Loading…
Version 1.0 · Last updated: May 12, 2026 · Effective: May 12, 2026
This Data Processing Addendum (the "DPA") forms part of and is incorporated into the BHmetrics Terms of Service (the "Agreement") between you ("Customer", "you", "Controller") and Choclement LLC, doing business as BHmetrics("Choclement", "we", "BHmetrics", "Processor"). This DPA governs the Processing of Personal Data by Choclement on Customer's behalf in the course of providing the Service (as defined in the Agreement).
This DPA reflects the parties' agreement on the Processing of Personal Data in compliance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the United Kingdom Data Protection Act 2018 and UK GDPR ("UK GDPR"), the Swiss Federal Act on Data Protection ("FADP"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other applicable data-protection laws (collectively, "Data Protection Laws").
By using the Service after the effective date of this DPA, Customer accepts and agrees to be bound by this DPA. To request a counter-signed copy, email [email protected].
Capitalized terms not defined here have the meanings in the Agreement or Data Protection Laws.
With respect to Customer Personal Data, Customer is the Controller (or, where Customer is itself a Processor for a third-party Controller, a Processor) and Choclement is the Processor (or, as applicable, a Subprocessor). Under the CCPA/CPRA, Customer is the "Business" and Choclement is a "Service Provider". The parties also acknowledge that, in relation to certain Personal Data that Choclement Processes for its own purposes (such as account-management, billing, security, fraud-prevention, and product-improvement data described in our Privacy Policy), Choclement is an independent Controller and this DPA does not apply to that Processing.
Choclement will Process Customer Personal Data only on documented instructions from Customer, as set out in the Agreement, this DPA, Customer's configuration of the Service, and any additional written instructions Customer gives. Choclement will inform Customer if it believes an instruction violates Data Protection Laws.
Choclement will: (a) Process Customer Personal Data only for the limited and specified purposes set out in the Agreement and this DPA; (b) comply with applicable obligations under the CCPA/CPRA, including providing the same level of privacy protection as required of Businesses; (c) not Sell or Share (as those terms are defined under the CCPA/CPRA) Customer Personal Data; (d) not retain, use, or disclose Customer Personal Data outside the direct business relationship between the parties or for any commercial purpose other than the Business Purpose, except as permitted by the CCPA/CPRA; (e) not combine Customer Personal Data with Personal Data from other sources except as permitted under CCPA Regulation § 7050(b); (f) notify Customer if Choclement determines it can no longer meet its obligations under the CCPA/CPRA; and (g) grant Customer the right, upon reasonable notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data.
This DPA applies for as long as Choclement Processes Customer Personal Data under the Agreement.
The subject matter, nature, purpose, categories of Data Subjects, and categories of Personal Data are described in Schedule 1 (Details of Processing).
Choclement will ensure that personnel authorized to Process Customer Personal Data are bound by written confidentiality obligations or are under appropriate statutory obligations of confidentiality, and have received appropriate data-protection training. Access is restricted to those personnel who need it to perform the Agreement.
Choclement will implement and maintain appropriate technical and organizational measures to ensure a level of security appropriate to the risk of Processing Customer Personal Data, including the measures specified in Schedule 2 (Technical and Organizational Measures). Choclement may update these measures from time to time, provided that the updated measures continue to provide at least an equivalent level of protection.
Customer grants Choclement a general authorization to engage Subprocessors to Process Customer Personal Data, subject to this Section 5. A current list of Subprocessors is published at /legal/subprocessors and incorporated by reference.
Choclement will give Customer at least thirty (30) days' advance notice (by in-product banner, email, or update to the Subprocessors page) before authorizing any new Subprocessor to Process Customer Personal Data, or before replacing a Subprocessor with another. Customer may, within fifteen (15) days after receipt of notice, object on reasonable data-protection grounds by emailing [email protected]. The parties will discuss the objection in good faith. If Choclement cannot accommodate the objection without materially affecting the Service, Customer may terminate the affected portion of the Service on written notice; Choclement will refund any prepaid, unused fees attributable to the terminated portion on a pro-rata basis.
Choclement will enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those in this DPA, including by incorporating the SCCs and UK Addendum where required by a Restricted Transfer. Choclement remains liable to Customer for the acts and omissions of its Subprocessors with respect to Customer Personal Data, to the extent set out in this DPA and the Agreement.
Choclement will, taking into account the nature of the Processing, provide reasonable assistance — by appropriate technical and organizational measures, insofar as possible — to enable Customer to respond to Data Subject requests to exercise rights of access, rectification, erasure, restriction, portability, objection, and the right not to be subject to automated decision-making under Data Protection Laws.
If Choclement receives a Data Subject request relating to Customer Personal Data, Choclement will not respond directly (except to acknowledge receipt and to inform the Data Subject that the request must be made to Customer) and will forward the request to Customer without undue delay.
Customer is responsible for verifying and responding to Data Subject requests; Customer will reimburse Choclement for reasonable costs of any extraordinary assistance Choclement provides beyond what is available through self-service in the Service.
Choclement will notify Customer without undue delay (and in any event within seventy-two (72) hours) after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will, to the extent then known: (a) describe the nature of the Personal Data Breach, the categories and approximate number of Data Subjects, and the categories and approximate number of records concerned; (b) provide the name and contact details of a point of contact; (c) describe the likely consequences; and (d) describe measures taken or proposed to address and mitigate the Personal Data Breach. Choclement will provide reasonable assistance to Customer in fulfilling Customer's notification and communication obligations under Data Protection Laws. Choclement's notification or response to a Personal Data Breach is not an acknowledgement of fault or liability.
