Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Terms of Service or other written or electronic agreement (the "Agreement") between SJW Group, Inc., a New York corporation, d/b/a More Good Reviews ("Processor", "we", "us"), with a principal place of business at 525 E 14th St 7H, New York, NY 10009, and ____________________________________ ("Controller", "you"), with a principal place of business at ____________________________________________________________ (together, the "Parties").

This DPA governs the Processing of Personal Data by Processor on behalf of Controller in connection with the services provided through the More Good Reviews platform (the "Services"). To the extent of any conflict between this DPA and the Agreement, this DPA controls with respect to the Processing of Personal Data.

1. Definitions

Capitalized terms used but not defined in this DPA have the meanings given in the Agreement. For purposes of this DPA:

"Applicable Data Protection Law" means all laws and regulations applicable to the Processing of Personal Data under this DPA, including, as applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act ("CCPA") as amended by the California Privacy Rights Act, and other comparable US state privacy laws.
"Controller" means the entity that determines the purposes and means of the Processing of Personal Data (also referred to as a "business" under the CCPA).
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates (also referred to as a "consumer" under the CCPA).
"Personal Data" means any information relating to a Data Subject that is Processed by Processor on behalf of Controller under the Agreement. Personal Data does not include data that Processor handles in its capacity as an independent controller (for example, account registration data of Controller's own personnel).
"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data Processed under this DPA.
"Process" / "Processing" means any operation performed on Personal Data, whether or not by automated means, such as collection, storage, use, disclosure, transmission, erasure, or destruction.
"Processor" means the entity that Processes Personal Data on behalf of the Controller (also referred to as a "service provider" under the CCPA).
"Sub-processor" means any third party engaged by Processor to Process Personal Data on Controller's behalf.
"Standard Contractual Clauses" or "SCCs" means the standard contractual clauses approved by the European Commission for the transfer of Personal Data to processors established in third countries, as updated from time to time.

2. Scope and Purpose of Processing

2.1 Roles of the Parties

With respect to Personal Data Processed under this DPA, Controller is the Controller and Processor is the Processor.

2.2 Subject Matter and Purpose

Processor will Process Personal Data solely to provide the Services described in the Agreement, including:

Sending review request messages, reminders, and related communications by email or SMS to Data Subjects on Controller's behalf;
Hosting and displaying reviews, ratings, and feedback collected from Data Subjects;
Producing analytics, reporting, and AI-assisted content (such as review suggestions, highlights, replies, and tags) for Controller's use; and
Performing such other Processing as Controller may instruct in writing or through the configuration of the Services.

2.3 Categories of Data Subjects

Data Subjects whose Personal Data is Processed include Controller's end customers, prospects, contacts, and other individuals whose details Controller imports, enters, or otherwise makes available through the Services.

2.4 Categories of Personal Data

Personal Data Processed under this DPA typically includes:

Identifiers: first name, last name, email address, telephone number;
Customer relationship data: relationship to Controller's business, transaction or visit dates, location, source, language;
Content data: review text, ratings, feedback, replies, and any data Controller imports or that Data Subjects submit through review pages or messages;
Technical data: IP address and basic device or browser metadata associated with review submissions or message engagement events.

Processor does not require, request, or knowingly Process special categories of Personal Data (Article 9 GDPR) or children's data under this DPA. Controller is responsible for ensuring it does not submit such data to the Services unless agreed in writing.

2.5 Duration

Processing will continue for the term of the Agreement and any additional period during which Processor is required to retain Personal Data by law or to fulfill its obligations under Section 9.

2.6 Controller Instructions

Processor will Process Personal Data only on documented instructions from Controller, including those reflected in the Agreement, this DPA, and Controller's configuration and use of the Services. Processor will notify Controller if, in its opinion, an instruction infringes Applicable Data Protection Law, unless prohibited from doing so by law.

