Data Processing Addendum

1. Definitions

• Applicable Privacy Laws: All privacy and data protection laws applicable to the processing described herein, including the CCPA as amended by CPRA, VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), and applicable Federal telecommunications regulations (TCPA, CAN-SPAM).
• Personal Information: Any information that identifies, relates to, describes, or could reasonably be linked directly or indirectly with a consumer, homeowner, or household.
• Services: The digital infrastructure, website builds, missed-call text-back engines, CRM pipelines, local number routing, review automation, and client communication tools provided by Black Bull Systems.

2. Roles and Scope of Processing

You are the business/controller of Personal Information (including homeowner inquiries, incoming caller phone numbers, SMS conversations, and customer review lists) submitted to or captured by the Services. Black Bull Systems acts strictly as your service provider/processor, operating only upon your documented instructions and as necessary to fulfill the Services.

3. Processing Instructions & Restrictions

1. No Sale or Commercial Sharing: Black Bull Systems will never sell, rent, or disclose your customer leads or customer lists to any third party for commercial gain.
2. Purpose Limitation: We process customer phone numbers, text history, and review solicitations solely to provide your marketing automations, missed-call text-backs, and reputation management.
3. Data Segregation: We maintain strict logical separation of client data to guarantee your book of business remains exclusively yours.

4. Confidentiality & Security Measures

All personnel authorized to process client data are bound by strict non-disclosure obligations. We implement administrative, technical, and physical safeguards including TLS 1.3 encryption in transit, AES-256 encryption at rest, multi-factor authentication, audit logging of system access, and automated penetration testing.

5. Authorized Sub-Processors

You authorize us to engage the following infrastructure providers to process data on your behalf. Each sub-processor is bound by data protection obligations no less protective than those in this DPA:

We provide at least 30 days advance notice before introducing new sub-processors that process client Personal Data.

6. TCPA & Telecommunications Compliance

As the business sender of SMS, MMS, and automated phone responses, you are responsible for maintaining valid consent for outbound communications. Black Bull Systems provides automated opt-out handling: whenever a lead or customer texts STOP, UNSUBSCRIBE, or CANCEL, the system instantly revokes further automated outreach.

7. Consumer Rights Assistance & Data Deletion

We provide the necessary tools for you to export, correct, or delete any consumer record in accordance with CCPA/CPRA or state law requests. Upon termination of services, client data is retained for 30 days to facilitate export, after which it is permanently purged from active systems.

8. Contact & Privacy Officer

For any questions regarding this Data Processing Addendum or our data protection practices, please contact: