Data Processing Addendum

Last updated: October 22, 2026

1. What this covers

This Data Processing Addendum ("DPA") is part of the Evnie terms of service between FINTechNC, which operates Evnie ("Evnie", "we"), and the business using Evnie ("you"). It covers Customer Personal Information: personal information about your customers, your team, and other people that Evnie processes for you, including bookings, online orders, questionnaire answers, AI receptionist chats, team logins, and anything you link to Blackhawk (connected apps, uploaded files and records sent from other apps). It doesn't cover your public business profile, which the terms of service cover.

If this DPA and the terms of service disagree about Customer Personal Information, this DPA wins.

2. Roles

You're the "business" or "controller" for Customer Personal Information. Evnie is your "service provider" or "processor", as those terms are used in US state privacy laws, including the California Consumer Privacy Act as amended (CCPA) and similar laws in other states. You decide why the information is collected and what it's used for; we process it on your behalf.

3. How we use it

We process Customer Personal Information only to provide, secure, support and improve Evnie for you, as described in the terms of service, our privacy policy and the settings you choose (for example, taking bookings and orders, sending confirmations, answering your Blackhawk questions and sending your alerts), and as the law requires. Your use of Evnie and your settings are your instructions to us.

We will not:

• sell Customer Personal Information, or share it for cross-context behavioral advertising;
• keep, use or disclose it for any purpose other than providing Evnie to you, or outside our direct business relationship with you;
• combine it with personal information we get from anyone else, except as the law allows a service provider to;
• include it in the business information we share or license to AI platforms and partners;
• try to re-identify information we've turned into one-way codes or de-identified.

We may use information that has been de-identified or combined across many businesses so it can't reasonably be linked to a person or to you, to improve Evnie. We'll comply with the CCPA and other applicable privacy laws in processing Customer Personal Information, and we'll tell you if we decide we can no longer meet our obligations under them. You may then take reasonable steps, including ending your use of Evnie, to stop any unauthorized use.

4. Your responsibilities

• You have the legal right to collect the information and to give it to us, and you've given any notices and obtained any consents the law requires.
• You won't send us the sensitive information listed in section 5a of the terms of service (such as health records, payment card or bank account numbers, or government ID numbers).
• You'll honor your customers' privacy choices, such as requests to opt out or delete, using the tools in Evnie or by asking us.

5. People who work on it

Only people at Evnie who need access to run, secure or support the service can access Customer Personal Information, and they're bound to keep it confidential.

6. Subprocessors

We use other companies to help run Evnie, such as hosting, email, payment and AI providers. They're listed, with what they receive, in section 4 of our privacy policy. Each is bound by written terms that protect the information at least as well as this DPA. We'll update that list before adding a new subprocessor that handles Customer Personal Information, and you can contact us with any concerns. We're responsible for our subprocessors' work under this DPA.

7. Security

We use reasonable technical and organizational measures appropriate to the information, including:

• encrypted connections (HTTPS) for everything sent to and from Evnie;
• encryption of access keys for connected apps and of service keys at rest;
• one-way codes in place of customer names, emails, phone numbers and IDs in Blackhawk;
• role-based access in your account (owner, manager, staff) and optional two-step login;
• limits on automated requests, and keeping only what's needed for as long as it's needed.

8. Security incidents

If we confirm a breach of security that leads to unauthorized access to, or loss, change or disclosure of, Customer Personal Information, we'll tell you without undue delay, describe what happened and what we're doing about it, and give you the information we reasonably can to help you meet any duty you have to notify people or regulators.

9. Helping you

• Privacy requests: we'll help you answer requests from people to access, correct, delete or opt out of the use of their information, through the tools in Evnie or by email. If someone asks us directly about information we hold for you, we'll pass it to you.
• Assessments: we'll give you information you reasonably need for a data protection or risk assessment about your use of Evnie.
• Showing compliance: once a year, or after a security incident, we'll answer your reasonable written questions about how we meet this DPA.

10. Deleting it

You can delete Customer Personal Information in Evnie at any time, for example by deleting bookings or unlinking a Blackhawk source. When you close your account, we delete Customer Personal Information within 90 days, except where the law requires us to keep it (such as tax records for orders). Before you close your account, you can ask us for a copy at [email protected].

11. Where it's processed

Evnie is run from the United States and hosted on Cloudflare's network, which may process information in other countries to deliver and protect the service. Evnie is built for businesses and customers in the United States.

12. Health information

Evnie isn't designed for protected health information and isn't a business associate under HIPAA. Don't use it to collect or store protected health information.

13. Contact

Questions about this DPA or a privacy request: [email protected].