This addendum is between the customer ("Business") and WS SOLUTIONS LLC ("Service Provider") and applies to personal information processed through OperableWeb on the Business's behalf. It is written to meet the contract requirements of Cal. Civ. Code § 1798.100(d) and § 1798.140(ag), Cal. Code Regs. tit. 11 § 7051, and the processor-contract provisions of the other US state privacy laws (e.g. Va. Code § 59.1-579, Colo. Rev. Stat. § 6-1-1305).
Service Provider processes personal information only to provide the service the Business configures: recording consent choices, receiving and fulfilling consumer privacy requests, maintaining the Business's data inventory and related records. Limited and specified business purpose: providing the service under the Terms.
Service Provider will not: (a) sell or share the personal information; (b) retain, use or disclose it for any purpose other than the business purpose, including any commercial purpose; (c) retain, use or disclose it outside the direct business relationship; (d) combine it with personal information received from others, except as permitted by law.
Service Provider processes on the Business's documented instructions (the configuration and actions in the service), complies with applicable US state privacy laws, provides the same level of privacy protection they require, and will notify the Business if it can no longer meet its obligations. The Business may take reasonable steps to stop and remediate unauthorized use.
Everyone processing the data is bound by confidentiality. Service Provider maintains reasonable security measures appropriate to the nature of the data, including encryption in transit and at rest for credentials and request findings, role-based access, and audit logging.
Service Provider uses the sub-processors listed at /legal/subprocessors under written contracts with equivalent obligations, and gives at least 30 days' notice of changes so the Business can object.
Service Provider assists the Business with consumer requests, data protection assessments and regulator inquiries, using the service's features.
Service Provider makes available information reasonably necessary to demonstrate compliance and allows reasonable assessments no more than once a year, or after an incident.
Service Provider notifies the Business without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting the Business's personal information.
At the end of the service, Service Provider deletes the personal information within 30 days (exports remain available until then), unless retention is required by law.
Last updated 2026-10-30 · Terms · Privacy · DPA · Sub-processors