This Data Processing Addendum (“DPA”) supplements the Cogs Terms of Service or another written agreement between Spear America LLC d/b/a Cogs (“Cogs”) and the business customer identified in the applicable account, order, or agreement (“Customer”). It applies to the extent Cogs processes Customer Personal Data on behalf of Customer in providing the Service.
1. Definitions
Applicable Data Protection Law means privacy and data-protection laws applicable to the processing covered by this DPA, including applicable U.S. state comprehensive privacy laws and, where expressly applicable to a Customer, relevant non-U.S. data-protection laws.
Customer Personal Data means Personal Data contained in Customer Data that Cogs processes on Customer's behalf in providing the Service. It excludes personal information Cogs processes independently for its own account administration, billing, security, legal compliance, communications, and similar business operations where Cogs determines the purposes and means of processing.
Personal Data, Controller, Processor, Business, Service Provider, Contractor, Consumer, and Sale have the meanings assigned by Applicable Data Protection Law.
2. Roles and Customer Instructions
To the extent Applicable Data Protection Law distinguishes controllers/businesses from processors/service providers/contractors, Customer acts as the Controller or Business for Customer Personal Data and Cogs acts as the Processor, Service Provider, or Contractor, as applicable.
Cogs will process Customer Personal Data only on Customer's documented instructions, including the agreement, this DPA, Customer's configuration and use of the Service, authorized integrations, support requests, and additional lawful instructions agreed by the parties, unless applicable law requires otherwise.
Customer instructs Cogs to process Customer Personal Data to host, import, organize, categorize, reconcile, analyze, report, secure, support, maintain, and otherwise provide the Service and Customer-selected integrations and AI Features.
Customer also instructs Cogs to maintain accounting records and related audit/provenance information according to the retention configuration and policy described in the agreement, subject to Customer's lawful deletion/return instructions and Applicable Data Protection Law.
3. Purpose Limitation; No Sale or Behavioral Advertising
Cogs will not sell Customer Personal Data or share Customer Personal Data for cross-context behavioral advertising or targeted advertising.
Cogs will not retain, use, or disclose Customer Personal Data outside the business purposes and Customer instructions described in the agreement and this DPA except as permitted or required by Applicable Data Protection Law.
Cogs may use Customer Personal Data to improve or personalize the Service for that Customer where consistent with Customer's instructions.
For generalized or cross-customer model improvement, Cogs' policy is to use information that has been aggregated, deidentified, or otherwise transformed so that it is not reasonably linked to Customer or an identifiable individual, unless Customer separately authorizes another use or Applicable Data Protection Law permits it. Cogs will not combine Customer Personal Data received in its processor/service-provider role with personal information received from or on behalf of another person except where Applicable Data Protection Law permits such combination.
4. Customer Responsibilities
Customer will comply with Applicable Data Protection Law, provide required notices, obtain required permissions or lawful bases, and ensure that its instructions to Cogs are lawful. Customer is responsible for the accuracy and lawfulness of Customer Personal Data and for determining whether the Service is appropriate for the data Customer chooses to process.
5. Confidentiality
Cogs will ensure that personnel authorized to process Customer Personal Data are subject to appropriate confidentiality obligations and receive access only as reasonably necessary for their role.
6. Security Measures
Taking into account the nature, scope, context, and purposes of processing and the risks to individuals, Cogs will maintain reasonable administrative, technical, and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
Those measures are expected to include, as appropriate to Cogs' then-current architecture:
- access controls and authorization based on job responsibilities;
- authentication controls for administrative and production systems;
- encrypted transport for data transmitted over public networks;
- reasonable protections for stored secrets and credentials;
- logging, monitoring, and security-event investigation;
- backup and recovery practices appropriate to the Service;
- vulnerability and patch-management processes appropriate to hosted systems and dependencies;
- incident-response procedures; and
- vendor/subprocessor review appropriate to the sensitivity of processing.
