Data Processing Addendum

Effective date: September 9, 2026 · Version v2026-09-09 · Last updated: September 9, 2026

This Data Processing Addendum (the “DPA”) forms part of the Cache CRM Terms of Service between Cache CRM, a product of SoCal Cleaner, LLC (“Cache”, “we”, “us”), and the Customer that operates a Workspace (“Customer”, “you”). It applies automatically when you accept the Terms — no separate signature is required. If you need a countersigned copy for your own records, email support@cachecrm.com.

1. Roles of the parties

With respect to personal information about your own customers, staff and contacts that you put into your Workspace (“Customer Personal Data”):

• You are the controller, and the business under the California Consumer Privacy Act as amended by the CPRA. You decide what is collected, from whom, and why, and you are responsible for having a lawful basis and the necessary consents.
• Cache is the processor, and a service provider under the CCPA. We process Customer Personal Data only to provide the Service to you.

Cache is an independent controller of the account information described in Section 1 of the Privacy Policy — the names, email addresses and roles of the people who use Cache, and the acceptance, billing and security records attached to them. That data is governed by the Privacy Policy, not by this DPA.

2. Subject matter, duration, nature and purpose

• Subject matter. Provision of the Cache CRM platform: customer relationship management, scheduling, SMS and email messaging, calling, estimating, invoicing and payment collection, automations, reporting and search.
• Duration. The term of the Terms of Service, plus the retention windows set out in Section 8 of this DPA and Section 7 of the Privacy Policy.
• Nature and purpose. Hosting, storage, retrieval, indexing, transmission, display, backup, deletion, and the automated processing your Workspace configures — sending messages, running automations, calculating metrics.
• Categories of data subjects. Your own customers and prospects; your employees, contractors and crew members; anyone who contacts you and whose record you create.
• Categories of personal data. Identifiers (name, phone, email); service and billing addresses; commercial records (leads, jobs, estimates, invoices, payments, payment method tokens); the contents of SMS and email messages and, where you enable recording, call recordings and transcripts; opt-in and opt-out records; and the free-text notes your team writes.
• Special categories. None. Section 4.2 of the Terms prohibits putting protected health information, financial-institution data covered by the Gramm-Leach-Bliley Act, government identification numbers, biometric identifiers or data about minors into the Service.

3. Our obligations as processor

• Documented instructions. We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, the configuration choices you make in the application, and any further written instruction you give us. If we believe an instruction breaks the law, we will tell you.
• Confidentiality. Every person we authorize to process Customer Personal Data is bound by a duty of confidentiality that survives the end of their engagement, and access is limited to those who need it to operate or support the Service.
• Security. We maintain the technical and organizational measures in Section 4.
• Sub-processors. As set out in Section 5.
• Assistance. We assist you with data-subject requests (Section 6), with security-incident notification (Section 7), and with data-protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to us.
• Deletion or return. As set out in Section 8.
• Demonstrating compliance. As set out in Section 9.

4. Security measures

We maintain the following measures, and will not materially reduce them during the term:

• Encryption in transit — TLS on every connection between clients, our servers and our sub-processors.
• Encryption at rest — provided by our infrastructure providers for databases, file storage and backups.
• Tenant isolation — every record is scoped to a Workspace, and database security rules enforce, on the server, that a signed-in user can read and write only inside a Workspace they belong to. Cross-Workspace access is denied by default.
• Access controls — role-based permissions inside each Workspace; production access limited to the small number of personnel who need it; secrets held server-side only and never shipped to a browser or mobile app.
• Logging — privileged actions such as data exports, record merges, API credential changes and administrative operations are recorded, as are server request and error logs.
• Backups — regular encrypted backups, cycled on a rolling schedule, with residual copies of deleted data purged within 90 days of deletion.
• Payment data — card data is handled exclusively by Stripe, a PCI-DSS Level 1 service provider. Cache stores tokens and identifiers, never card numbers.
• Secure development — changes are reviewed before release, dependencies are kept current, and credentials are held in a managed secret store.

We do not hold a SOC 2 report or other third-party security certification today. Section 9 describes what we can give you instead.

5. Sub-processors

You authorize us to engage the sub-processors published at cachecrm.com/subprocessors, which is incorporated into this DPA by reference and lists each provider's purpose, the data it receives and where it processes it. Optional sub-processors on that list are engaged only for Workspaces that switch the relevant integration on.

