing financial statements.
• Sending a campaign you asked us to send, and managing an account you asked us to manage.
• Operating a form or a system on a website we built for you.
• Answering your questions about the work, correcting errors, and keeping the records the law requires.

21.6 Nature of the processing

Collecting, recording, organizing, storing, using, transmitting to a Government Body or a Subprocessor where the Covered Service requires it, correcting, exporting and deleting.

21.7 Frequency and duration

Processing is continuous for as long as the Covered Service is running, and then for the period described in section 13. Bookkeeping follows the schedule you agree with us. Marketing processing happens as and when you instruct it.

21.8 Subprocessors

The current list is on our Subprocessors page, which is part of this Addendum under section 10.1.

22. Annex B: our security measures

These are the measures we apply to Customer Personal Information. We have described them at the level we can evidence, and we have not listed a control we do not have. Where a measure depends on a provider rather than on us, we say so.

22.1 What we are

We do not operate data centers, servers or physical infrastructure of our own, so we make no claims about buildings, cameras, badges or environmental controls. Our work is delivered online, and the physical safeguards we can speak for are the ones that apply to the devices our team works on, described in section 22.2. The systems we work in are operated by established hosted providers, listed on our Subprocessors page, each of which runs its own security program.

22.2 The measures we apply

• Access control. Access to Customer Personal Information is limited to the people who need it for a Covered Service. Accounts are individual rather than shared. Access is reviewed and is removed when a person leaves or changes role.
• Multi-factor authentication. We require multi-factor authentication on accounts that can reach Customer Personal Information. The FTC Safeguards Rule requires this of us, and we apply it as a rule rather than as a preference.
• Encryption in transit. Our website and the provider services we work in are reached over encrypted connections.
• Encryption at rest. Customer Personal Information is stored in hosted systems that encrypt data at rest as a platform default.
• Devices. Devices used by our team to reach Customer Personal Information use full disk encryption, a screen lock and supported, updated operating system software.
• A secure route for sensitive documents. Where a Covered Service needs an identity document or a tax identifier, we give you a route built for the purpose. We do not ask you to send those by ordinary email.
• Confidentiality. Everyone with access is bound by a written confidentiality obligation that survives the end of their engagement.
• Training. Our people receive security awareness training covering how to handle customer information, how to recognize phishing, and what to do if something goes wrong.
• Provider selection and oversight. We choose established providers, we put written data protection terms in place with them, and we review that list when something changes.
• Incident response. We maintain a written process for handling a suspected or confirmed Security Incident, including the notifications in section 12, and section 12 states who decides that an incident has occurred and starts the clock.
• Disposal. We dispose of Customer Personal Information securely when it is no longer needed for the purpose it was collected for and the law does not require us to keep it, consistent with the disposal requirement in the Safeguards Rule.
• Logging. We rely on the activity logs kept by the hosted systems we work in, and on the access records those systems provide.

Section 9 explains where the Safeguards Rule sits in relation to all of this.

22.3 What we do not claim

We do not hold a SOC 2 report and we are not certified to ISO 27001. We do not describe our security as bank level, military grade, unbreakable or fully compliant with any standard. We do not claim penetration testing, continuous monitoring or any other control that is not listed in section 22.2. If a claim about our security is not written in this annex, we have not made it, and you should not rely on it.

22.4 Changes to these measures

Our measures may change as our tools and providers change. We will not make a change that materially reduces the overall protection given to Customer Personal Information, and section 19 tells you how we handle changes to this document.

Contact

Questions about this Addendum, requests for a countersigned copy, objections to a Subprocessor, privacy rights requests, and notices under any section of this document:

Email: support@blugency.co

Post: Blugency LLC, 1209 Mountain Road Pl NE, Ste N, Albuquerque, NM 87110, United States