Woodrow.ai
Last updated: August 13, 2026
This Data Processing Addendum (“DPA”) is incorporated into and forms part of the Terms of Service (the “Agreement”) between Subscript, Inc. (“Company”) and the Customer that accepted the Agreement (“Customer”), and applies to the extent Company Processes Personal Data on behalf of Customer in connection with the Services. This DPA takes effect automatically upon, and as of the date of, Customer’s acceptance of the Agreement. Capitalized terms not defined in this DPA have the meaning given to them in the Agreement.
1.1. “CCPA” means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
1.2. “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing,” and “Personal Data Breach” have the meanings given in the GDPR, and are interpreted to include the analogous terms under other Data Protection Laws, including “Business,” “Service Provider,” “Consumer,” “Personal Information,” and “Security Incident” under the CCPA.
1.3. “Data Protection Laws” means all data protection and privacy laws applicable to the Processing of Personal Data under the Agreement, including, as applicable, the GDPR, the UK GDPR, the CCPA, and the Swiss Federal Act on Data Protection.
1.4. “GDPR” means Regulation (EU) 2016/679, and, where applicable, the GDPR as it forms part of UK law by operation of the UK European Union (Withdrawal) Act 2018 (“UK GDPR”).
1.5. “Personal Data” means Customer Data that constitutes personal data, personal information, or an analogous term under Data Protection Laws.
1.6. “SCCs” means the Standard Contractual Clauses annexed to European Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
1.7. “Subprocessor” means any third party engaged by Company to Process Personal Data in connection with providing the Services.
2.1. GDPR Roles. Where Data Protection Laws that adopt the Controller/Processor framework apply, Customer is the Controller and Company is the Processor of Personal Data. Each party will comply with the obligations applicable to its role.
2.2. CCPA Roles. Where the CCPA applies, Customer is a Business and Company is a Service Provider receiving Personal Data solely to perform the Services, a business purpose permitted under the CCPA. Company will not Sell or Share Personal Data, and will not retain, use, or disclose Personal Data for any purpose other than performing the Services, except as otherwise permitted by the CCPA. Company certifies that it understands these restrictions and will comply with them.
2.3. Scope. This DPA applies to the Processing of Personal Data by Company on behalf of Customer in connection with the Services, as further described in Annex I.
2.4. Account and Billing Information. This DPA does not apply to Company's collection and Processing of information about Customer or its Authorized Users that Company collects and Processes as a controller or business in its own right and not on Customer's documented instructions. That Processing is instead governed by Company's Privacy Policy, available at woodrow.ai/privacy-policy.
3.1. Instructions. Company will Process Personal Data only on Customer’s documented instructions, including regarding international transfers, unless required to do otherwise by law, in which case Company will inform Customer before Processing unless that law prohibits such notice. Configuring, accessing, and using the Services in accordance with the Agreement and the Documentation constitutes Customer’s instructions to Process Personal Data for that purpose.
3.2. Personnel. Company will ensure that personnel authorized to Process Personal Data are subject to confidentiality obligations.
3.3. Security. Company will implement and maintain the technical and organizational security measures described in Annex II, designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
3.4. Subprocessors. Company may engage Subprocessors to Process Personal Data in accordance with Section 6 of this DPA.
3.5. Data Subject Requests. Taking into account the nature of the Processing, Company will provide reasonable assistance to Customer, through appropriate technical and organizational measures made available in the Services or otherwise, to help Customer respond to requests from Data Subjects to exercise their rights under Data Protection Laws. If Company receives a request directly from a Data Subject, Company will direct the Data Subject to submit the request to Customer, and Customer is responsible for responding to the request. If Customer’s request for assistance requires Company effort beyond what is reasonably available through the Services’ standard functionality, Company may charge Customer a reasonable fee for such assistance, to be agreed in advance.
3.6. Compliance Assistance. Taking into account the nature of Processing and the information reasonably available to Company, Company will provide reasonable assistance to Customer with data protection impact assessments and prior consultations with supervisory authorities that Customer reasonably believes are required under Data Protection Laws, solely in relation to Processing of Personal Data by Company under this DPA.
3.7. Personal Data Breach Notification. Company will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a confirmed Personal Data Breach affecting Personal Data, and will provide information reasonably available to Company about the Personal Data Breach to assist Customer in meeting its own notification obligations. Company’s notification of, or response to, a Personal Data Breach is not an acknowledgment of fault or liability.
3.8. Deletion or Return. Following termination or expiration of the Agreement, Company will make Personal Data available for export as described in Section 12.4 of the Agreement, after which Company will delete Personal Data, except that Company may retain Personal Data (a) to the extent required by applicable law, and (b) in encrypted backup copies until their scheduled, routine deletion in the ordinary course, subject in each case to the confidentiality obligations of this DPA.
3.9. Demonstration of Compliance. Company will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, which Company may satisfy by providing Customer with its then-current third-party audit report(s) (e.g., SOC 2 Type II) or similar documentation summarizing Company’s security program. If such documentation does not reasonably address Customer’s audit obligations under Data Protection Laws, Company will allow for, and contribute to, an audit conducted by Customer or a mutually agreed, independent third-party auditor bound by confidentiality, no more than once in any twelve (12)-month period, on at least thirty (30) days’ prior written notice, during normal business hours, and at Customer’s expense. Any such audit will (i) be conducted in a manner designed to minimize disruption to Company’s operations, (ii) exclude access to the data, systems, or premises of Company’s other customers, and (iii) exclude Company’s confidential or proprietary information not directly relevant to Company’s Processing of Customer’s Personal Data. This Section 3.9 does not limit any audit or inspection rights a supervisory authority may have directly against Company under applicable Data Protection Laws.
