HelpWire Data Processing Agreement

In short: If you use HelpWire to handle other people's personal data — your clients, employees, or customers — the law (notably the GDPR) requires a written contract about how we process that data for you. This is that contract. It applies automatically; you don't need to sign anything.

This Data Processing Agreement ("DPA") forms part of the HelpWire Terms of Service ("Terms") between Electronic Team, Inc. ("we," "us," the "Processor") and the customer accepting the Terms ("Customer," "you," the "Controller"). It applies automatically whenever you use the Service to process personal data of Clients or other individuals on whose behalf you act, and takes effect on your first such use. If you need a copy of this DPA for your records, contact dpo@electronic.us.

Capitalized terms not defined here have the meanings in the Terms. "Personal data," "controller," "processor," "data subject," "processing," "personal data breach," and "supervisory authority" have the meanings in the GDPR. "Applicable Data Protection Law" means the GDPR, the UK GDPR, the Swiss Federal Act on Data Protection, the CCPA/CPRA, the Virginia CDPA, and other data-protection laws applicable to the processing under this DPA. "Customer Data" means personal data that you or your Operators submit to or generate in the Service and that we process on your behalf, as detailed in Annex 1 — including Client directory records, notes, and session metadata associated with your Clients.

You are the controller of Customer Data (or a processor acting for another controller, in which case we are your subprocessor and you warrant your instructions are consistent with the controller's). We are your processor. For CCPA/CPRA purposes, we act as your "service provider": we process Customer Data only to provide the Service, and we do not sell it, share it for cross-context behavioral advertising, retain it, use it, or disclose it for any purpose other than performing the Service or as permitted by the CCPA. We will not combine Customer Data with personal information we receive from other sources except as the CCPA permits, will comply with the CCPA and provide the level of privacy protection it requires, and will notify you if we determine that we can no longer meet our obligations under the CCPA. You may take the reasonable and appropriate steps described in Section 12 to ensure that we use Customer Data consistently with your obligations, and may direct us to stop and remediate any unauthorized use. For the Virginia CDPA and other U.S. state privacy laws, we act as your processor, and this DPA is the contract those laws require between a controller and its processor.

For clarity, we act as an independent controller — not your processor — for the data described in Section 2 of the Privacy Policy as controller data (your account, billing, support, and analytics data). We also act as an independent controller for the limited use of device identifiers and session metadata to enforce Plan limits and to detect and prevent abuse, as described in Sections 2 and 3 of the Privacy Policy. Section 9.2 of the Terms is your documented instruction to create aggregated or de-identified statistics from Customer Data on the conditions stated there; once aggregated or de-identified so that no individual, Organization, or Client can be identified, those statistics are not Customer Data and are not subject to this DPA.

Your obligations. You are responsible for the lawfulness of Customer Data and of your instructions, for giving Clients and other data subjects any notices and obtaining any consents that Applicable Data Protection Law requires, for not storing special categories of personal data or the regulated data described in Section 9.4 of the Terms in client records, notes, or chat except where Section 9.4 permits it and you have a lawful basis to do so, for the lawfulness of any personal data, including special categories, that appears in Session content transmitted through the Service, and for configuring the Service's security features (including access groups, and making sure your Operators enable MFA) appropriately for your use.

The subject matter, duration, nature and purpose of processing, categories of data subjects, and categories of personal data are set out in Annex 1.

We will: (a) process Customer Data only on your documented instructions (including with regard to transfers of Customer Data to a third country) — which are: the Terms, this DPA, and your and your Operators' use of the Service's features — unless law requires otherwise, in which case we will inform you unless the law prohibits it; (b) promptly inform you if, in our opinion, an instruction infringes Applicable Data Protection Law; (c) ensure persons authorized to process Customer Data are bound by confidentiality obligations; (d) not sell Customer Data or share it for advertising purposes; (e) maintain a record of the processing we carry out on your behalf as required by Article 30(2) GDPR; and (f) notify you without undue delay, unless legally prohibited, if we receive a legally binding request from a public authority for access to Customer Data, and disclose only the minimum required.