Change notice. We will give at least 30 days' notice before a new sub-processor starts processing Customer Personal Data. Email support@cachecrm.com to be added to the notice list. You may object in writing within those 30 days on reasonable data-protection grounds; we will work with you to find an alternative, and if we cannot, you may terminate the affected part of the Service without penalty and receive a refund of any prepaid unused fees.

We impose data-protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain liable to you for a sub-processor's performance.

6. Assistance with data-subject requests

The application lets you find, correct, export and delete most records yourself; that is the fastest route for a request from one of your customers. Where a request needs our help, email support@cachecrm.com and we will assist you in responding — including access, correction, deletion, portability and opt-out requests — taking into account the nature of the processing. We complete such requests within 30 days. If a data subject contacts us directly about data in your Workspace, we will not respond substantively; we will tell them to contact you and forward the request to you.

7. Security incidents

We will notify you of a personal data breach affecting Customer Personal Data without undue delay and in any event within 72 hours of confirming the breach. The notice will describe, to the extent known: the nature of the breach and the categories and approximate number of records and data subjects involved; the likely consequences; the measures we have taken or propose to take; and a contact point for more information. We will provide further information as the investigation progresses and will cooperate reasonably with your own notification obligations. Notice will be sent to the administrator email addresses on your Workspace, so keep them current.

8. Deletion and return

You may export Customer Personal Data at any time while your Workspace is active. On termination we make it available for export for 30 days. After that window we delete or de-identify Workspace content within 60 days, and residual copies age out of encrypted backups within 90 days of deletion. We keep only what we must to comply with legal, tax or telecommunications obligations — principally payment records for 7 years, and opt-out records indefinitely, because both of us need to be able to prove that a number asked not to be contacted.

9. Audits

On written request, no more than once in any 12-month period, we will provide the information reasonably necessary to demonstrate compliance with this DPA: a written response to your security questionnaire, a description of our technical and organizational measures, and any third-party audit or certification report we hold at that time. We do not currently hold a SOC 2 or ISO 27001 report; if we obtain one, it will be made available under this section in place of a questionnaire. On-site audits are not offered. Where a supervisory authority requires more, we will discuss a proportionate alternative in good faith. You must treat anything we give you under this section as our confidential information, and you bear your own costs.

10. Location of processing

Cache and its sub-processors store and process Customer Personal Data in the United States. The Service is offered to customers located in the United States, and we do not offer EU or UK Standard Contractual Clauses today. If you require them, contact support@cachecrm.com before you rely on the Service for personal data subject to those regimes.

11. California service-provider terms

With respect to Customer Personal Data, Cache is a service provider under Cal. Civ. Code section 1798.140(ag), and:

• We do not sell Customer Personal Data and do not share it for cross-context behavioral advertising, as those terms are defined by the CPRA. No consideration passes between the parties for the personal information itself.
• We do not retain, use or disclose Customer Personal Data for any purpose other than performing the Service specified in the Terms, or as otherwise permitted by the CCPA — including retaining, using or disclosing it for a commercial purpose outside our direct business relationship with you.
• We do not combine Customer Personal Data with personal information received from, or on behalf of, another person, or collected from our own interactions with a consumer, except as permitted by Cal. Civ. Code section 1798.140(ag)(1) and its regulations.
• We certify that we understand these restrictions and will comply with them.
• You may take reasonable and appropriate steps under Section 9 to confirm that we use Customer Personal Data consistently with your obligations, and to stop and remediate any unauthorized use if it occurs.
• We will tell you if we determine we can no longer meet these obligations.

12. Liability, precedence and term

Each party's liability under this DPA is subject to the limitations and exclusions in Section 13 of the Terms of Service, and those limits apply in the aggregate across the Terms and this DPA. Nothing in this DPA raises or removes them.

If this DPA conflicts with the Terms on the subject of data protection, this DPA controls. In all other respects the Terms control. This DPA takes effect when you accept the Terms and continues for as long as we process Customer Personal Data for you.

13. Contact

Questions about this DPA, sub-processor notices, security questionnaires and breach reports:

Related: Terms of Service · Privacy Policy · SMS Terms · Sub-processors