3. Controller Obligations

Controller represents, warrants, and covenants that:

Lawful basis. Controller has established and will maintain a valid legal basis under Applicable Data Protection Law (including, where required, Data Subject consent) to collect Personal Data and to instruct Processor to Process it for the purposes described in Section 2.
Notice. Controller has provided all required notices and disclosures to Data Subjects regarding the Processing of their Personal Data by Processor and its Sub-processors.
Permitted use. Controller's instructions to Processor will comply with Applicable Data Protection Law, the Agreement, and applicable anti-spam, telecommunications, and consumer protection laws (including, where applicable, CAN-SPAM, TCPA, and CASL).
Accuracy. Controller is responsible for the accuracy, quality, and legality of Personal Data submitted to the Services and for the means by which Controller acquired that Personal Data.
Configuration. Controller is responsible for configuring the Services (including sending limits, opt-out handling, and security settings exposed to it) to meet Controller's compliance obligations.
Data subject requests. Controller will respond to Data Subjects who exercise rights under Applicable Data Protection Law in the first instance, subject to Processor's assistance under Section 7. If Controller uses agency or white-label features, Controller remains responsible for End Customer Data processed through Client or Team Member activity in Controller's account, as further described in Section 9 of the Agreement.

4. Processor Obligations

Processor will:

Purpose limitation. Process Personal Data only for the purposes described in Section 2 and only in accordance with Controller's documented instructions.
No sale or sharing. Not sell, share, rent, or release Personal Data outside the direct business relationship with Controller. Processor does not "sell" or "share" Personal Data within the meaning of the CCPA and will not retain, use, or disclose Personal Data for any purpose other than performing the Services or as otherwise permitted by Applicable Data Protection Law.
Confidentiality. Ensure that personnel authorized to Process Personal Data are bound by appropriate confidentiality obligations.
Security. Implement and maintain the technical and organizational measures described in Section 6.
Sub-processors. Engage Sub-processors only in accordance with Section 5.
Cooperation. Make available to Controller, on reasonable request, information necessary to demonstrate compliance with this DPA, subject to Section 10.
International transfers. Where Personal Data is transferred outside the jurisdiction of Controller, rely on a valid transfer mechanism under Applicable Data Protection Law, including, as applicable, the SCCs, the UK International Data Transfer Addendum, or successor mechanisms. The Parties agree the SCCs are incorporated by reference where required, with Controller acting as data exporter and Processor as data importer.

5. Sub-processors

5.1 General Authorization

Controller provides Processor with a general authorization to engage Sub-processors to Process Personal Data, subject to the requirements of this Section 5.

5.2 Current Sub-processors

As of the Effective Date, Processor uses the sub-processors listed on our Sub-processors page to Process Personal Data on Controller's behalf. That page is incorporated into and forms part of this DPA. Processor will keep that list current and notify Controller of changes in accordance with Section 5.4.

5.2.1 Controller-Initiated Integrations

Certain features of the Services allow Controller to connect third-party services that Controller independently controls — including, without limitation, HubSpot, Slack, Discord, ClickSend, SimpleTexting, TextLink, and Controller's own SMTP or Twilio account. Where Controller initiates and authorizes such an integration, the third party acts as a separate controller or processor under Controller's relationship with that third party and is not a Sub-processor of Processor under this DPA.

5.3 Sub-processor Obligations

Processor will enter into a written agreement with each Sub-processor imposing data protection obligations substantially equivalent to those in this DPA, including obligations of confidentiality, security, and limited Processing. Processor remains responsible for each Sub-processor's performance to the same extent as if Processor performed the Services itself.

5.4 Notice and Objection

Processor will update its Sub-processors page and provide Controller with at least thirty (30) days' notice of any intended addition or replacement of a Sub-processor by email to Controller's primary account contact and by in-product notice. Controller may object to a new Sub-processor on reasonable data protection grounds by giving written notice to legal@moregoodreviews.com within fifteen (15) days of receiving notice. The Parties will work in good faith to resolve the objection. If no resolution is reached, Controller may terminate the affected Services without penalty by providing written notice; Processor will refund any prepaid, unused fees for the terminated portion.