We implement the technical and organizational measures ("TOMs") described in Annex 2, taking into account the state of the art and the risks of the processing. We may update the TOMs, provided updates do not materially reduce the level of protection.

You generally authorize us to engage subprocessors to provide the Service. The subprocessors listed on the date you accept this DPA are approved. That list is also the agreed list of sub-processors for the purposes of Clause 9(a) of the Standard Contractual Clauses in Annex 3. The current list of subprocessors that process Customer Data is at https://www.helpwire.app/legal/subprocessors/, together with a dated record of changes. We will notify Organization owners by email at least 14 days before adding or replacing such a subprocessor. You may object on reasonable data-protection grounds within that window; if we cannot offer a workaround, you may cancel your subscription as described in the Terms, effective at the end of your current billing period. We remain responsible for our subprocessors' performance and will impose data-protection obligations on them no less protective than this DPA. On request, we will provide a summary of the data-protection terms in place with a subprocessor.

Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures, insofar as possible, in fulfilling your obligations regarding: (a) data-subject requests — if a data subject contacts us directly about Customer Data, we will refer them to you and not respond on the merits except as required by law; (b) security, breach notification, data-protection impact assessments, and prior consultation with supervisory authorities. We may charge reasonable fees for assistance that exceeds the Service's built-in capabilities, and will tell you before costs arise.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Data. The notice will describe, to the extent known, the nature of the breach, categories and approximate numbers of data subjects and records affected, likely consequences, and measures taken or proposed. Our notification is not an acknowledgment of fault or liability. We will reasonably cooperate with your own notification obligations. We will not notify data subjects or authorities on your behalf unless you instruct us to or the law requires it.

Customer Data is processed on our production infrastructure in California, USA, and in the countries where our subprocessors operate (see the subprocessor list). Session relay servers operate in 12 AWS regions worldwide but carry only end-to-end-encrypted session content, which we do not decrypt. For transfers of EU/EEA, UK, or Swiss personal data to countries without an adequacy decision, the parties incorporate the European Commission's Standard Contractual Clauses (Module Two: controller-to-processor), completed as set out in Annex 3, which also completes the UK Addendum and the Swiss adaptations, as applicable. Electronic Team does not currently hold an EU-U.S. Data Privacy Framework certification; where a subprocessor holds one, it may rely on it for the relevant transfer. Each subprocessor that processes Customer Data in the United States is certified under the Data Privacy Framework or bound to us by the SCCs.

Customer Data is available to you in the Service during the subscription. Upon deletion of your account, Customer Data is deleted immediately and irreversibly from production systems, consistent with Section 13 of the Terms; encrypted backup snapshots containing deleted data expire within 7 days, and IP addresses in rotating server logs are overwritten within 30 days. At the end of the Service, at your choice, we will return Customer Data to you by providing an export in a common machine-readable format, or delete it. You may request an export at any time, at no charge, and we will provide it within 30 days of your request; Customer Data then remains available in the Service for at least 30 days after we provide the export, unless you delete your account earlier, and you may extend either period once by notice before it ends. During those periods we will provide reasonable assistance with the export and keep the Service available. If we terminate your account, Customer Data remains available for export for at least 30 days after termination before it is deleted, unless law prohibits the export, requires us to preserve the data for an investigation, or the account was used for unauthorized access or fraud. Section 13.4 of the Terms describes the categories of data included in an export and the deletion that follows a switching request. Where you delete your account yourself, you instruct us to delete Customer Data immediately without prior return. On written request, we will confirm deletion. We may retain Customer Data only where and as long as law requires, protected under this DPA.

We will make available information reasonably necessary to demonstrate compliance with this DPA — first through documentation and security summaries. We do not currently hold third-party security certifications or attestations (such as SOC 2 or ISO 27001). Where these are insufficient under Applicable Data Protection Law, you may conduct (directly or through a non-competitor auditor bound to confidentiality) an audit of relevant processing facilities and records: no more than once per calendar year, on at least 30 days' written notice, during business hours, minimizing disruption, and at your own cost unless the audit reveals a material breach of this DPA.

