Legal
California CCPA Addendum
This Addendum modifies the watchtower Data Processing Agreement ("DPA") and Privacy Policy for personal information of California consumers under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively "CCPA").
It applies to Customers established in California or whose end users include California residents.
1. Application
This Addendum applies in addition to the DPA. To the extent of any conflict between this Addendum and the DPA, this Addendum controls solely with respect to California matters.
2. Roles under the CCPA
For data covered by this Addendum, the parties' CCPA roles are:
- Customer is a business as defined in Cal. Civ. Code Section 1798.140(d).
- Watchtower is a service provider as defined in Cal. Civ. Code Section 1798.140(ag).
Watchtower processes Personal Information on Customer's behalf for the business purposes set out in the Terms of Service. Watchtower shall not:
- Sell or share Personal Information.
- Retain, use, or disclose Personal Information for purposes other than the business purposes specified in the contract.
- Retain, use, or disclose Personal Information outside the direct business relationship between watchtower and Customer.
- Combine Personal Information received from Customer with Personal Information from any other source except as expressly permitted in the Terms.
Watchtower certifies that it understands the restrictions in this Section and shall comply with them.
3. Sale and sharing
Watchtower does NOT sell, share, or otherwise transfer Personal Information for cross-context behavioural advertising. The Sub- Processor list on our Sub-processors page reflects this: no advertising network is engaged.
4. Consumer rights
Watchtower assists Customer in fulfilling consumer requests under the CCPA:
- Right to know what categories of Personal Information are collected, used, disclosed.
- Right to access the specific pieces of Personal Information collected about the consumer.
- Right to delete Personal Information, subject to the exceptions in Cal. Civ. Code Section 1798.105(d) (including the service-provider exception for security data necessary for watchtower to maintain the service).
- Right to correct inaccurate Personal Information.
- Right to opt-out of sale or sharing (not applicable, as watchtower does not sell or share).
- Right to limit use of sensitive personal information (not applicable, as watchtower does not process sensitive Personal Information by design).
The audit-chain carve-out in DPA Section 11 applies to deletion requests in California as elsewhere. The CCPA's service-provider exception in Section 1798.105(d)(8) is the legal basis under which watchtower preserves audit-chain entries necessary to maintain the security of the service.
5. Discrimination
Watchtower does not discriminate against consumers for exercising their CCPA rights. The watchtower service is provided to Customer's authorised users on the basis Customer specifies; the service does not vary based on a consumer's exercise of any right.
6. Sensitive personal information
Watchtower does not collect sensitive personal information as defined in Cal. Civ. Code Section 1798.140(ae) by design. If sensitive personal information is incidentally collected (e.g. through a Microsoft Graph response that includes a precise geolocation), the limitation on use described in this Addendum applies.
7. Notification of suspected non-compliance
Watchtower shall notify Customer if watchtower determines that it can no longer meet its obligations under the CCPA. Customer may take reasonable and appropriate steps to stop and remediate unauthorised use of Personal Information.
8. References
This addendum modifies the watchtower base legal pack (Data Processing Agreement, Privacy Policy, sub-processor list).