{"id":89,"date":"2026-08-18T04:20:08","date_gmt":"2026-08-18T04:20:08","guid":{"rendered":"\/dpa\/"},"modified":"2026-08-18T06:31:45","modified_gmt":"2026-08-18T06:31:45","slug":"dpa","status":"publish","type":"page","link":"https:\/\/dev.way.com\/auto-repair-software\/dpa\/","title":{"rendered":"Data Processing Agreement"},"content":{"rendered":"<section class=\"wrt-legal alignfull wp-block-wrt-legal\">\n\t<div class=\"wrt-legal__inner\">\n\t\t<nav class=\"wrt-legal__topics\" aria-label=\"Topics\">\n\t\t\t<div class=\"wrt-legal__topics-panel\">\n\t\t\t\t<p class=\"wrt-legal__topics-heading\">Topics<\/p>\n\t\t\t\t<ul class=\"wrt-legal__topics-list\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li class=\"wrt-legal__topics-item\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a\n\t\t\t\t\t\t\t\t\tclass=\"wrt-legal__topics-link\"\n\t\t\t\t\t\t\t\t\thref=\"\/auto-repair-software\/terms-of-service\/\"\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t>\n\t\t\t\t\t\t\t\t\tTerms &amp; Conditions\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li class=\"wrt-legal__topics-item\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a\n\t\t\t\t\t\t\t\t\tclass=\"wrt-legal__topics-link\"\n\t\t\t\t\t\t\t\t\thref=\"\/auto-repair-software\/privacy-policy\/\"\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t>\n\t\t\t\t\t\t\t\t\tPrivacy Policy\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<li class=\"wrt-legal__topics-item\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<a\n\t\t\t\t\t\t\t\t\tclass=\"wrt-legal__topics-link\"\n\t\t\t\t\t\t\t\t\thref=\"\/auto-repair-software\/dpa\/\"\n\t\t\t\t\t\t\t\t\t aria-current=\"page\"\t\t\t\t\t\t\t\t>\n\t\t\t\t\t\t\t\t\tWay.com Data Processing Agreement (\u201cDPA\u201d)\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/li>\n\t\t\t\t\t\t\t\t\t<\/ul>\n\t\t\t<\/div>\n\t\t<\/nav>\n\n\t\t<div class=\"wrt-legal__main\">\n\t\t\t<div class=\"wrt-legal__document\">\n  <h1 class=\"wrt-legal__title\">Way.com Data Processing Agreement (\u201cDPA\u201d)<\/h1>\n  <section class=\"wrt-legal__section\">\n    <p class=\"wrt-legal__p\">Shop (\u201cCustomer\u201d) has entered into an agreement with Way.com, Inc. (\u201cWay.com\u201d) (each a \u201cParty\u201d and collectively the \u201cParties\u201d) under which Way.com has agreed to provide the Shop Services in accordance with such agreement (the \u201cAgreement\u201d). This US Data Processing Agreement (the \u201cDPA\u201d) is incorporated into and forms part of the Agreement and shall be effective on the effective date of the Agreement.<\/p>\n    <p class=\"wrt-legal__p\">To the extent that Klaviyo processes any Customer Personal Data (as defined below) on behalf of the Customer in connection with the provision of the Shop Services, the Parties have agreed that it shall do so on the terms of this DPA.<\/p>\n    <p class=\"wrt-legal__p\">When Customer uses the R&amp;M SaaS , Way.com may collect Customer Personal Information (as defined below) from or about Consumers (as defined below). This DPA describes the Parties\u2019 respective data protection obligations under the US Data Protection Laws with respect to such Customer Personal Information.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">1. Definitions<\/h2>\n    <p class=\"wrt-legal__p\">Capitalized terms used but not defined within this DPA shall have the meaning set forth in the Agreement. The following capitalized terms used in this DPA shall be defined as follows:<\/p>\n    <ol class=\"wrt-legal__list wrt-legal__list--numbered\">\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cConsumer\u201d means a natural person whose Personal Information is Processed.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cCustomer Personal Data\u201d means Personal Information provided by Customer to, or which is collected on behalf of Customer by, Way.com to provide the Shop Services to Customer pursuant to the Agreement.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cInstructions\u201d means Customer\u2019s instructions to Way.com: (i) to provide the Shop Services to Customer in accordance with the features and functionalities of the Shop Services and related documentation; (ii) through Authorized User-initiated actions on and through the Shop Services or otherwise based on Customer\u2019s configuration and use of the Shop Services; (iii) contained in the Agreement and\/or any applicable Shop Agreement; and (iv) mutually agreed by the Parties in writing.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cPersonal Information\u201d or \u201cPersonal Data\u201d means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable natural person. Where applicable, Personal Data shall be interpreted consistent with the same or similar term under US Data Protection Laws.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cSecurity Incident\u201d means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Customer Personal Information.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cSensitive Information\u201d means \u201cSensitive Personal Information\u201d or \u201cSensitive Personal Data\u201d as defined under US Data Protection Laws.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cUS Data Protection Laws\u201d means, to the extent applicable, federal and state laws relating to data protection, the Processing of Personal Data, privacy and\/or data protection in force from time to time in the United States, including any regulations promulgated pursuant to any such laws, as applicable.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cVerifiable Consumer Request\u201d means the rights asserted by any individual in relation to Personal Information under the US Data Protection Laws.