1. Purpose and parties
This Data Processing Addendum ("DPA") is part of the Terms of Service (the "Agreement") between WorkShare LLC ("BotBid") and the customer named in the Agreement ("Customer"). It applies when BotBid processes Customer Personal Data on Customer's behalf in providing the Service.
This DPA takes effect on the later of the effective date of the Agreement or the date Customer accepts this DPA, and stays in effect as long as BotBid processes Customer Personal Data.
2. Definitions
Terms used but not defined here have the meanings given in the Agreement. In this DPA:
- "Applicable Privacy Law" means all US federal and state laws on privacy and the processing of personal information that apply to the processing under this DPA, including the California Consumer Privacy Act as amended and similar state laws.
- "Customer Personal Data" means personal information within Customer Data that BotBid processes on behalf of Customer.
- "Processing" means any operation performed on personal information, such as collection, storage, use, disclosure or deletion.
- "Security Incident" means a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- "Subprocessor" means a third party engaged by BotBid that processes Customer Personal Data.
- "Controller", "business", "processor", "service provider" and "consumer" have the meanings given in Applicable Privacy Law.
3. Roles of the parties
Customer is the controller or business for Customer Personal Data. BotBid is a processor or service provider that processes Customer Personal Data on Customer's behalf.
Customer is responsible for the lawfulness of the Customer Personal Data it provides, for giving any notices and obtaining any consents required by Applicable Privacy Law, and for the accuracy of its instructions.
BotBid is an independent controller of the account, billing, security and usage information it collects to run its own business, which is governed by the BotBid Privacy Policy.
4. Scope and instructions
BotBid will process Customer Personal Data only on Customer's documented instructions, unless required otherwise by law. The Agreement, this DPA, and Customer's configuration and use of the Service are Customer's complete instructions. Additional instructions require written agreement.
BotBid will tell Customer if it believes an instruction violates Applicable Privacy Law, and may suspend that processing until the instruction is changed or confirmed.
If the law requires BotBid to process Customer Personal Data other than on Customer's instructions, BotBid will tell Customer first, unless the law forbids it.
The details of processing are in Annex 1.
Customer instructs BotBid, as part of the Service, to send relevant portions of Customer Personal Data to AI model providers acting as Subprocessors, solely to produce output for Customer. Values flagged as secret are removed before sending, and the AI features cannot send email, submit bids, sign documents or spend money on their own.
Customer will not instruct BotBid to process special categories of sensitive personal information except where needed for a bid and allowed by law.
5. Confidentiality of personnel
BotBid will ensure that every person it authorizes to process Customer Personal Data is bound by a duty of confidentiality, is trained on handling personal information, and has access only to the extent needed for their role.
BotBid personnel do not have routine access to Customer prices, stored portal credentials or signatures. Access to them for support or security reasons requires a recorded, approved reason and is logged.
6. Security measures
BotBid will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the nature of the data and the risks. The current measures are described in Annex 2. BotBid may update them over time, as long as the updates do not materially reduce the overall level of protection.
7. Subprocessors
Customer gives BotBid general authorization to engage Subprocessors. A current list, including each Subprocessor's category of service and processing location, is available to Customer on request.
BotBid will give Customer at least [30] days notice before adding or replacing a Subprocessor, by email or in the Service. Customer may object in writing on reasonable data protection grounds within that period. The parties will work in good faith to resolve the objection. If they cannot, Customer may terminate the affected part of the Service and receive a refund of prepaid fees for the unused period.
BotBid will bind each Subprocessor by written agreement to data protection terms at least as protective as this DPA, including a prohibition on using Customer Personal Data to train shared AI models where the Subprocessor provides AI processing. BotBid remains responsible for its Subprocessors' performance.
8. Assistance with requests
Taking into account the nature of the processing, BotBid will provide reasonable assistance, including through features of the Service such as export, correction and deletion, to help Customer respond to requests from individuals exercising their rights under Applicable Privacy Law.
If BotBid receives a request directly from an individual about Customer Personal Data, it will forward the request to Customer and will not respond except to tell the individual to contact Customer, unless the law requires otherwise.
BotBid will also provide reasonable information to help Customer carry out any required data protection assessments.
9. Security Incident notification
BotBid will notify Customer without undue delay, and in any event within [72] hours, after becoming aware of a Security Incident.
The notice will describe, to the extent known, the nature of the incident, the categories and approximate volume of data and individuals affected, the likely consequences, and the steps taken or proposed to address it. BotBid will provide updates as more information becomes available.
BotBid will take reasonable steps to contain and remedy the incident and will cooperate with Customer's reasonable requests. Notice of a Security Incident is not an admission of fault or liability.
