Way Repair Tech
Schedule a Demo

Way.com Data Processing Agreement (“DPA”)

Shop (“Customer”) has entered into an agreement with Way.com, Inc. (“Way.com”) (each a “Party” and collectively the “Parties”) under which Way.com has agreed to provide the Shop Services in accordance with such agreement (the “Agreement”). This US Data Processing Agreement (the “DPA”) is incorporated into and forms part of the Agreement and shall be effective on the effective date of the Agreement.

To the extent that Klaviyo processes any Customer Personal Data (as defined below) on behalf of the Customer in connection with the provision of the Shop Services, the Parties have agreed that it shall do so on the terms of this DPA.

When Customer uses the R&M SaaS , Way.com may collect Customer Personal Information (as defined below) from or about Consumers (as defined below). This DPA describes the Parties’ respective data protection obligations under the US Data Protection Laws with respect to such Customer Personal Information.

1. Definitions

Capitalized terms used but not defined within this DPA shall have the meaning set forth in the Agreement. The following capitalized terms used in this DPA shall be defined as follows:

  1. “Consumer” means a natural person whose Personal Information is Processed.
  2. “Customer Personal Data” means Personal Information provided by Customer to, or which is collected on behalf of Customer by, Way.com to provide the Shop Services to Customer pursuant to the Agreement.
  3. “Instructions” means Customer’s instructions to Way.com: (i) to provide the Shop Services to Customer in accordance with the features and functionalities of the Shop Services and related documentation; (ii) through Authorized User-initiated actions on and through the Shop Services or otherwise based on Customer’s configuration and use of the Shop Services; (iii) contained in the Agreement and/or any applicable Shop Agreement; and (iv) mutually agreed by the Parties in writing.
  4. “Personal Information” or “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person. Where applicable, Personal Data shall be interpreted consistent with the same or similar term under US Data Protection Laws.
  5. “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Information.
  6. “Sensitive Information” means “Sensitive Personal Information” or “Sensitive Personal Data” as defined under US Data Protection Laws.
  7. “US Data Protection Laws” means, to the extent applicable, federal and state laws relating to data protection, the Processing of Personal Data, privacy and/or data protection in force from time to time in the United States, including any regulations promulgated pursuant to any such laws, as applicable.
  8. “Verifiable Consumer Request” means the rights asserted by any individual in relation to Personal Information under the US Data Protection Laws.
  9. “Business”, “Contractor”, “Controller”, “Service Provider”, “Processor”, “Process”, “Sale”, and “Share” shall have the meanings set forth in the US Data Protection Laws.

End Note. Words denoting the singular includes the plural and vice versa. Defined words include their grammatical forms. In the event of a conflict in the meanings of defined terms in the US Data Protection Laws, the meaning from the law applicable to the state of residence of the relevant Consumer applies.

2. Relationship and Overview of Processing

With respect to the Shop Services, the Parties agree that: (i) Customer is considered the Business or Controller and will comply with its obligations as a Business and Controller under the US Data Protection Laws; and (ii) Way.com is considered a Service Provider or Processor and will comply with its obligations as a Service Provider and Processor under the US Data Protection Laws. Customer will provide Customer Personal Information to Way.com only to the extent permitted by, and in compliance with, the Agreement, and it will ensure that it has all necessary rights and permissions needed to permit Customer Personal Information to be collected and processed in accordance with the Instructions. To the extent that Way.com is deemed to be a “Contractor”, Way.com certifies that it understands the restrictions on its Processing of Customer Personal Information as set forth in this DPA and will comply with them.