4.1. Lawful Basis. Customer represents and warrants that it has, and will maintain throughout the Term, all notices, consents, and lawful bases necessary under Data Protection Laws to collect and disclose Personal Data to Company for Processing in accordance with this DPA and the Agreement.
4.2. Lawful Instructions. Customer will ensure that its instructions to Company regarding the Processing of Personal Data comply with Data Protection Laws. Customer is solely responsible for the accuracy, quality, and legality of Personal Data and the means by which Customer acquired it.
4.3. Sensitive Data. Customer will not submit, and will ensure its Authorized Users do not submit, any special category or sensitive Personal Data (e.g., health, biometric, or government-ID data) to the Services unless Company has first agreed in writing to implement additional safeguards for that data.
5.1. Standard Contractual Clauses. To the extent Company’s Processing of Personal Data originating from the European Economic Area, the United Kingdom, or Switzerland involves a transfer to a jurisdiction not recognized as providing an adequate level of data protection, the SCCs are incorporated into this DPA by reference and apply as follows: (a) Module Two (Controller to Processor) applies where Customer is a Controller and Company is a Processor; (b) Module Three (Processor to Processor) applies where Customer is a Processor and Company is a Subprocessor; (c) in Clause 7, the optional docking clause does not apply; (d) in Clause 9, Option 2 (general written authorization) applies, and the time period for prior notice of Subprocessor changes is as set out in Section 6.2 of this DPA; (e) in Clause 11, the optional language does not apply; (f) in Clause 17, the SCCs are governed by the laws of Ireland; (g) in Clause 18(b), disputes are resolved before the courts of Ireland; and (h) Annexes I, II, and III to the SCCs are populated with the information in Annexes I, II, and III to this DPA.
5.2. UK Transfers. For transfers subject to the UK GDPR, the UK International Data Transfer Addendum to the SCCs, issued by the UK Information Commissioner under S119A(1) Data Protection Act 2018, is incorporated by reference and completed with the corresponding information from this DPA.
5.3. Swiss Transfers. For transfers subject to the Swiss Federal Act on Data Protection, the SCCs apply as adapted to reflect the requirements of that Act, including replacing references to the GDPR and EU supervisory authorities and courts with the corresponding Swiss references, as reasonably determined by Company.
5.4. Alternative Transfer Mechanism. If Company adopts an alternative, valid transfer mechanism for the transfer of Personal Data not described in this DPA (including any new version of, or successor to, the SCCs), that mechanism will apply instead, and Company will provide notice to Customer describing the mechanism.
6.1. General Authorization. Customer provides general authorization for Company to engage Subprocessors to Process Personal Data, subject to this Section 6. Company’s current list of material Subprocessors is available at https://trust.woodrow.ai/subprocessors.
6.2. New Subprocessors. Company will provide notice (by posting to https://trust.woodrow.ai/subprocessors or by email) at least ten (10) days before authorizing a new Subprocessor to Process Personal Data. If Customer has a reasonable, documented data-protection objection to a new Subprocessor, Customer may object in writing within that ten (10)-day period. The parties will discuss the objection in good faith; if unresolved, Customer’s sole and exclusive remedy is to terminate the portion of the Services that cannot be provided without the objected-to Subprocessor, by written notice to Company, without penalty.
6.3. Subprocessor Obligations. Company will impose data protection obligations on each Subprocessor that are no less protective than those in this DPA, and remains liable to Customer for a Subprocessor’s acts and omissions to the same extent Company would be liable if performing that Subprocessor’s services directly.
7.1. Liability Cap. Each party’s liability arising out of or related to this DPA, whether in contract, tort, or otherwise, is subject to the limitations and exclusions of liability set out in Section 11 (Limitation of Liability) of the Agreement, and any reference in Section 11 of the Agreement to liability “arising out of or related to this Agreement” includes liability arising out of or related to this DPA. The parties agree this DPA does not expand either party’s liability beyond what is set out in the Agreement.
8.1. Term. This DPA takes effect on the date Customer accepts the Agreement and continues for so long as Company Processes Personal Data on behalf of Customer under the Agreement.
8.2. Order of Precedence. In the event of a conflict between this DPA and the Agreement regarding the Processing of Personal Data, this DPA controls. In the event of a conflict between this DPA and the SCCs (where applicable), the SCCs control.
9.1. Governing Law. This DPA is governed by the same governing law and jurisdiction as the Agreement, except that the SCCs (where applicable) are governed as set out in Section 5.1.
9.2. Severability. If any provision of this DPA is invalid or unenforceable, the remaining provisions remain in full force, and the invalid or unenforceable provision will be modified to the minimum extent necessary to make it enforceable.
9.3. No Third-Party Beneficiaries. Except as expressly provided in the SCCs where applicable, this DPA does not confer any rights or remedies on any person other than the parties.
Company’s current security practices are described in detail at trust.woodrow.ai (“Trust Page”), which is incorporated into this Annex II by reference. At a minimum, Company maintains:
(a) encryption of Personal Data in transit and at rest;
(b) logical access controls, including role-based access and multi-factor authentication for administrative access;
(c) a documented information security program, reviewed at least annually;
(d) employee confidentiality obligations and periodic security training;
(e) a documented incident response and breach notification process;
(f) vulnerability management, including periodic penetration testing;
(g) backup and disaster recovery procedures; and
(h) network segmentation and monitoring designed to detect and prevent unauthorized access.
Company’s current list of material Subprocessors is maintained at https://trust.woodrow.ai/subprocessors and is incorporated into this Annex III by reference.
.svg)
.svg)
.svg)
.svg)
.svg)