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">\u201cBusiness\u201d, \u201cContractor\u201d, \u201cController\u201d, \u201cService Provider\u201d, \u201cProcessor\u201d, \u201cProcess\u201d, \u201cSale\u201d, and \u201cShare\u201d shall have the meanings set forth in the US Data Protection Laws.<\/li>\n    <\/ol>\n    <p class=\"wrt-legal__p\">End Note. Words denoting the singular includes the plural and vice versa. Defined words include their grammatical forms. In the event of a conflict in the meanings of defined terms in the US Data Protection Laws, the meaning from the law applicable to the state of residence of the relevant Consumer applies.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">2. Relationship and Overview of Processing<\/h2>\n    <p class=\"wrt-legal__p\">With respect to the Shop Services, the Parties agree that: (i) Customer is considered the Business or Controller and will comply with its obligations as a Business and Controller under the US Data Protection Laws; and (ii) Way.com is considered a Service Provider or Processor and will comply with its obligations as a Service Provider and Processor under the US Data Protection Laws. Customer will provide Customer Personal Information to Way.com only to the extent permitted by, and in compliance with, the Agreement, and it will ensure that it has all necessary rights and permissions needed to permit Customer Personal Information to be collected and processed in accordance with the Instructions. To the extent that Way.com is deemed to be a \u201cContractor\u201d, Way.com certifies that it understands the restrictions on its Processing of Customer Personal Information as set forth in this DPA and will comply with them.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">3. Instructions for Processing<\/h2>\n    <ol class=\"wrt-legal__list wrt-legal__list--numbered\">\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Way.com will only Process Customer Personal Information under the Instructions of Customer, and in accordance with US Data Protection Laws. The Agreement and this DPA will generally constitute Instructions for the Processing of Customer Personal Information. Customer may issue further written Instructions in accordance with this DPA. The parties agree that the specific \u201cbusiness purpose\u201d (\u201cbusiness purpose\u201d as defined under the CCPA) of Way.com\u2019s Processing of Customer Personal Information are the Instructions. Way.com is only authorized to Process Customer Personal Information for the purposes listed in the Instructions and for no other purpose. The details of data processing (such as subject matter, nature and purpose of the processing, categories of Customer Personal Information and data subjects) are described in the Agreement and in Exhibit 1 of this DPA.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Without limiting the foregoing, Way.com will not: (i) Sell Customer Personal Information to third-parties or otherwise make Customer Personal Information available to any third party for monetary or other valuable consideration; (ii) Share Customer Personal Information with any third party (this excludes Way.com Affiliates and Sub-processors); (iii) retain, use, or disclose Customer Personal Information for any purpose other than for the business purposes specified in the Agreement or as otherwise permitted by US Data Protection Laws; (iv) retain, use, or disclose Customer Personal Information outside of the direct business relationship between the Parties; or (v) except as otherwise permitted by US Data Protection Law, combine Customer Personal Information with Customer Personal Information that Way.com receives from or on behalf of another person or persons, or collects from its own interaction with the Consumer.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Way.com will limit access to Customer Personal Information to personnel who have a business need to access such Customer Personal Information, and will ensure that personnel handling Customer Personal Information are subject to adequate confidentiality obligations that persist beyond the contractual relationship with the personnel.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Way.com will provide Customer with information and support to enable Customer to conduct and document any data protection assessments as required under US Data Protection Law. In addition, Way.com will notify Customer promptly if Way.com determines that it can no longer meet its obligations under US Data Protection Laws.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Customer will have the right to take reasonable and appropriate steps to ensure that Way.com uses Customer Personal Information in a manner consistent with Customer\u2019s obligations under US Data Protection Law.<\/li>\n    <\/ol>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">4. Security and Audit Obligations<\/h2>\n    <ol class=\"wrt-legal__list wrt-legal__list--numbered\">\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Way.com will implement the technical and organizational security measures specified in Exhibit 2 of this DPA to protect Customer Personal Information.\u00a0\u00a0 When assessing the appropriate level of security, account will be taken in particular of the nature, scope, context and purpose of the Processing as well as the risks of varying likelihood and severity for the rights and freedoms of the Consumers.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Customer has the right to audit Way.com&#x27;s compliance with this DPA and US Data Protection Laws, including by way of inspections, and Way.com shall reasonably cooperate in this regard. The Parties agree that all such audits will be conducted: (i) upon reasonable written notice to Way.com; (ii) only once per year or more frequently if any audit indicates that Way.com is in material non-compliance with this DPA; (iii) only during Way.com&#x27;s normal business hours if conducted in form of an inspection; (iv) in a manner that does not disrupt Way.com&#x27;s business if conducted in form of an inspection; and (v) only upon entering into a confidentiality agreement with Way.com.