10. Deletion and return
During the subscription, Customer may export Customer Personal Data using the Service's export tools.
After the Agreement ends, Customer has [30] days to request a final export. BotBid will then delete Customer Personal Data from the live Service. Copies in backups will be deleted as backups age out, currently within about [30] days, and will remain protected by this DPA until then.
BotBid may keep Customer Personal Data where the law requires it, and will keep such data confidential and process it only for that purpose.
11. Audits
On written request, no more than once a year, BotBid will provide information reasonably needed to show compliance with this DPA, such as a summary of its security program, completed security questionnaires, and any third-party audit reports it has.
If that information is not enough to show compliance, or if a regulator requires it, Customer may conduct a reasonable on-site or remote audit, at its own cost, on at least [30] days notice, during business hours, in a way that does not unreasonably disrupt BotBid's operations or compromise other customers' data. Auditors must sign a confidentiality agreement. The parties will agree on scope in advance.
12. US state law service provider terms
When BotBid acts as a service provider or processor under Applicable Privacy Law, BotBid will not:
- sell or share Customer Personal Data, as those terms are defined in Applicable Privacy Law;
- retain, use or disclose Customer Personal Data for any purpose other than the business purposes set out in the Agreement, including for any commercial purpose other than providing the Service;
- retain, use or disclose Customer Personal Data outside the direct business relationship between Customer and BotBid;
- combine Customer Personal Data with personal information it receives from other sources or customers, except as allowed by Applicable Privacy Law;
- use Customer Personal Data to train shared AI models.
13. Further service provider commitments
BotBid will comply with its obligations under Applicable Privacy Law and give the same level of privacy protection the law requires of Customer. BotBid will notify Customer if it determines it can no longer meet these obligations. Customer may take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data. BotBid certifies that it understands and will comply with the restrictions in this DPA.
14. International transfers
BotBid stores and processes Customer Personal Data in the United States, in its primary hosting region in the eastern United States (US-East). [If Customer Personal Data subject to the laws of another country is transferred, the parties will add the transfer terms required by those laws in a separate schedule.]
15. Liability
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.
Customer remains responsible for its own configuration of the Service, including roles, permissions, automatic sending settings, and what information it chooses to upload, and BotBid is not liable for processing that follows those settings.
16. Order of precedence
If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls. In all other respects, the Agreement controls. Nothing in this DPA reduces either party's obligations under Applicable Privacy Law.
17. Annex 1: details of processing
Subject matter and duration: providing the Service under the Agreement, for the term of the Agreement plus the deletion period in Section 10.
Nature and purpose: hosting, storage, organization, analysis, AI-assisted drafting and summarizing, email sending at Customer's direction, backup, support and security of Customer Data, so that Customer can find, plan, write and track public bids.
- Categories of individuals: Customer's employees, owners, signers and contractors; Customer's references and past-project contacts; agency buyers and contacts named in public notices or correspondence; suppliers and subcontractors.
- Categories of personal information: names, job titles, work contact details, signatures, professional licenses and certifications, past-project details, correspondence, portal login credentials, and any other personal information Customer chooses to upload.
- Sensitive information: Customer may upload tax identification numbers, signatures and login credentials. These are protected by additional encryption and access controls.
- Frequency: continuous, for the term of the Agreement.
- Location of processing: the United States, primary hosting region US-East (eastern United States).
- Retention: as set out in Section 10.
18. Annex 2: security measures
BotBid maintains at least the following measures:
- Encryption in transit using current transport security for all connections to the Service.
- Encryption at rest for databases, files and backups, with a separate encryption key for each customer workspace, and a second, separate key for stored portal credentials and signatures.
- Per-customer data separation enforced at several layers, with automated tests that check one customer cannot reach another's data before any release.
- Access control based on roles and least privilege; required two-step sign-in for owners, signers and anyone with access to stored credentials; session management with sign out from all devices.
- Audit logging of sign-ins, administrative actions, credential reveals and signature uses, kept append-only and visible to the customer.
- Strict limits on staff access, with recorded approvals for sensitive access and notice to the customer where appropriate.
- Encrypted backups taken daily, kept on a rolling schedule, with regular restore tests.
- Vulnerability management, including timely patching, secure coding practices, protection against common web attacks, file-type checks and isolated processing of uploaded documents.
- Removal of secret values before any text is sent to AI models, and records of what was sent for a limited period.
- Monitoring and alerting for availability, errors and suspicious activity, and a documented incident response process.
- Confidentiality commitments and privacy training for personnel.