This section is a contractual security baseline, not a representation that Cogs has obtained a particular certification unless Cogs expressly states so in writing.
7. Subprocessors
Customer provides general authorization for Cogs to engage subprocessors to process Customer Personal Data. Cogs will require each subprocessor to be bound by written data-protection obligations appropriate to the processing and consistent with Cogs' obligations under this DPA to the extent required by Applicable Data Protection Law.
Cogs maintains a current Subprocessors List linked from its legal pages. Where Applicable Data Protection Law or an agreed enterprise contract requires notice of a new subprocessor, Cogs will provide reasonable notice through the Subprocessors page, the Service, email, or another agreed method.
Customer may object to a new subprocessor on reasonable and documented data-protection grounds within 15 days after applicable notice. The parties will work in good faith toward a commercially reasonable resolution. If no reasonable alternative is available, Cogs may permit Customer to terminate the affected portion of the Service without penalty as the exclusive remedy for the objection, subject to any separately negotiated agreement.
Cogs remains responsible for its obligations under this DPA notwithstanding use of subprocessors, subject to the limitations in the governing agreement.
8. Consumer / Data-Subject Requests
Taking into account the nature of processing, Cogs will provide reasonable assistance to Customer to respond to verified requests by individuals to exercise rights under Applicable Data Protection Law where Customer cannot reasonably fulfill the request without Cogs' assistance.
If Cogs receives a request relating primarily to Customer Personal Data for which Customer is the Controller/Business, Cogs may refer the requester to Customer and, where appropriate, notify Customer. Cogs will not independently respond to the substance of the request except as instructed by Customer or required by law.
9. Security Incidents
Cogs will notify Customer without undue delay after becoming aware of a confirmed breach of security involving Customer Personal Data for which Applicable Data Protection Law requires processor/service-provider notification.
To the extent reasonably available, notice will include information necessary for Customer to understand the nature of the incident, categories of affected information, likely consequences, and measures taken or proposed. Information may be provided in phases as the investigation develops.
Notification is not an admission of fault or liability.
10. Assistance with Compliance
Taking into account the nature of processing and information available to Cogs, Cogs will provide reasonable assistance required by Applicable Data Protection Law with Customer's obligations concerning security, qualifying breach notifications, data-protection assessments, and consultations with regulators, where the relevant obligation relates to Cogs' processing of Customer Personal Data.
Unless required by law or caused by Cogs' breach of this DPA, Customer will reimburse Cogs for materially burdensome assistance requested outside the ordinary functionality of the Service at mutually agreed rates.
11. Government and Legal Requests
Unless prohibited by law, Cogs will notify Customer of a legally binding request specifically seeking Customer Personal Data where Cogs reasonably determines Customer should respond directly. Cogs may challenge requests it reasonably believes are unlawful, invalid, or overbroad where appropriate.
12. Return, Deletion, and Retention
Upon termination or Customer's lawful instruction, Cogs will delete or return Customer Personal Data as required by Applicable Data Protection Law, subject to:
- applicable legal-retention obligations;
- documented Customer instructions or retention configuration;
- legal holds and preservation of claims;
- security/fraud-prevention records reasonably necessary to protect Cogs and customers; and
- backup copies that are isolated from ordinary use and overwritten in the ordinary backup lifecycle.
Cogs' standard Service policy contemplates seven-year retention for accounting records, but that policy is not a claim that Applicable Data Protection Law always permits Cogs to retain Customer Personal Data against a Controller's lawful deletion instruction. Where a mandatory processor-deletion rule applies and no lawful retention basis exists, Cogs will follow that rule.
Where personal identifiers can be removed or deidentified without impairing required accounting-record integrity, provenance, auditability, security, or a lawful retention purpose, Cogs may scrub or deidentify them in accordance with Customer instructions and Cogs' retention processes.
