Data Processing Addendum

This Data Processing Addendum is part of the Terms of Service between Gearbox Technologies LLC and the BayNerve customer. It applies when Gearbox Technologies LLC processes personal information in customer workspace data on the customer's behalf.

For that processing, the customer is the business or controller and Gearbox Technologies LLC is the service provider or processor, as those terms or comparable terms are defined by applicable United States privacy law. Each party remains responsible for the obligations applicable to its own role.

For account administration, service security, subscriptions, support, and direct business operations, Gearbox Technologies LLC can process personal information for its own disclosed business purposes as described in the Privacy Policy.

The customer instructs Gearbox Technologies LLC to process customer personal information to provide, secure, maintain, support, and improve the contracted service; provide user-invoked features and integrations; comply with documented customer instructions; and comply with law.

Gearbox Technologies LLC will not sell customer personal information, use it for cross-context behavioral advertising, or retain, use, or disclose it outside the direct business relationship except as permitted by this Addendum, the Terms, documented instructions, or applicable law.

If an instruction would violate applicable law, Gearbox Technologies LLC may decline it and will inform the customer unless law prohibits notice.

The subject matter is the operation of BayNerve. Processing continues for the customer's use of the service and any reasonable transition, backup, security, dispute, or legally required retention period.

Processing can include collection, storage, organization, retrieval, display, transmission, analysis, transcription, generation, export, restriction, deletion, and other operations needed for enabled features.

Data subjects can include a customer's personnel, vendors, business contacts, vehicle owners, customers, prospective customers, and individuals identified in shop records. Data can include contact details, account and employment-related information, vehicle and service records, messages, consent and approval records, financial transaction records, device and security data, photos, videos, audio, documents, and inferences or drafts generated from that information.

Gearbox Technologies LLC will require personnel authorized to process customer personal information to protect its confidentiality and use it only for their assigned responsibilities.

Gearbox Technologies LLC will maintain safeguards appropriate to the nature of the service and information, taking into account available technology, implementation cost, processing context, and risk. Current safeguards are summarized in the Privacy Policy and internal security documentation and can change as the service evolves.

The customer is responsible for secure configuration, appropriate user access, endpoint security, lawful instructions, and information it downloads or transfers outside BayNerve.

The customer gives general authorization for Gearbox Technologies LLC to use service providers to process customer personal information. The current provider and external-service list is published in the Legal Center.

Gearbox Technologies LLC will impose data-protection obligations appropriate to the services a provider performs. Gearbox Technologies LLC remains responsible for its own obligations under this Addendum when a service provider performs processing on its behalf.

A customer with a reasonable data-protection objection to a newly listed provider may contact Gearbox Technologies LLC. The parties will work in good faith on a commercially reasonable solution, which can include disabling the affected optional feature or ending it under the Terms if no reasonable alternative is available.

Taking into account the nature of processing and information available, Gearbox Technologies LLC will provide reasonable assistance for verified data-subject requests, security obligations, impact assessments, consultations with regulators, and customer compliance information required by applicable law.

If Gearbox Technologies LLC receives a request concerning customer-controlled workspace data, it can direct the requester to the customer and notify the customer when legally permitted. Gearbox Technologies LLC will not independently respond on the customer's behalf unless instructed or legally required.

The customer is responsible for deciding whether a request is valid, what exceptions apply, and what response is required.

Gearbox Technologies LLC will notify the customer without unreasonable delay after determining that a security incident resulted in unauthorized acquisition of or access to customer personal information. Gearbox Technologies LLC will provide notice whether or not it has yet been determined that the incident independently requires notice to an individual, regulator, or other third party under applicable law. Where applicable law imposes a shorter or specific deadline on Gearbox Technologies LLC in its role as a service provider, processor, or third-party agent, Gearbox Technologies LLC will follow that deadline.

Gearbox Technologies LLC will take reasonable steps to contain and investigate an incident and will provide information reasonably needed for the customer to meet applicable notice duties. Notice timing and content will account for available information, investigation needs, security, law-enforcement restrictions, and the parties' legal roles. Notice is not an admission of fault or liability.

If Gearbox Technologies LLC receives a legally binding request for Customer personal information, it will direct the requester to the Customer when appropriate and will notify the Customer before disclosure unless prohibited by law or necessary to address an emergency.

Gearbox Technologies LLC will assess the request and disclose only information it reasonably determines is required. The Customer remains responsible for legal requests it receives as controller or business.

During an active account, authorized users can use available controls to export supported data or remove selected records. On a verified customer request after service ends, Gearbox Technologies LLC will delete or return customer personal information when reasonably feasible, unless retention is required or permitted for security, financial records, disputes, backups, service integrity, or law.

The product does not currently provide one-click workspace deletion, and CSV exports do not include the underlying binary media files. Customers that need broader return or deletion assistance must contact support before access ends.

On reasonable written request, Gearbox Technologies LLC will provide information reasonably necessary to demonstrate compliance with this Addendum, subject to confidentiality, security, privilege, and third-party restrictions.

If applicable law requires an audit and the provided information is insufficient, the parties will agree on a proportionate review that avoids unreasonable disruption, duplication, access to another customer's data, or disclosure of sensitive security information. The customer bears its audit costs unless applicable law requires otherwise.

To the extent an applicable United States state privacy law requires specific controller-to-processor or business-to-service-provider terms, the Customer appoints Gearbox Technologies LLC to process personal information for the limited business purposes in this Addendum. Gearbox Technologies LLC will provide the same level of privacy protection required for its role, notify the Customer if it can no longer meet an applicable obligation, and permit reasonable steps required by law to stop and remediate unauthorized use.

Gearbox Technologies LLC will not combine Customer personal information with personal information received from another customer or from its own consumer interactions except as permitted by applicable law to provide the Service, protect security, or perform the business purposes in this Addendum.

This Addendum is intended to support United States business-to-business data processing. It does not, by itself, represent that a particular privacy law applies to either party or that BayNerve is suitable for regulated data outside the verified product scope.

If this Addendum conflicts with the Terms on processing customer personal information, this Addendum controls. The liability provisions in the Terms apply to this Addendum unless applicable law prohibits that result.

Data-processing questions may be sent to info@gearboxtechnologies.com.