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">To conduct such audit, Customer may engage a third-party auditor subject to such auditor complying with the requirements under Section 4.2 and provided that such auditor is suitably qualified, independent and not a competitor of Way.com.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Customer will bear the costs for any audit initiated by Customer, unless the audit reveals material non-compliance with the requirements of this DPA.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Upon request, Way.com will provide to Customer documentation reasonably evidencing the implementation of its technical and organizational security measures in accordance with industry standards. Way.com may, in its discretion, provide data protection compliance certifications issued by a commonly accepted certification issuer which has been audited by a data security expert, or by a publicly certified auditing company. If the requested audit scope is addressed in such a certification produced by a qualified third-party auditor within twelve (12) months of Customer&#x27;s audit request and Way.com confirms there are no known material changes in the controls audited, Customer agrees to accept those findings in lieu of requesting an audit of the controls covered by the report, unless there are indications of any non-compliance with such certification, this DPA, or US Data Protection Laws.<\/li>\n    <\/ol>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">5. Security Incidents<\/h2>\n    <p class=\"wrt-legal__p\">Way.com will notify Customer in writing without undue delay after becoming aware of any Security Incident, and reasonably cooperate in any obligation of Customer under US Data Protection Laws to make any notifications, such as to individuals or supervisory authorities. Way.com will take reasonable steps to contain, investigate, and mitigate any Security Incident, and will send Customer timely information about the Security Incident, including, but not limited to, the nature of the Security Incident, the measures taken to mitigate or contain the Security Incident, and the status of the investigation. Way.com\u2019s notification of or response to a Security Incident under this Section 5 will not be construed as an acknowledgement by Way.com of any fault or liability with respect to the Security Incident. Way.com will provide reasonable assistance with Customer\u2019s investigation of the Security Incident and any notification obligation of Customer under US Data Protection Laws, such as in relation to individuals or supervisory authorities.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">6. Verifiable Consumer Requests<\/h2>\n    <p class=\"wrt-legal__p\">Way.com has implemented technical and organizational measures to assist Customer with its obligation to respond to Verifiable Consumer Requests for the access and erasure of Customer Personal Information. Way.com will make this functionality available to Customer during Customer\u2019s Subscription Term. If Way.com receives a Verifiable Consumer Request from a Consumer that identifies Customer, it will promptly forward that request to Customer. Customer agrees to follow Way.com\u2019s documented procedures, provide sufficient information to identify records containing relevant Customer Personal Information, and otherwise cooperate with Way.com\u2019s reasonable requests. \u200b\u200bCustomer must not send duplicative or unnecessary requests to Way.com (for example, requests for Customer Personal Information not processed by the Shop Services).<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">7. Sub-processors<\/h2>\n    <ol class=\"wrt-legal__list wrt-legal__list--numbered\">\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Customer grants Way.com the general authorization to engage Sub-processors subject to Section 7.2 and agrees to the engagement of Way.com\u2019s current Sub-processors<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Way.com will use commercially reasonable efforts to ensure that any Affiliates and Sub-processors who receive Customer Personal Information agree to contractual requirements for confidentiality, data protection, and data security substantially equivalent to those set out in this DPA.<\/li>\n      <li class=\"wrt-legal__item wrt-legal__item--text\">Way.com will provide Customer with at least fifteen (15) days\u2019 notice of any proposed changes to the Sub-processors it uses to Process Customer Personal Information. Customer may object to Way.com\u2019s use of a new Sub-processor by providing Way.com with written notice of the objection within five (5) days after Way.com has provided notice of such proposed change (an \u201cObjection\u201d). If Customer does not object to the engagement within the Objection period, consent regarding the engagement will be assumed. In the event Customer objects to Way.com\u2019s use of a new Sub-processor, Customer and Way.com will work together in good faith to find a mutually acceptable resolution to address such Objection. If the Parties are unable to reach a mutually acceptable resolution within a reasonable timeframe, either Party may, as its sole and exclusive remedy, terminate the portion of the Agreement relating to the Shop Services affected by such change by providing written notice to the other Party. During any such Objection period, Way.com may suspend the affected portion of the Shop Services.