LegalData Processing Addendum
How Palazzo processes personal data on a customer's behalf.
This Data Processing Addendum ("DPA") applies only where an agreement between Palazzo, Inc. ("Palazzo") and a customer ("Customer") incorporates it. The Platform Terms of Use incorporate it, and an order form or master agreement may too (together, the "Agreement"). It governs Palazzo's processing of Customer Personal Data. If this DPA and the Agreement conflict on data protection, this DPA controls.
1. Definitions
- Customer Personal Data: personal information that Customer, or its End Users, provide to Palazzo through the Services, and that Palazzo processes on Customer's behalf.
- Data Protection Laws: US federal and state privacy laws that apply to the processing, including the California Consumer Privacy Act as amended (CCPA), and comparable state laws.
- Security Incident: a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- Subprocessor: a third party Palazzo engages to process Customer Personal Data.
- End Users: Customer's shoppers, website visitors, clients, and other people who use the Customer-facing tools the Services provide.
- Services and Outputs: the Platform and the Platform Outputs, as defined in the Agreement.
Other capitalized terms have the meaning given in the Agreement.
2. Roles and scope
Customer is the business (controller) and Palazzo is the service provider (processor) for Customer Personal Data. Annex 1 describes the processing.
This DPA doesn't cover:
- Data Palazzo processes as a business for its own purposes, such as Customer's account and billing information
- An End User's own Palazzo account, after the End User creates it. That account is governed by Palazzo's Privacy Policy.
- Checkout data, if Palazzo ever becomes the merchant of record. Today the retailer is the seller, and Palazzo passes orders to it under this DPA.
3. Customer's instructions
Palazzo processes Customer Personal Data only to provide the Services under the Agreement, and on Customer's documented instructions, including those in this DPA. Palazzo will tell Customer if it believes an instruction violates Data Protection Laws.
Customer is responsible for having a lawful basis, and any notice or consent required, for the Customer Personal Data it provides.
4. Service provider commitments
Palazzo will not:
- Sell or share Customer Personal Data, as those terms are defined in the CCPA
- Keep, use, or disclose Customer Personal Data for any purpose other than the business purposes in Annex 1, or outside its direct business relationship with Customer
- Combine Customer Personal Data with personal information Palazzo receives from other sources, except as the CCPA permits a service provider to do
- Use Customer Personal Data to train or fine-tune AI models, or use Outputs to train or fine-tune models used for anyone other than Customer unless Customer opts in through the Data Rights Rider (MSA §8(f)(iv)), and never Outputs that contain Customer Personal Data
Palazzo may de-identify Customer Personal Data to the standard in MSA §9(c), during and after the Agreement. Once de-identified, it is no longer Customer Personal Data, and Palazzo may use it as the Agreement allows, including in aggregate benchmarks and trend reports that never identify Customer or any individual. Palazzo will not use Customer Personal Data that identifies Customer or any individual for benchmarking.
Palazzo will comply with Data Protection Laws that apply to it as a service provider, and will give Customer the same level of privacy protection those laws require. Palazzo will tell Customer if it can no longer meet its obligations. Customer may then take reasonable steps to stop and fix unauthorized use.
5. Confidentiality
Palazzo makes sure everyone authorized to process Customer Personal Data is bound by confidentiality obligations.
6. Security
Palazzo maintains the technical and organizational measures in Annex 2, appropriate to the risk. Palazzo may update them, as long as the overall protection doesn't decrease.
7. Subprocessors
- Customer authorizes Palazzo to use the Subprocessors on the list at palazzo.ai/legal/subprocessors.
- Palazzo binds each Subprocessor by written contract to data protection terms at least as protective as this DPA, and remains responsible for their performance.
- Palazzo will give at least 30 days' notice before adding a new Subprocessor, by updating the list and emailing Customers who have asked for updates at legal@palazzo.ai.
- Customer may object on reasonable data protection grounds within those 30 days. The parties will discuss in good faith. If no resolution is reached, Customer may end the affected Services and receive a pro-rated refund of prepaid fees for them.
Service providers Customer chooses and connects, such as Customer's own Shopify store, are Customer's own processors, not Palazzo's Subprocessors.
8. AI providers
When a feature needs an AI model, Palazzo sends the specific input to an AI Subprocessor for that request only. Palazzo uses AI Subprocessors only under terms or account settings that bar them from training their models on Customer Personal Data or Outputs, other than anonymized or aggregated usage data. Its retention of request copies is limited, and stated on the Subprocessor list.
9. Where data is processed
Palazzo processes Customer Personal Data in the United States. The Subprocessor list states each Subprocessor's location. Palazzo will update the list before processing Customer Personal Data in a new country.