Each party's liability under this DPA is subject to the limitations and exclusions in Section 16 of the Terms, which apply in aggregate across the Terms and this DPA. If this DPA conflicts with the Terms on data-protection matters, this DPA prevails; the SCCs, where they apply, prevail over both. This DPA lasts as long as we process Customer Data and terminates automatically when processing ends.

Subject matter. Provision of the HelpWire remote support and remote desktop service.

Duration. The term of the Customer's use of the Service, until deletion under Section 11 of this DPA.

Nature and purpose. Hosting and transmission of data required to establish and manage remote support sessions between the Customer's Operators and its Clients; storage of the Customer's client directory, chat messages, session events, and session metadata; transmission (without content retention) of end-to-end-encrypted session content — screen data, input, clipboard, and files.

Categories of data subjects.

• The Customer's Clients: individuals whose devices receive remote support (customers, employees, contractors, or other end users of the Customer).
  
  
• The Customer's Operators, to the extent their data appears within Customer Data (e.g., in session metadata).

Categories of personal data.

• Client identification data entered by the Customer: name, email address, phone number, company, country, order number, messenger contact details, social profile links, and any other information Operators choose to record in notes fields.
  
  
• Session metadata and device records: session start/end times and duration, IP addresses, OS name and version, host name, CPU architecture, BIOS UUID, router MAC address, hashed hardware characteristics, and connection events.
  
  
• Chat messages and session events: stored for the Customer's Organization until deletion of the related record or account.
  
  
• Session content transmitted during Sessions (screen content, input, clipboard, transferred files) — end-to-end encrypted between the Operator and Client applications and transmitted only; never stored by us. The content of this data is determined solely by the Customer and its Clients and may include any category of personal data, including special categories; the Customer is responsible for the lawfulness of transmitting it.

Special categories. Not requested or required by the Service, and not to be stored in client records, notes, or chat (Terms Section 9.4). Special categories may be present in Session content that the Customer transmits and that we do not store, and may appear incidentally in Customer-entered fields despite Section 9.4; in both cases the Customer is responsible for the lawfulness of the processing.

Frequency. Continuous, as driven by the Customer's use.

This annex describes the technical and organisational measures ("TOMs") we implement under Article 32 GDPR. It mirrors Section 11 of our Privacy Policy.

Encryption and transmission. Session content (screen, input, clipboard, file transfer) is end-to-end encrypted between the Operator and Client applications using TLS 1.3 with cipher suite TLS_AES_256_GCM_SHA384 (AES-256-GCM); it is not decrypted at relay servers or any intermediate node. Application-to-server traffic (chat, service commands) is encrypted in transit with the same protocols and decrypted only on the central server. QUIC+TLS is used where UDP transport is required; web traffic runs over HTTPS/WSS. Database connections are encrypted in transit.

Data minimization by architecture. No recording or storage of session audiovisual content; transferred files and clipboard content are never stored server-side. Chat messages and session events are stored for the Customer's Organization until deletion of the related record or account.

Data portability and erasure. Self-service account deletion removes Customer Data from production systems immediately, and exports of Organization data in a common machine-readable format are available on request (Terms Section 13.4).

Access control. Personal data accessible only to personnel who need it for their duties. Internal services reachable only via corporate VPN behind an additional authentication layer, with individual per-service credentials. Customer-side access control: Organization owners control Operator membership and group-level client access; MFA available for all user accounts via Clerk.

Infrastructure. Production servers located in California, USA (AWS us-west-1); session relay servers on AWS across 12 regions worldwide; a separate server distributes application builds. Applications code-signed (DigiCert). Authentication and credential management via Clerk.

Availability and resilience. Backups of file directories and database dumps are taken every 2 days; volume snapshots are encrypted and retained for a maximum of 7 days. Key infrastructure parameters are continuously monitored with automated alerting, and an on-call administrator team responds to incidents. Recovery procedures are executed manually and verified as needed.