13. Audits and Information
Cogs will make information reasonably necessary to demonstrate compliance with this DPA available to Customer, which may include relevant policies, summaries, questionnaires, third-party reports, or certifications if available.
If Applicable Data Protection Law requires an audit right and available materials are insufficient, Customer may conduct or appoint an independent qualified auditor to conduct a reasonable audit no more than once in any 12-month period, unless a material security incident or regulator requires otherwise. Audits must be subject to reasonable confidentiality, security, scope, timing, and cost controls and must not expose other customers' data, Cogs source code, or information that would create a security risk.
Where permitted by Applicable Data Protection Law, Cogs may satisfy an audit requirement through a qualified independent third-party assessment or report.
14. U.S. State Privacy Terms
To the extent applicable U.S. state privacy law treats Cogs as a Service Provider, Contractor, or Processor, Cogs agrees that it will:
- process Customer Personal Data only for the limited and specified purposes set out in the agreement, this DPA, and Customer's lawful instructions;
- not sell Customer Personal Data or share it for cross-context behavioral advertising or targeted advertising;
- comply with applicable restrictions on retaining, using, disclosing, or combining Customer Personal Data;
- provide the same level of privacy protection required of the applicable processor/service-provider role;
- notify Customer if Cogs determines it can no longer meet an applicable statutory obligation, where required by law;
- permit Customer to take reasonable and appropriate steps required by law to help ensure Cogs uses Customer Personal Data consistently with Customer's obligations;
- permit Customer, where required by law, to take reasonable steps to stop and remediate unauthorized use of Customer Personal Data; and
- flow down applicable obligations to subprocessors.
Nothing in this section authorizes Cogs to process Customer Personal Data in a way prohibited by Applicable Data Protection Law.
15. International Transfers
If Customer Personal Data subject to legally restricted international-transfer rules is transferred internationally, the parties will use a legally recognized transfer mechanism where required. If EU, EEA, UK, or Swiss transfer terms are needed for a particular Customer, the parties may incorporate the applicable standard contractual clauses, UK addendum, or another approved mechanism through an order form or supplemental addendum.
This DPA does not by itself represent that EU/UK standard contractual clauses are executed unless they are expressly incorporated for the relevant Customer.
16. Processing Details
Subject matter
Provision of Cogs business accounting and bookkeeping software and customer-selected integrations.
Duration
For the term of the Service plus applicable retention, backup, legal-hold, and deletion periods.
Nature and purpose of processing
Hosting, importing, storing, organizing, categorizing, reconciling, analyzing, reporting, securing, supporting, transmitting, and otherwise processing information to provide the Service, AI Features, integrations, and related support.
Categories of data subjects
Customer's Authorized Users and personnel; Customer's customers; vendors; contractors; accountants/advisers; transaction counterparties; and other individuals whose information appears in Customer's business or accounting records.
Categories of Customer Personal Data
Identifiers and contact details; business relationship information; account/user information; transaction and financial-account information; order and commerce information; accounting records; payment/refund information; tax/shipping/discount information; communications; usage/security information; and other Personal Data Customer chooses to submit or connect.
Sensitive data
Customer Personal Data may include financial-account information or other information treated as sensitive under Applicable Data Protection Law. Customer should not submit sensitive information that is unnecessary for the intended accounting workflow and remains responsible for determining whether additional legal requirements apply.
Frequency
Continuous or as initiated by Customer and Authorized Users during the subscription term and applicable retention period.
17. Conflict; Liability; Governing Agreement
If this DPA conflicts with the governing agreement regarding processing of Customer Personal Data, this DPA controls to the extent of the conflict. Otherwise, the governing agreement, including its limitations of liability, governing-law, and dispute-resolution provisions, applies to this DPA unless Applicable Data Protection Law requires otherwise.
Operator: Spear America LLC, 1021 E Lincolnway, Ste 6344, Cheyenne, Wyoming 82001, United States
Service: Cogs (GetCogs.ai)
Legal contact: legal@getcogs.ai