Data Processing Addendum

This addendum forms part of the Terms of Service between you (the customer) and Commercer LLC, 33 N Gould St, Sheridan, WY 82801, USA. It applies whenever we process personal data on your behalf: your customer lists, your funnel visitor data, your message recipients, your order and checkout data, and anything else you bring into the workspace.

You are the controller. We are the processor. Where you are yourself a processor for someone else, we are a subprocessor and the same terms apply down the chain.

• Subject matter: providing the Oddyssey marketing experimentation workspace.
• Duration: for as long as your account is active, plus the retention periods in the Privacy Policy.
• Categories of data subjects: your customers, prospects, funnel visitors and message recipients.
• Categories of personal data: identifiers such as name, email, phone number and device or cookie identifiers; order and transaction metadata; engagement and campaign response data; any other data you choose to upload.
• We do not want special category data. Do not upload health, biometric, political, religious or similar data to the workspace.

• We process personal data only on your documented instructions, which include your configuration of the product and your use of its features.
• We will tell you if an instruction appears to breach applicable data protection law, and we may pause that processing.
• Everyone with access is bound by confidentiality.
• We will not sell personal data, use it for our own marketing, or use it to train AI models.
• We assist you, taking account of what we can see, with data subject requests, impact assessments and consultations with regulators.

We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, per-workspace isolation, least-privilege access, credential vaulting for connected services, audit logging of privileged actions and regular dependency scanning. The security overview page describes these in plain language.

You give general authorization for us to use the subprocessors listed on our subprocessors page. We impose equivalent data protection obligations on each of them and remain liable for their performance. We will give at least 30 days' notice before adding or replacing one, and you may object on reasonable data protection grounds; if we cannot resolve the objection you may terminate the affected service and receive a pro-rata refund.

For transfers out of the EEA, the UK or Switzerland, the European Commission's Standard Contractual Clauses apply, with Module Two for controller-to-processor and Module Three for processor-to-processor transfers, supplemented by the UK International Data Transfer Addendum where relevant. They are incorporated here by reference, with you as data exporter and us as data importer.

We will notify you without undue delay, and in any case within 72 hours of becoming aware of a personal data breach affecting your data. The notice will describe what happened, the data and people affected as far as we can tell, the likely consequences and the steps we are taking.

You can delete data inside the workspace at any time. On termination we delete or return your personal data within 90 days, except where law requires us to keep it. Backups age out within 35 days.

On reasonable written request, and no more than once a year unless a regulator requires otherwise, we will provide the information needed to demonstrate compliance with this addendum and cooperate with an audit carried out by you or an independent auditor bound by confidentiality, at your cost and without disrupting the service.

These terms apply automatically to every customer; no signature is required. If your procurement process needs a countersigned copy, email support@tryoddyssey.com and we will arrange it.