Data Processing Agreement

This Data Processing Agreement (“DPA”) supplements the Hourglass Terms and Conditions and governs the processing of Customer Data by Hourglass SaaS, operated by Spa City Digital LLC d/b/a Hourglass SaaS (“Hourglass,” “Processor”), on behalf of the Customer (“Customer,” “Controller”). This DPA is incorporated by reference into the Terms and Conditions and is binding upon Customer’s acceptance of the Terms.

• “Applicable Data Protection Laws” means all U.S. federal and state privacy and data protection laws applicable to the processing of Customer Data, including the California Consumer Privacy Act (CCPA), as amended.
• “Customer Data” means any data, including personal information, that Customer or Customer’s authorized users submit to or process through the Service.
• “Data Subject” means an identified or identifiable natural person whose personal information is contained in Customer Data.
• “Personal Information” means information that identifies, relates to, describes, or could reasonably be linked to a particular individual or household, as defined under Applicable Data Protection Laws.
• “Processing” means any operation performed on Customer Data, including collection, storage, use, disclosure, or deletion.
• “Sub-processor” means any third party engaged by Hourglass to process Customer Data on Hourglass’s behalf.

Capitalized terms not defined here have the meanings given in the Terms and Conditions.

Customer is the controller of Customer Data. Hourglass is the processor and processes Customer Data only on Customer’s documented instructions, as set forth in this DPA, the Terms and Conditions, and the Service’s standard functionality.

This DPA applies to Hourglass’s processing of Customer Data in connection with the Service.

Customer instructs Hourglass to process Customer Data:

• To provide, maintain, and improve the Service
• To comply with Customer’s reasonable written instructions
• To comply with Applicable Data Protection Laws and other legal obligations

If Hourglass believes an instruction violates Applicable Data Protection Laws, Hourglass will notify Customer and may suspend processing until the issue is resolved.

Hourglass will ensure that personnel authorized to process Customer Data are bound by confidentiality obligations, whether by contract or statute, and have received appropriate training on data protection.

Hourglass implements and maintains appropriate technical and organizational measures designed to protect Customer Data against unauthorized or unlawful processing, accidental loss, destruction, or damage. These measures include those described in Schedule B (Security Measures).

Hourglass reviews and updates these measures periodically and will not materially decrease the overall security of the Service during the term.

6.1 General Authorization

Customer authorizes Hourglass to engage Sub-processors to process Customer Data, subject to the requirements of this Section 6.

6.2 Current Sub-processors

A current list of Sub-processors is set forth in Schedule C and includes, at the date of this DPA, our hosting and infrastructure provider, payment processor, and email delivery provider. The full current list is available on request.

6.3 Notification of New Sub-processors

Hourglass will provide Customer with at least 30 days’ notice of any new Sub-processor before authorizing them to process Customer Data. Notice may be provided by email or through the Service.

6.4 Customer Objection

Customer may object to a new Sub-processor on reasonable data protection grounds within the notice period. Hourglass will work in good faith to address objections. If a resolution cannot be reached, Customer may terminate the affected Service with a pro-rata refund of prepaid fees for the unused portion of the term.

6.5 Sub-processor Obligations

Hourglass will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA. Hourglass remains liable for the acts and omissions of its Sub-processors as if they were Hourglass’s own.

To the extent Customer cannot fulfill a Data Subject’s rights request through the Service’s self-service tools, Hourglass will provide reasonable assistance to enable Customer to respond to:

• Requests to access, correct, delete, or port Personal Information
• Requests to restrict or object to processing
• Other rights granted under Applicable Data Protection Laws

If Hourglass receives a request from a Data Subject directly, Hourglass will promptly forward the request to Customer and not respond to the Data Subject directly except as required by law or to confirm receipt.

Hourglass will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data breach affecting Customer Data. The notification will include, to the extent known:

• A description of the nature of the breach
• The categories and approximate volume of Personal Information affected
• The likely consequences
• The measures taken or proposed to address the breach and mitigate harm
• Contact information for follow-up

Hourglass will cooperate with Customer in investigating and remediating any breach. Customer is responsible for notifying affected individuals and regulators as required by Applicable Data Protection Laws.

Customer may, no more than once per year and on at least 30 days’ written notice, request information reasonably necessary to verify Hourglass’s compliance with this DPA. Hourglass will respond to reasonable audit requests by providing:

• Summaries of independent security audits or certifications (if any)
• Written responses to specific compliance questions
• Documentation of Hourglass’s security and privacy practices

On-site audits are not permitted unless required by Applicable Data Protection Laws and conducted at Customer’s expense, during business hours, with reasonable notice, and subject to confidentiality obligations.