Choclement will provide Customer with reasonable assistance, taking into account the nature of Processing and the information available to Choclement, with any data protection impact assessment ("DPIA") and prior consultation with Supervisory Authorities that Customer is required to carry out under Data Protection Laws (GDPR Articles 35–36 and equivalents). Choclement may charge Customer reasonable fees for material assistance beyond making available standard product documentation.
Customer authorizes Choclement to transfer and Process Customer Personal Data in the United States and other countries in which Choclement or its Subprocessors operate, subject to the safeguards in this Section 9.
Where Choclement Processes Customer Personal Data originating from the European Economic Area in a Restricted Transfer, the SCCs are incorporated into this DPA by reference and completed as follows:
Where Choclement Processes Customer Personal Data originating from the United Kingdom in a Restricted Transfer, the UK Addendum is incorporated into this DPA by reference and the EU SCCs are modified by the UK Addendum. In Table 4 of the UK Addendum, the "Importer" and "Exporter" may end the UK Addendum as set out in Section 19 of the UK Addendum.
Where Choclement Processes Customer Personal Data originating from Switzerland in a Restricted Transfer, the EU SCCs apply with the following adjustments to accommodate the FADP: (a) references to the GDPR are interpreted as references to the FADP where the transfer is subject only to the FADP; (b) the Swiss FDPIC is the competent supervisory authority; (c) references to "Member States" include Switzerland; and (d) until the FADP's protections apply to legal persons, this DPA also protects Personal Data of legal persons in Switzerland.
If Choclement and Customer can rely on an adequacy decision (including the EU-US Data Privacy Framework, the UK Extension, or the Swiss-US Data Privacy Framework) or another approved transfer mechanism, the parties may rely on that mechanism instead of, or in addition to, the SCCs. Choclement may, upon notice, replace the SCCs with any successor or replacement mechanism approved under Data Protection Laws.
The parties acknowledge that they have conducted a transfer impact assessment in respect of the Restricted Transfers contemplated under this DPA and have agreed that the safeguards described herein are adequate. Choclement will, on request, provide Customer with the information reasonably necessary to update Customer's transfer impact assessment.
On termination or expiration of the Agreement, Choclement will, at Customer's choice expressed during the Extraction Window (defined in the Agreement), delete or return to Customer all Customer Personal Data Processed on Customer's behalf, and delete existing copies, except to the extent applicable law requires longer retention or the data is held in routine back-ups that are deleted in our ordinary retention cycle and not accessed during that cycle for any other purpose. The parties acknowledge that Aggregated Data (as defined in the Agreement) is not Customer Personal Data and may be retained by Choclement.
Choclement will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including by providing on request: (a) summaries of the most recent third-party security audits, penetration tests, SOC 2 Type II reports, or ISO 27001 certificates that Choclement has obtained; and (b) responses to Customer's reasonable security and privacy questionnaires.
If the materials in (a) and (b) above are not sufficient to enable Customer to comply with Data Protection Laws, Customer (or an independent third-party auditor mandated by Customer and not a competitor of Choclement) may conduct an audit, subject to: (i) at least thirty (30) days' written notice; (ii) not more than once per twelve-month period (except where a Supervisory Authority requires more frequent audit or Choclement has suffered a material Personal Data Breach affecting Customer Personal Data); (iii) confidentiality obligations protecting Choclement's confidential information and other customers' data; (iv) audits conducted during business hours, in a manner that does not unreasonably interfere with Choclement's operations; and (v) Customer bearing the costs of the audit, including reimbursing Choclement for its reasonable time at standard rates if the audit reveals no material breach.
The liability of each party under or in connection with this DPA (including the SCCs and UK Addendum) is subject to the limitations and exclusions of liability in the Agreement (including Section 16 of the Terms of Service). Multiple claims under the Agreement and this DPA do not enlarge the cap. To the extent the SCCs impose liability obligations that cannot be limited or excluded by contract, those obligations apply notwithstanding the preceding sentence, but only in respect of Personal Data subject to the SCCs.
In the event of a conflict between this DPA and the Agreement, this DPA prevails to the extent of the conflict and only with respect to the Processing of Customer Personal Data. In the event of a conflict between the SCCs and any other term of this DPA or the Agreement, the SCCs prevail to the extent of the conflict and only in respect of Restricted Transfers governed by the SCCs.
Where Customer is established in the EEA, the supervisory authority designated by Article 51 GDPR. Where Customer is not established in the EEA but Processing falls within Article 3(2) GDPR, the supervisory authority of the Member State in which Customer's EU representative is established. For UK transfers, the UK Information Commissioner's Office. For Swiss transfers, the Swiss FDPIC.
Choclement implements and maintains the following technical and organizational measures. Customer acknowledges that security measures evolve and that Choclement may modify these measures provided the modifications continue to provide an equivalent level of protection.
The current list of Subprocessors authorized to Process Customer Personal Data is published at /legal/subprocessors and is incorporated into this DPA by reference. The Subprocessors page includes, for each Subprocessor: name, role (e.g., hosting, database, email delivery, LLM inference), categories of Personal Data Processed, location of Processing, and the legal basis for any Restricted Transfer.
Adding or replacing a Subprocessor follows the notice and objection process in Section 5.2.
Choclement LLC, doing business as BHmetrics
c/o registered agent on file with the Delaware Secretary of State
Data Protection: [email protected]
Service URL: bhmetrics.com