Personnel. Confidentiality obligations for staff with data access; privacy and security policies binding on employees.

Incident response. Infrastructure monitoring with automated alerting and an on-call administrator team, supporting the breach-notification commitment in Section 9.

Subprocessor management. Subprocessors engaged under Section 7; list maintained at https://www.helpwire.app/legal/subprocessors/.

Review. These measures are reviewed and updated from time to time, and whenever we make a significant change to the Service or our infrastructure.

This Annex 3 forms part of the HelpWire Data Processing Agreement (the "DPA") between Electronic Team, Inc. ("Electronic Team") and the customer accepting the HelpWire Terms of Service (the "Customer"). Capitalized terms not defined here have the meanings given in the DPA and the Terms. Part A incorporates and completes the EU Standard Contractual Clauses for transfers of personal data from the European Economic Area. Parts B to D set out the Annexes the Clauses require. Part E completes the UK International Data Transfer Addendum for transfers from the United Kingdom. Part F contains the adaptations that apply to transfers from Switzerland. Part G contains operational terms that apply to all three.

Part A. Incorporation and completion of the EU Standard Contractual Clauses

1. Incorporation. The standard contractual clauses for the transfer of personal data to third countries annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (the "Clauses") are incorporated into the DPA by reference under Section 10 of the DPA and apply to every transfer of personal data that is subject to Regulation (EU) 2016/679 (the "GDPR") from the Customer to Electronic Team. Module Two (transfer controller to processor) applies. The Customer is the data exporter and Electronic Team is the data importer.

2. Execution. By accepting the Terms and using the Service to process personal data of Clients or other individuals on whose behalf it acts, the Customer is deemed to have signed the Clauses, including the Annexes completed in Parts B to D, with effect from the first such use. Electronic Team is deemed to have signed the Clauses on the same date by making the Service available under the DPA. A copy of the Clauses is available on request from the contact in Part B.

3. Selections. The Clauses are completed as follows.

• Clause 7 (docking clause) is included.
  
  
• Clause 9(a): Option 2 (general written authorisation) applies. The agreed list of sub-processors is the list in Part D, as maintained at the address stated there. The period for prior notice of any intended addition or replacement is 14 days, as provided in Section 7 of the DPA.
  
  
• Clause 11(a): the optional language on an independent dispute resolution body is not included.
  
  
• Clause 13(a): the paragraph that applies is determined by the position of the data exporter. Where the data exporter is established in an EU Member State, the supervisory authority of that Member State is competent. Where the data exporter is not established in an EU Member State but falls within Article 3(2) of the GDPR and has appointed a representative under Article 27, the supervisory authority of the Member State in which the representative is established is competent. Where the data exporter is not established in an EU Member State and falls within Article 3(2) without being required to appoint a representative, the supervisory authority of one of the Member States in which the data subjects whose personal data is transferred are located is competent.
  
  
• Clause 17: Option 1 applies. The Clauses are governed by the law of Ireland.
  
  
• Clause 18(b): the courts of Ireland are the courts chosen for the resolution of disputes.

4. Customers acting as processors. Where the Customer uses the Service as a processor on behalf of another controller (Section 3 of the DPA), Module Three (transfer processor to processor) applies in place of Module Two, with the same selections and the same Annexes, notwithstanding the reference to Module Two in Section 10 of the DPA. In that case the Customer warrants that it holds the controller's authorisation for the transfer and for the engagement of Electronic Team as a sub-processor, and the Customer is responsible for passing on to its controller the information that the Clauses require the data importer to provide to the controller, including notice of changes to the list of sub-processors under Clause 9(a).

5. Precedence. In accordance with Clause 5, the Clauses prevail over the DPA and the Terms in the event of a conflict, and the DPA and the Terms do not limit the rights of data subjects under the Clauses.