If Customer is subject to the GDPR or UK GDPR, the parties will sign the applicable Standard Contractual Clauses or UK addendum on request.
10. Security Incidents
Palazzo will notify Customer without undue delay, and no later than 72 hours after confirming a Security Incident affecting Customer Personal Data. The notice will include what Palazzo knows about the nature of the incident, the data affected, and the steps taken, with updates as more is learned. Palazzo will reasonably help Customer meet its own notification obligations. This timing is built into Palazzo's incident response procedure (POL-SEC-004).
Notice of an incident isn't an admission of fault.
11. Help with requests and assessments
Palazzo will:
- Promptly forward to Customer any request it receives from an End User about Customer Personal Data, without responding itself unless Customer authorizes it
- Provide reasonable help, given the nature of the processing, for Customer to respond to requests to know, delete, correct, or opt out
- Provide reasonable information Customer needs for any data protection assessment the law requires
12. Deletion and return
When the Agreement ends, the deletion terms of the Agreement apply:
- Under the Master Subscription Agreement (MSA v2.2 §10): Customer may export its data for 60 days after the Agreement ends. Within the following 60 days, Palazzo de-identifies Customer Personal Data to the MSA §9(c) standard and deletes the identifying elements, confirming in writing on request. Palazzo keeps the de-identified data, and no longer processes it as Customer Personal Data.
- Under the self-serve Platform Terms (§18): Customer may export its data during the first 30 days after the Agreement ends. Within 90 days, Palazzo de-identifies Customer Personal Data and deletes the identifying elements.
In both cases, backup copies expire under Palazzo's backup schedule, and Palazzo keeps only what the law requires it to keep. For Customer Personal Data protected by the GDPR or the UK GDPR, Palazzo instead returns or deletes it (including copies) at Customer's written choice, unless the law requires it to be kept, and keeps derived data only if it is anonymous under those laws.
Database backups aren't edited to remove individual records. They expire on the schedule in Palazzo's retention policy, and if a backup is ever restored, Palazzo reapplies every deletion made since that backup before the system goes live. On request, Palazzo will confirm deletion in writing.
13. Audits
Once a year, on written request, Palazzo will answer a reasonable security questionnaire, and provide a summary of its security program and any relevant third-party reports it has. If a regulator requires more, or a Security Incident has occurred, the parties will agree on a reasonable additional review, at Customer's cost, with reasonable notice and confidentiality.
14. Liability and term
Each party's liability under this DPA is subject to the limitations in the Agreement. This DPA lasts as long as Palazzo processes Customer Personal Data.
Annex 1: Description of processing
| Item | Description |
|---|---|
| Services covered | Palazzo Spaces, Studio, Showcase, Stylist, the image API, and Customer-embedded widgets, including Room Stylist (for furniture and for mattresses) and Style Finder; and the retailer marketing programs Palazzo runs for Customer (Style Mail, Style Insights, and Style Leads) |
| Business purposes | Hosting, processing, and displaying Customer content; generating images, designs, and recommendations; running Customer-branded shopping and design tools; passing orders to the selling retailer; sending email and postal marketing on Customer's behalf, with Customer as sender of record; analyzing Customer's customer data for Customer; retrieving Customer's existing customer records when its staff request them; reporting to Customer; security; and support |
| People the data is about | Customer's End Users, such as shoppers, homeowners, clients, and site visitors; agents and brokers named in listings; people shown in uploaded photos; Customer's staff using the Services |
| Categories of data | Names and contact details; listing addresses, prices, and agent and broker details; room, listing, and product photos (which may incidentally show people); chat messages and design choices; session and device activity; order details passed to the seller; for retailers, the customer records, purchase and transaction history, and store details Customer provides for designs, recommendations, and personalized exports; for retailer marketing programs, postal addresses, purchase history, and email engagement |
| Sensitive data | Not intended. Customer won't provide sensitive personal information unless the Services require it. |
| Duration | The term of the Agreement, plus the deletion period in section 12 |
Annex 2: Security measures
Palazzo maintains these measures today:
- Encryption in transit: TLS 1.2 or 1.3 on public endpoints, with HTTP redirected to HTTPS.
- Credential encryption: customer MLS credentials encrypted with AWS KMS, with the key held separately from the data.
- Backups: an automated daily database backup copied off the application host.
- Staff access to company applications: Google Workspace single sign-on, with device posture checks (disk encryption, current operating system, screen lock) before access. Multi-factor authentication is required on every staff account from the first sign-in, with no grace period.
- Confidentiality: staff and contractors are bound by confidentiality obligations in their agreements.
Palazzo's security policies set further requirements that are being put in place. These include access reviews, restore testing, audit logging, secrets management, and controls on server access. Palazzo will add each measure here once it's in place.