Data Processing Addendum

Jifi is operated by EFFICIO MARKETING LLC, an Ohio limited liability company. Contact support@jifi.io for service questions, privacy@jifi.io for privacy requests, or legal@jifi.io for legal notices.

This DPA forms part of the customer’s Jifi agreement and applies when we process personal data on its behalf. The customer is controller or equivalent decision-maker; we are processor or equivalent service provider for that data. The customer is responsible for lawful collection, notices, instructions and any required permissions. For our independent account, payment and security purposes, the Privacy Policy applies. This DPA controls conflicting agreement terms about customer-directed processing.

We process customer personal data only on documented instructions in the agreement, configured service use and lawful support requests, unless law requires otherwise. We will notify the customer of a legal requirement where permitted, and inform it if an instruction appears to violate applicable data-protection law. We may suspend the affected processing while that issue is resolved.

The subject matter is providing company knowledge preparation and maintenance, help-center publication, AI support, case continuity and human support workflows. Processing includes collecting, recording, storing, retrieving, transmitting, generating responses, displaying, exporting and deleting data. It is event-driven or recurring as configured, for the service term and applicable return, deletion and retention periods.

Data subjects include the company’s personnel, customers and other people lawfully identified in supplied material. Data categories include account/contact identifiers, company sources and files, article and revision content, private guidance, messages and images, optional contact details, case/recovery identifiers, feedback, handling history and associated technical records. The standard service excludes the sensitive uses prohibited by the Content Policy.

Personnel permitted to process customer personal data must be subject to confidentiality duties. We will maintain technical and organizational measures appropriate to the processing risk, including access controls and separation of company data, and assist the customer as required by applicable law with rights requests, security, impact assessments and regulator consultations, considering the nature of processing and information available to us.

We will notify the customer without undue delay after becoming aware of a personal data breach affecting its data, provide available relevant information, and cooperate with its assessment and legally required notices. The customer remains responsible for decisions and communications required of it as controller. Routine failed access attempts do not necessarily constitute a personal data breach.

The customer generally authorizes the providers described in the Subprocessor Notice for the stated functions. We will impose applicable data-protection obligations on subprocessors by contract and remain responsible for their performance of those obligations. We will notify customers of intended additions or replacements before they process customer data, giving an opportunity to object on reasonable data-protection grounds. If no suitable alternative resolves the objection, the affected processing may be suspended or ended.

Each party must comply with international-transfer requirements applicable to it. If a transfer requires standard contractual clauses, a UK addendum or another safeguard, the parties must complete the applicable mechanism and required details before that processing begins.

At the customer’s choice, we will return or delete customer personal data after the service ends, unless applicable law requires retention. The ordinary read/export period is at least 90 days; a lawful earlier deletion instruction can shorten it. Residual backup data remains protected and is removed through its expiry cycle. Retained legal records remain restricted to their permitted purpose.

We will make available information needed to demonstrate compliance with this DPA and allow and contribute to audits and inspections required by applicable law. Coordinate scope and timing to protect other customers, confidentiality and service operation. The customer may use available information and reasonable written questions first, without limiting mandatory audit rights. We will provide reasonable assistance with lawful correction, restriction and deletion instructions affecting subprocessors.

Applicable non-waivable rights and duties prevail over conflicting limitations. This DPA continues while we retain customer personal data. Contact privacy@jifi.io about instructions, data-protection information or requests.