A. List of parties

B. Description of transfer

C. Competent supervisory authority

The competent supervisory authority is determined in accordance with Clause 13 as completed in Part A.3. For transfers subject to the Swiss Federal Act on Data Protection, the Federal Data Protection and Information Commissioner is competent (Part F).

The data importer implements the technical and organisational measures described in Annex 2 of the DPA, which is incorporated here, together with the related facts stated in the Terms and the Privacy Policy. Organised under the headings in the Clauses list, those measures are as follows.

We use cookies and similar technologies (pixels and local storage) on helpwire.app and in the web portal for: essential operation (sign-in, security, abuse prevention with Google reCAPTCHA, and remembering your preferences); analytics (Google Analytics 4 and PostHog); and advertising measurement (Google Ads and Microsoft Advertising pixels, delivered through Google Tag Manager). The analytics and advertising providers may link these identifiers across sites under their own policies (Section 7).

Our cookie banner currently tells visitors that we use cookies, but it does not yet let you choose which cookies are set, so analytics and advertising cookies are set when you visit. We are introducing a consent tool that will let you accept or decline non-essential cookies, and when it is live we will publish a detailed Cookie Policy and update this section.

Until then, you can control cookies in your browser settings: you can block or delete them, although blocking essential cookies will prevent sign-in from working. You can opt out of Google Analytics across all sites with Google's browser add-on, and manage ad personalization in your Google and Microsoft account settings. Because there is no common standard for browser "Do Not Track" signals, we do not respond to them.

We are a US company. Our production servers are located in California, USA (AWS us-west-1); session relay servers operate in 12 AWS regions worldwide (EU, UK, US, Canada, Brazil, India, Japan, Australia), carrying only end-to-end-encrypted session traffic. Personal data is otherwise processed in the countries where our providers operate. Where we transfer personal data from the EU/EEA, UK, or Switzerland to countries without an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses ("SCCs" — contract terms pre-approved by EU regulators) and, for providers certified under the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, that certification. Our subprocessor list identifies the mechanism we rely on for each provider. You may request a copy of the relevant safeguards via the contact in Section 16.

In short: We keep data while your account is active. Deleting your account removes your data from production immediately; a few records outlive it for the limited periods shown below, because the law requires it, because they sit with Paddle, or for the operational reasons shown below.

Account deletion is self-service in the web portal and is immediate and irreversible for the data we control in production; backup snapshots containing deleted data expire within 7 days. Deletion does not reach data your Operator (as controller) holds about you elsewhere, or records Paddle must keep independently, or our support correspondence and server logs, which follow the periods above.

Session content (screen, input, clipboard, and transferred files) is end-to-end encrypted between the Operator and Client applications using TLS 1.3 with AES-256-GCM — it is not decrypted by relay servers or any other HelpWire infrastructure. Chat and service traffic between the applications and our servers is encrypted in transit with the same protocols and is decrypted only on our central servers. Connections are peer-to-peer by default; relay servers, used only as fallback, forward encrypted traffic without storing or decrypting it. Additional measures include: authentication with optional MFA for user accounts through Clerk; DigiCert code signing of all HelpWire applications; access to personal data limited to personnel who need it to perform their duties, with internal services accessible only over our corporate VPN behind an additional authentication layer and all service accounts credential-protected; and encrypted backup snapshots retained for a maximum of 7 days. No internet service can guarantee absolute security; if we learn of a breach affecting your personal data, we will notify you and regulators as required by law. If you believe you have found a security vulnerability in the Service, please report it to support@helpwire.app.

In short: You can access, correct, delete, and take away your data, and object to some uses. It's free, and we don't punish you for asking.

Everyone. Regardless of where you live, you can access and correct your account data in the web portal, delete your account (Section 10), and unsubscribe from marketing at any time.

EU/EEA, UK, and Swiss residents (GDPR, UK GDPR, and Swiss FADP). You have the right to: access your personal data and get a copy; rectify inaccurate data; erasure; restriction of processing; data portability (a machine-readable copy); object to processing based on legitimate interests, including profiling; object to direct marketing (absolute — we stop immediately); withdraw consent at any time without affecting prior processing; and lodge a complaint with your supervisory authority. We do not make decisions with legal or similarly significant effects based solely on automated processing.