3. Instructions for Processing

  1. Way.com will only Process Customer Personal Information under the Instructions of Customer, and in accordance with US Data Protection Laws. The Agreement and this DPA will generally constitute Instructions for the Processing of Customer Personal Information. Customer may issue further written Instructions in accordance with this DPA. The parties agree that the specific “business purpose” (“business purpose” as defined under the CCPA) of Way.com’s Processing of Customer Personal Information are the Instructions. Way.com is only authorized to Process Customer Personal Information for the purposes listed in the Instructions and for no other purpose. The details of data processing (such as subject matter, nature and purpose of the processing, categories of Customer Personal Information and data subjects) are described in the Agreement and in Exhibit 1 of this DPA.
  2. Without limiting the foregoing, Way.com will not: (i) Sell Customer Personal Information to third-parties or otherwise make Customer Personal Information available to any third party for monetary or other valuable consideration; (ii) Share Customer Personal Information with any third party (this excludes Way.com Affiliates and Sub-processors); (iii) retain, use, or disclose Customer Personal Information for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by US Data Protection Laws; (iv) retain, use, or disclose Customer Personal Information outside of the direct business relationship between the Parties; or (v) except as otherwise permitted by US Data Protection Law, combine Customer Personal Information with Customer Personal Information that Way.com receives from or on behalf of another person or persons, or collects from its own interaction with the Consumer.
  3. Way.com will limit access to Customer Personal Information to personnel who have a business need to access such Customer Personal Information, and will ensure that personnel handling Customer Personal Information are subject to adequate confidentiality obligations that persist beyond the contractual relationship with the personnel.
  4. Way.com will provide Customer with information and support to enable Customer to conduct and document any data protection assessments as required under US Data Protection Law. In addition, Way.com will notify Customer promptly if Way.com determines that it can no longer meet its obligations under US Data Protection Laws.
  5. Customer will have the right to take reasonable and appropriate steps to ensure that Way.com uses Customer Personal Information in a manner consistent with Customer’s obligations under US Data Protection Law.

4. Security and Audit Obligations

  1. Way.com will implement the technical and organizational security measures specified in Exhibit 2 of this DPA to protect Customer Personal Information.   When assessing the appropriate level of security, account will be taken in particular of the nature, scope, context and purpose of the Processing as well as the risks of varying likelihood and severity for the rights and freedoms of the Consumers.
  2. Customer has the right to audit Way.com's compliance with this DPA and US Data Protection Laws, including by way of inspections, and Way.com shall reasonably cooperate in this regard. The Parties agree that all such audits will be conducted: (i) upon reasonable written notice to Way.com; (ii) only once per year or more frequently if any audit indicates that Way.com is in material non-compliance with this DPA; (iii) only during Way.com's normal business hours if conducted in form of an inspection; (iv) in a manner that does not disrupt Way.com's business if conducted in form of an inspection; and (v) only upon entering into a confidentiality agreement with Way.com.
  3. To conduct such audit, Customer may engage a third-party auditor subject to such auditor complying with the requirements under Section 4.2 and provided that such auditor is suitably qualified, independent and not a competitor of Way.com.
  4. Customer will bear the costs for any audit initiated by Customer, unless the audit reveals material non-compliance with the requirements of this DPA.
  5. Upon request, Way.com will provide to Customer documentation reasonably evidencing the implementation of its technical and organizational security measures in accordance with industry standards. Way.com may, in its discretion, provide data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, or by a publicly certified auditing company. If the requested audit scope is addressed in such a certification produced by a qualified third-party auditor within twelve (12) months of Customer's audit request and Way.com confirms there are no known material changes in the controls audited, Customer agrees to accept those findings in lieu of requesting an audit of the controls covered by the report, unless there are indications of any non-compliance with such certification, this DPA, or US Data Protection Laws.

5. Security Incidents

Way.com will notify Customer in writing without undue delay after becoming aware of any Security Incident, and reasonably cooperate in any obligation of Customer under US Data Protection Laws to make any notifications, such as to individuals or supervisory authorities. Way.com will take reasonable steps to contain, investigate, and mitigate any Security Incident, and will send Customer timely information about the Security Incident, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation. Way.com’s notification of or response to a Security Incident under this Section 5 will not be construed as an acknowledgement by Way.com of any fault or liability with respect to the Security Incident. Way.com will provide reasonable assistance with Customer’s investigation of the Security Incident and any notification obligation of Customer under US Data Protection Laws, such as in relation to individuals or supervisory authorities.