6. Security Measures

Processor will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against a Personal Data Breach, including:

Encryption. Encryption of Personal Data in transit using TLS 1.2 or higher and at rest using industry-standard algorithms.
Access control. Role-based access controls, least-privilege access, unique user IDs, multi-factor authentication for production access, and timely revocation upon personnel change.
Network and host security. Firewalls, security groups, isolated production environments, automated patching, and monitoring of production infrastructure.
Application security. Secure development practices, code review, dependency scanning, and protection against common web vulnerabilities.
Data segregation. Logical segregation of Personal Data on a per-Controller basis.
Backups and resiliency. Encrypted backups, restoration testing, and reasonable measures to ensure availability and resilience of the Services.
Logging and monitoring. Audit logging of access to production systems and monitoring for anomalous activity.
Personnel. Confidentiality obligations and security awareness training for personnel with access to Personal Data.
Vendor management. Due diligence and contractual controls for Sub-processors handling Personal Data.

Processor may update its security measures from time to time provided that the updated measures do not materially reduce the overall level of protection.

7. Data Subject Rights Assistance

Taking into account the nature of the Processing, Processor will assist Controller, through appropriate technical and organizational measures, in fulfilling Controller's obligation to respond to requests by Data Subjects to exercise their rights under Applicable Data Protection Law, including rights of access, rectification, erasure, restriction, portability, and objection.

Routing. If Processor receives a request directly from a Data Subject relating to Personal Data Processed on Controller's behalf, Processor will, without undue delay, forward the request to Controller and not respond directly except to confirm receipt or to direct the Data Subject to Controller.
Self-service tools. Processor will make available reasonable self-service functionality within the Services to enable Controller to access, export, correct, or delete Personal Data.
Additional assistance. Where the self-service tools are not sufficient, Processor will provide reasonable additional assistance at Controller's request. Processor may charge a reasonable fee for assistance that is excessive or repetitive.

8. Personal Data Breach Notification

Notification window. Processor will notify Controller without undue delay, and in any event within seventy-two (72) hours after becoming aware of a Personal Data Breach affecting Controller's Personal Data.
Contents of notice. To the extent known at the time of notice, the notification will include:
- the nature of the Personal Data Breach, including the categories and approximate number of Data Subjects and records affected;
- the likely consequences of the Personal Data Breach;
- the measures Processor has taken or proposes to take to address the Personal Data Breach and mitigate its possible adverse effects; and
- a designated point of contact for further information.
Updates. Where it is not possible to provide all information at the same time, Processor may provide the information in phases without undue further delay.
Cooperation. Processor will reasonably cooperate with Controller in Controller's investigation, mitigation, and notification activities related to the Personal Data Breach.
No admission. Notice of a Personal Data Breach is not, and will not be construed as, an admission of fault or liability by Processor.

Notices under this Section will be sent to the security contact designated by Controller in its account or, if none is designated, to the primary account contact.

9. Deletion or Return of Personal Data on Termination

Election. Upon termination or expiration of the Agreement, Controller may elect, within thirty (30) days, to have Processor return or delete Personal Data Processed on its behalf.
Default. If Controller does not make an election within thirty (30) days, Processor will delete Personal Data within ninety (90) days of termination, except as set out in Section 9.3.
Retention. Processor may retain Personal Data to the extent required by Applicable Data Protection Law or other applicable law, in which case Processor will continue to protect such Personal Data in accordance with this DPA and limit further Processing to the purposes that require retention.
Backups. Personal Data residing in routine backups will be deleted in accordance with Processor's standard backup rotation schedule and will not be restored to active systems other than for disaster recovery purposes.
Certification. Processor will provide written certification of deletion upon Controller's reasonable request.