<\/li>\n    <\/ol>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">8. Deidentified Data<\/h2>\n    <p class=\"wrt-legal__p\">If, under US Data Protection Laws, Way.com receives deidentified data from or on behalf of Customer, then Way.com will: (i) take reasonable measures to ensure the information cannot be associated with a Consumer; (ii) publicly commit to Process deidentified data solely in deidentified form and not attempt to reidentify the information; and (iii) contractually obligate any recipients of deidentified data to comply with the foregoing requirements and US Data Protection Law.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">9. Deletion and Return<\/h2>\n    <p class=\"wrt-legal__p\">Way.com will, within ninety (90) days of the date of termination or expiry of the Agreement, (i) if requested to do so by Customer within that time period, return a copy of all Customer Personal Information or provide a self-service functionality allowing Customer to do the same; and in any case (ii) delete all copies of Customer Personal Information Processed by Way.com and take reasonable efforts to procure the deletion of any copies in Sub-processors possession.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">10. Sensitive Information<\/h2>\n    <p class=\"wrt-legal__p\">Notwithstanding anything to the contrary in the R&amp;M SaaS, including any documentation provided as part of the Shop Services, the Shop Services are not intended to Process Sensitive Information. Customer is solely responsible for determining whether using the Shop Services to Process Sensitive Information complies with US Data Protection Laws. If Customer processes Sensitive Information in its use of the Shop Services, Customer is acknowledging that Way.com\u2019s technical and organizational security measures specified in Exhibit 2 of this DPA are sufficient and satisfactory for its purposes in relation to its Processing of its Sensitive Information.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">11. Term and Termination<\/h2>\n    <p class=\"wrt-legal__p\">This DPA is effective as of the Effective Date and continues in effect until (i) termination or expiration of the Agreement or (ii) Way.com ceases to process Customer Personal Information through the Shop Services on behalf of Customer, whichever period is greater. Either Party has the right to extraordinarily terminate this DPA and the Agreement if: (i) the Parties agree in writing that this DPA conflicts in any material respect with the US Data Protection Laws, including as a result of an amendment or change in applicable law; (ii) any authority or court demands or requests changes to these agreements and the Parties cannot agree on adequate amendments to reflect these changes; or (iii) Way.com notifies Customer in writing that it can no longer meet its obligations under the US Data Protection Laws.<\/p>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">Exhibit 1 &#8211; Processing Details<\/h2>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">Nature of the Processing<\/p>\n      <p class=\"wrt-legal__p\">Way.com will use Customer Personal Information to provide the Shop Services as described in the Agreement. The processing activities include collecting, storing, and transferring Customer Personal Information for the provision of such Shop Services.<\/p>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">Purpose(s) of the Processing<\/p>\n      <p class=\"wrt-legal__p\">To provide a shop management platform and related services, including but not limited to: preparing estimates, managing customer communications, processing payments, and supporting shop operations.<\/p>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">Types of Customer Personal Information Subject to Processing<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Name<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Phone number<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Email address<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Referral source<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Address<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Vehicle information (including year, make, model, type of car or motorcycle, mileage, license plate, VIN, and repair information)<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Any other information provided by Customer or collected on behalf of Customer in connection with the Shop Services<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">Categories of Data Subjects<\/p>\n      <p class=\"wrt-legal__p\">Consumers (as defined in the DPA) whose Personal Information is processed in connection with the Shop Services.<\/p>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">Duration of Processing<\/p>\n      <p class=\"wrt-legal__p\">Way.com will process Customer Personal Information for as long as the Agreement is in effect, or as otherwise required by applicable law.<\/p>\n    <\/section>\n  <\/section>\n  <section class=\"wrt-legal__section\">\n    <h2 class=\"wrt-legal__heading\">Exhibit 2 &#8211; Security Measures<\/h2>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__p\">Way.com will implement the following technical and organizational security measures to protect Customer Personal Information:<\/p>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">1. Access Control<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Limit access to Customer Personal Information to authorized personnel who require such access to fulfill their job responsibilities.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Implement unique user IDs and strong authentication mechanisms (e.g., passwords, multi-factor authentication) for all personnel with access.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Maintain and regularly review access logs to detect unauthorized access attempts.