6. Verifiable Consumer Requests

Way.com has implemented technical and organizational measures to assist Customer with its obligation to respond to Verifiable Consumer Requests for the access and erasure of Customer Personal Information. Way.com will make this functionality available to Customer during Customer’s Subscription Term. If Way.com receives a Verifiable Consumer Request from a Consumer that identifies Customer, it will promptly forward that request to Customer. Customer agrees to follow Way.com’s documented procedures, provide sufficient information to identify records containing relevant Customer Personal Information, and otherwise cooperate with Way.com’s reasonable requests. ​​Customer must not send duplicative or unnecessary requests to Way.com (for example, requests for Customer Personal Information not processed by the Shop Services).

7. Sub-processors

  1. Customer grants Way.com the general authorization to engage Sub-processors subject to Section 7.2 and agrees to the engagement of Way.com’s current Sub-processors
  2. Way.com will use commercially reasonable efforts to ensure that any Affiliates and Sub-processors who receive Customer Personal Information agree to contractual requirements for confidentiality, data protection, and data security substantially equivalent to those set out in this DPA.
  3. Way.com will provide Customer with at least fifteen (15) days’ notice of any proposed changes to the Sub-processors it uses to Process Customer Personal Information. Customer may object to Way.com’s use of a new Sub-processor by providing Way.com with written notice of the objection within five (5) days after Way.com has provided notice of such proposed change (an “Objection”). If Customer does not object to the engagement within the Objection period, consent regarding the engagement will be assumed. In the event Customer objects to Way.com’s use of a new Sub-processor, Customer and Way.com will work together in good faith to find a mutually acceptable resolution to address such Objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, either Party may, as its sole and exclusive remedy, terminate the portion of the Agreement relating to the Shop Services affected by such change by providing written notice to the other Party. During any such Objection period, Way.com may suspend the affected portion of the Shop Services.

8. Deidentified Data

If, under US Data Protection Laws, Way.com receives deidentified data from or on behalf of Customer, then Way.com will: (i) take reasonable measures to ensure the information cannot be associated with a Consumer; (ii) publicly commit to Process deidentified data solely in deidentified form and not attempt to reidentify the information; and (iii) contractually obligate any recipients of deidentified data to comply with the foregoing requirements and US Data Protection Law.

9. Deletion and Return

Way.com will, within ninety (90) days of the date of termination or expiry of the Agreement, (i) if requested to do so by Customer within that time period, return a copy of all Customer Personal Information or provide a self-service functionality allowing Customer to do the same; and in any case (ii) delete all copies of Customer Personal Information Processed by Way.com and take reasonable efforts to procure the deletion of any copies in Sub-processors possession.

10. Sensitive Information

Notwithstanding anything to the contrary in the R&M SaaS, including any documentation provided as part of the Shop Services, the Shop Services are not intended to Process Sensitive Information. Customer is solely responsible for determining whether using the Shop Services to Process Sensitive Information complies with US Data Protection Laws. If Customer processes Sensitive Information in its use of the Shop Services, Customer is acknowledging that Way.com’s technical and organizational security measures specified in Exhibit 2 of this DPA are sufficient and satisfactory for its purposes in relation to its Processing of its Sensitive Information.

11. Term and Termination

This DPA is effective as of the Effective Date and continues in effect until (i) termination or expiration of the Agreement or (ii) Way.com ceases to process Customer Personal Information through the Shop Services on behalf of Customer, whichever period is greater. Either Party has the right to extraordinarily terminate this DPA and the Agreement if: (i) the Parties agree in writing that this DPA conflicts in any material respect with the US Data Protection Laws, including as a result of an amendment or change in applicable law; (ii) any authority or court demands or requests changes to these agreements and the Parties cannot agree on adequate amendments to reflect these changes; or (iii) Way.com notifies Customer in writing that it can no longer meet its obligations under the US Data Protection Laws.