10. Audit Rights

Audit reports. Processor will, upon reasonable request, make available to Controller summary information regarding its security measures, including, where available, third-party audit reports, certifications, and questionnaires.
Audits. Where required by Applicable Data Protection Law and where the information made available under Section 10.1 is not sufficient, Controller (or an independent auditor mandated by Controller and approved by Processor, which approval will not be unreasonably withheld) may conduct an audit of Processor's compliance with this DPA.
Conditions. Any audit will be conducted: (a) no more than once per twelve (12) month period (except where required following a Personal Data Breach or by a competent authority); (b) on at least thirty (30) days' prior written notice; (c) during regular business hours; (d) subject to confidentiality obligations; (e) in a manner that does not unreasonably interfere with Processor's business operations; and (f) at Controller's cost, including reimbursement of Processor's reasonable expenses.
Scope. Audits will not extend to (i) information of other customers of Processor, (ii) Processor's internal accounting or financial information, (iii) trade secrets, or (iv) any information that, in Processor's reasonable opinion, could compromise the security of Processor's systems or premises.

11. Liability and Indemnification

Liability cap. Each Party's aggregate liability under or in connection with this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability set out in the Agreement.
Controller indemnity. Controller will defend, indemnify, and hold harmless Processor and its affiliates from and against any third-party claims, losses, damages, fines, and expenses (including reasonable attorneys' fees) arising out of or related to (a) Controller's breach of Section 3, (b) Controller's instructions to Processor, or (c) Personal Data submitted to the Services in violation of Applicable Data Protection Law or applicable anti-spam, telecommunications, or consumer protection laws.
Processor indemnity. Processor will defend, indemnify, and hold harmless Controller and its affiliates from and against any third-party claims, losses, damages, fines, and expenses (including reasonable attorneys' fees) arising out of Processor's material breach of its obligations under Sections 4, 5, 6, 8, or 9, subject to the limitations in Section 11.1.
Apportionment. Where Controller and Processor are both responsible for damage caused by Processing in violation of Applicable Data Protection Law, each Party will bear liability in proportion to its responsibility for the damage, consistent with Article 82 GDPR (where applicable).
Conditions. The indemnified Party must (a) promptly notify the indemnifying Party of the claim, (b) give the indemnifying Party sole control over the defense and settlement (provided no settlement imposes obligations on the indemnified Party without its written consent), and (c) reasonably cooperate in the defense.

12. Governing Law

Choice of law. This DPA is governed by the laws of the State of New York, United States, without regard to its conflict-of-law principles, except where Applicable Data Protection Law requires otherwise.
Forum. The Parties consent to the exclusive jurisdiction of the state and federal courts located in New York County, New York for any dispute arising out of or relating to this DPA, except where Applicable Data Protection Law grants Data Subjects or supervisory authorities other forums.
GDPR / UK GDPR. To the extent the GDPR or UK GDPR applies to Processing under this DPA, the relevant provisions of the GDPR or UK GDPR control over any inconsistent provision of this DPA, and the SCCs and any UK Addendum are incorporated by reference and prevail over conflicting terms.
CCPA. To the extent the CCPA applies, Processor is acting as a "service provider" and the restrictions in Section 4.2 apply.

13. General Provisions

Order of precedence. In the event of any conflict, the order of precedence is: (a) the SCCs (where incorporated), (b) this DPA, (c) the Agreement.
Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions will remain in full force and effect.
Entire agreement. This DPA, together with the Agreement, constitutes the entire agreement between the Parties regarding the Processing of Personal Data.
Amendments. Processor may update this DPA from time to time as required to reflect changes in Applicable Data Protection Law, the Services, or its Sub-processors, provided that such updates do not materially diminish Controller's rights under this DPA. Material changes will be communicated to Controller with reasonable notice.
Counterparts and electronic signature. This DPA may be executed in counterparts, including electronically, each of which constitutes an original and together one instrument.

Signatures

Processor — SJW Group, Inc., a New York corporation, d/b/a More Good Reviews

Signature: ____________________________

Name: Scott Vayner

Title: President

Date: ____________________________

Controller — ____________________________________

Signature: ____________________________

Name: ____________________________

Title: ____________________________

Date: ____________________________