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">2. Data Encryption<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Encrypt Customer Personal Information at rest using industry-standard encryption algorithms (e.g., AES-256).<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Encrypt Customer Personal Information in transit using secure protocols (e.g., TLS 1.2 or higher).<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Manage encryption keys securely, restricting access to authorized personnel only.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">3. Data Segregation<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Segregate Customer Personal Information from other data sets to prevent unauthorized access or commingling.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Use logical separation (e.g., role-based access controls, separate databases) where physical separation is not feasible.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">4. Physical Security<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Store servers and systems containing Customer Personal Information in secure facilities with access controls (e.g., badge access, visitor logs).<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Implement environmental controls (e.g., fire suppression, climate control) to protect physical infrastructure.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">5. System Security and Maintenance<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Regularly update and patch systems, applications, and devices to address known vulnerabilities.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Use anti-malware and endpoint protection solutions on all systems processing Customer Personal Information.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Monitor systems for unusual activity and respond promptly to security incidents.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">6. Data Backup and Recovery<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Perform regular backups of Customer Personal Information and test restoration procedures periodically.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Store backups securely, with access limited to authorized personnel.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Ensure backup data is encrypted and protected from unauthorized access.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">7. Personnel Training and Awareness<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Provide security and privacy training to all personnel with access to Customer Personal Information.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Require personnel to acknowledge and comply with security policies and procedures.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">8. Incident Response<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Maintain an incident response plan to address potential data breaches or security incidents involving Customer Personal Information.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Notify the Controller without undue delay upon becoming aware of a security incident affecting Customer Personal Information, providing relevant details as required by the DPA.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">9. Subprocessor Management<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Require subprocessors to implement security measures at least as protective as those set forth in the DPA.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Conduct due diligence on subprocessors\u2019 security practices before engagement.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">10. Data Minimization and Retention<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Process Customer Personal Information only as necessary to fulfill contractual obligations.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Retain Customer Personal Information only for as long as required by the Controller or applicable law, and securely delete or return data upon termination of services.<\/li>\n      <\/ul>\n    <\/section>\n    <section class=\"wrt-legal__section\">\n      <p class=\"wrt-legal__item-title\">11. Audit and Compliance<\/p>\n      <ul class=\"wrt-legal__list wrt-legal__list--bullets\">\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Make available information necessary to demonstrate compliance with these security measures, subject to reasonable confidentiality and security restrictions.<\/li>\n        <li class=\"wrt-legal__item wrt-legal__item--text\">Cooperate with the Controller\u2019s reasonable requests for information or audits, provided such requests do not unreasonably disrupt Processor\u2019s business operations.<\/li>\n      <\/ul>\n    <\/section>\n  <\/section>\n<\/div>\t\t<\/div>\n\t<\/div>\n<\/section>\n\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":0,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"page-content","meta":{"footnotes":""},"class_list":["post-89","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/dev.way.com\/auto-repair-software\/wp-json\/wp\/v2\/pages\/89","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dev.way.com\/auto-repair-software\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/dev.way.com\/auto-repair-software\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/dev.way.com\/auto-repair-software\/wp-json\/wp\/v2\/comments?post=89"}],"version-history":[{"count":1,"href":"https:\/\/dev.way.com\/auto-repair-software\/wp-json\/wp\/v2\/pages\/89\/revisions"}],"predecessor-version":[{"id":98,"href":"https:\/\/dev.way.com\/auto-repair-software\/wp-json\/wp\/v2\/pages\/89\/revisions\/98"}],"wp:attachment":[{"href":"https:\/\/dev.way.com\/auto-repair-software\/wp-json\/wp\/v2\/media?parent=89"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}