Customer Data Processing & Data Security Addendum
1. Purpose
This Data Processing & Data Security Addendum (“DPA”) establishes responsibilities regarding Customer Data processed through Cheetah Smart ERP and forms part of the Terms of Service.
2. Roles
Customer determines what business information is entered into the Service and why it is used. Cheetah processes Customer Data primarily to provide, maintain, secure, support, and improve the Service.
Customer is responsible for determining whether its use of the Service complies with laws applicable to its business and data.
3. Customer Ownership
Customer retains ownership of Customer Data. Nothing in this DPA transfers ownership of Customer Data to Cheetah.
4. Permitted Processing
Cheetah may process Customer Data for hosting, storage, retrieval, transmission, backup, security, technical support, troubleshooting, Service operation, maintenance, fraud prevention, performance monitoring, analytics, product development, and Service improvement.
Cheetah may use service providers and subprocessors as reasonably necessary to perform these activities.
5. Confidentiality
Cheetah will require personnel and contractors with access to Customer Data to maintain appropriate confidentiality obligations.
6. Security Measures
Cheetah will implement commercially reasonable security measures appropriate to the Service, which may include encryption in transit, encryption at rest where supported, access controls, authentication controls, password protection, role-based permissions, monitoring, backup procedures, security updates, restricted administrative access, logging, and incident-response procedures.
Security measures may evolve as technology, threats, and the Service change.
7. Payment Information
Cheetah’s application is not intended to store complete credit-card numbers, CVV codes, or bank-account credentials.
Payment information is processed through designated payment providers. Cheetah may retain payment-related identifiers and limited billing information necessary to operate subscriptions and billing.
8. Data Segregation
Cheetah will use reasonable technical measures designed to prevent one customer’s account from accessing another customer’s Customer Data.
No security measure can guarantee that unauthorized access will never occur.
9. Security Incidents
If Cheetah determines that a security incident materially affecting Customer Data has occurred, Cheetah will take reasonable steps to investigate, contain, and remediate the incident.
Where required by applicable law, Cheetah will provide notice to affected customers or governmental authorities.
Customer is responsible for promptly notifying Cheetah of suspected compromise involving Customer accounts, credentials, devices, integrations, or Customer Data.
10. Data Export
Cheetah provides data-export or download functionality through available administrative tools. Customer is responsible for using those tools to maintain copies of critical business information.
Cheetah does not guarantee that every item of information can be exported in every circumstance or format.
11. Data Retention and Deletion
Following termination or expiration, Customer Data may remain available for thirty (30) days for Customer export through available administrative download tools, unless a different period is expressly stated by Cheetah.
After that period, Customer Data may be deleted. Backup copies may remain temporarily until overwritten through Cheetah’s normal backup cycle.
Cheetah has no obligation to maintain Customer Data indefinitely after termination.
12. Third-Party Providers
Cheetah may engage third-party infrastructure and service providers for hosting, storage, payment processing, communications, security, analytics, monitoring, support, and related services.
Cheetah may permit such providers to process Customer Data only as reasonably necessary to provide their services to Cheetah, subject to appropriate contractual or operational safeguards where applicable.
Third-party providers may have their own terms, policies, security practices, and limitations.
13. Customer Responsibilities
Customer is responsible for determining what information should be entered into Cheetah, obtaining appropriate permissions, maintaining accurate information, configuring user permissions, protecting credentials, complying with applicable laws, responding to data-subject or customer requests applicable to Customer’s business, and maintaining independent records of critical information.
14. No Absolute Security Guarantee
Customer acknowledges that no electronic system can guarantee absolute security.
Cheetah does not guarantee that Customer Data can never be accessed, lost, corrupted, altered, unavailable, or disclosed as a result of circumstances beyond Cheetah’s reasonable control or despite reasonable safeguards.
15. No Specialized Regulatory Commitment Unless Agreed
Unless Cheetah expressly agrees otherwise in a separate written agreement, this DPA does not represent that the Service satisfies every regulatory, industry-specific, contractual, or customer-specific security or data-processing requirement applicable to Customer.
Customer is responsible for determining whether the Service is appropriate for the information Customer chooses to process through it.
16. Governing Documents
If there is a conflict between this DPA and the Terms of Service concerning a specific data-processing issue, this DPA controls solely with respect to that specific issue.
All disclaimers, limitations of liability, exclusions of damages, indemnification provisions, and other protections in the Terms of Service remain applicable to this DPA unless expressly stated otherwise.