Exhibit 1 – Processing Details

Nature of the Processing

Way.com will use Customer Personal Information to provide the Shop Services as described in the Agreement. The processing activities include collecting, storing, and transferring Customer Personal Information for the provision of such Shop Services.

Purpose(s) of the Processing

To provide a shop management platform and related services, including but not limited to: preparing estimates, managing customer communications, processing payments, and supporting shop operations.

Types of Customer Personal Information Subject to Processing

  • Name
  • Phone number
  • Email address
  • Referral source
  • Address
  • Vehicle information (including year, make, model, type of car or motorcycle, mileage, license plate, VIN, and repair information)
  • Any other information provided by Customer or collected on behalf of Customer in connection with the Shop Services

Categories of Data Subjects

Consumers (as defined in the DPA) whose Personal Information is processed in connection with the Shop Services.

Duration of Processing

Way.com will process Customer Personal Information for as long as the Agreement is in effect, or as otherwise required by applicable law.

Exhibit 2 – Security Measures

Way.com will implement the following technical and organizational security measures to protect Customer Personal Information:

1. Access Control

  • Limit access to Customer Personal Information to authorized personnel who require such access to fulfill their job responsibilities.
  • Implement unique user IDs and strong authentication mechanisms (e.g., passwords, multi-factor authentication) for all personnel with access.
  • Maintain and regularly review access logs to detect unauthorized access attempts.

2. Data Encryption

  • Encrypt Customer Personal Information at rest using industry-standard encryption algorithms (e.g., AES-256).
  • Encrypt Customer Personal Information in transit using secure protocols (e.g., TLS 1.2 or higher).
  • Manage encryption keys securely, restricting access to authorized personnel only.

3. Data Segregation

  • Segregate Customer Personal Information from other data sets to prevent unauthorized access or commingling.
  • Use logical separation (e.g., role-based access controls, separate databases) where physical separation is not feasible.

4. Physical Security

  • Store servers and systems containing Customer Personal Information in secure facilities with access controls (e.g., badge access, visitor logs).
  • Implement environmental controls (e.g., fire suppression, climate control) to protect physical infrastructure.

5. System Security and Maintenance

  • Regularly update and patch systems, applications, and devices to address known vulnerabilities.
  • Use anti-malware and endpoint protection solutions on all systems processing Customer Personal Information.
  • Monitor systems for unusual activity and respond promptly to security incidents.

6. Data Backup and Recovery

  • Perform regular backups of Customer Personal Information and test restoration procedures periodically.
  • Store backups securely, with access limited to authorized personnel.
  • Ensure backup data is encrypted and protected from unauthorized access.

7. Personnel Training and Awareness

  • Provide security and privacy training to all personnel with access to Customer Personal Information.
  • Require personnel to acknowledge and comply with security policies and procedures.

8. Incident Response

  • Maintain an incident response plan to address potential data breaches or security incidents involving Customer Personal Information.
  • Notify the Controller without undue delay upon becoming aware of a security incident affecting Customer Personal Information, providing relevant details as required by the DPA.

9. Subprocessor Management

  • Require subprocessors to implement security measures at least as protective as those set forth in the DPA.
  • Conduct due diligence on subprocessors’ security practices before engagement.

10. Data Minimization and Retention

  • Process Customer Personal Information only as necessary to fulfill contractual obligations.
  • Retain Customer Personal Information only for as long as required by the Controller or applicable law, and securely delete or return data upon termination of services.

11. Audit and Compliance

  • Make available information necessary to demonstrate compliance with these security measures, subject to reasonable confidentiality and security restrictions.
  • Cooperate with the Controller’s reasonable requests for information or audits, provided such requests do not unreasonably disrupt Processor’s business operations.