California residents (CCPA/CPRA). You have the right to: know what personal information we collect, use, and disclose; access it; correct it; delete it; and not be discriminated against for exercising your rights. We do not sell personal information. Our use of advertising-measurement cookies (Section 7) constitutes "sharing" for cross-context behavioral advertising under the CPRA. Until our consent tool is live, you can limit it by blocking cookies in your browser or turning off ad personalization in your Google and Microsoft account settings (Sections 7 and 8). The consent tool will add an opt-out control and support for Global Privacy Control signals, and we will update this Policy when it is live. Authorized agents may submit requests on your behalf with proof of authorization.

Notice at collection for California residents. In the preceding 12 months, we collected these categories of personal information: identifiers (name, email address, IP address, device identifiers); commercial information (subscription and order records); internet or other network activity (website, portal, and product usage, and session metadata); approximate geolocation derived from IP address; professional information you provide about your Organization and role; the contents of your support communications; and sensitive personal information limited to account log-in credentials, which are held by Clerk and used only to authenticate you. We collect these categories from you, from your devices and use of the Service, and from Clerk and Paddle, for the purposes in Section 5, and keep them for the periods in Section 10. We disclosed identifiers, commercial information, and internet activity to our service providers for business purposes, and shared identifiers and internet activity with Google and Microsoft for advertising measurement. We do not sell personal information, do not knowingly sell or share the personal information of consumers under 16, and do not use or disclose sensitive personal information for purposes that would require a right to limit.

Virginia residents (VCDPA). You have the right to access, correct, delete, and obtain a copy of your personal data, and to opt out of targeted advertising, sale, and significant profiling. We do not sell personal data. If we decline a request, you may appeal by replying to our decision or writing to the contact in Section 16 marked "Appeal"; we respond to appeals within 60 days, and if we deny your appeal, you may contact the Virginia Attorney General.

Residents of other U.S. states. If you live in another state with a comprehensive privacy law (for example, Colorado, Connecticut, Texas, or Oregon), you have similar rights of access, correction, deletion, portability, and opt-out of targeted advertising and sale, and you can exercise them in the same way. If we decline a request, you may appeal using the process described above for Virginia residents.

How to exercise rights. Email dpo@electronic.us or use the contacts in Section 16. We verify requests using your account email and respond within one month (GDPR) or 45 days (CCPA/VCDPA), extendable once where the law allows; we'll tell you if we need longer. If your request concerns data an Operator holds about you as their Client, we will refer you to them and assist them (Section 2).

HelpWire is not directed to children, and you must be 18 to create an account. We do not knowingly collect personal data from children under 13 (or the higher age applicable under local law, such as 16 in parts of the EU). A child may appear as the user of a device receiving support arranged by an adult — for example, a parent's or school's device; in that case the Operator, as controller, is responsible for the lawfulness of that support. If you believe we hold personal data collected directly from a child, contact us and we will delete it.

If Electronic Team is involved in a merger, acquisition, or sale of assets, personal data may be transferred to the successor. We will notify you before your personal data becomes subject to a materially different privacy policy, and you will have the opportunity to object or delete your account.

We may update this Policy. Material changes will be announced by email and/or a portal notice at least 30 days before taking effect; minor changes are posted with an updated "Last updated" date. We will not use previously collected data in ways materially inconsistent with the policy in effect when it was collected without your consent.

Electronic Team, Inc., 11890 Sunrise Valley Dr, Ste 111, Reston, VA 20191, USA · +1 202 335 8465

• Privacy contact: dpo@electronic.us
  
• Support: support@helpwire.app
  
• General: support@helpwire.app · feedback@helpwire.app

EU/EEA residents may complain to their local supervisory authority, UK residents to the Information Commissioner's Office, and Swiss residents to the Federal Data Protection and Information Commissioner; Virginia residents may contact the Virginia Attorney General.