Floburn Data Protection Terms

What these terms are. These terms are part of each MicroForensics Engagement Letter that names this version by its date, as if set out in it, and are read with that letter's Schedule A, which states the Business Purposes, where Personal Information is held, the Security Incident notice, the notice and objection right before a Subprocessor is added or replaced, and Floburn's certification. Where these terms and that signed document disagree, the signed document prevails. Floburn keeps every version of these terms at its own address for as long as an Agreement that names it runs, and gives the Client a PDF of any version on request. A later version binds the Client only by a Change Order, Operated-Service Order or amendment signed by both Parties, as the Agreement provides; the classes table below changes by the notice the Agreement requires before a class is added. In these terms "the Agreement" means that Engagement Letter with its Schedules and every Statement of Work, Operated-Service Order and Change Order signed under it; "the Client" and "Floburn" are its Parties, each a "Party"; and a capitalized term has the meaning the Agreement gives it.

Definitions

In the Agreement and these terms: "CCPA" means the California Consumer Privacy Act, Civil Code §1798.100 and following, as amended, and its regulations; "Personal Information" and "Sensitive Personal Information" have the meanings in Civil Code §1798.140 and include information about Workers; "Processing" means any operation on Personal Information, including remote access; and "Subprocessor" means any person Floburn engages to assist in Processing it.

Roles under the CCPA

Where the CCPA applies to the Client, the Client is the business and Floburn its service provider under the Agreement; otherwise the same terms govern. Nothing here states whether the CCPA applies to the Client.

Instructions, and notice at collection

Floburn Processes Personal Information on the Client's documented instructions, which are the Agreement and the written instructions the Sponsor or the Custodian of Records gives under it, and tells the Client in writing before acting on an instruction it considers would breach the CCPA or another law that applies to it.

Notice to Workers at collection is the Client's to give, as the business and employer; Floburn gives it on no one's behalf.

What Floburn shall not do, and shall do, as the CCPA requires of a service provider

Floburn shall not: (a) sell or share Personal Information; (b) retain, use or disclose it for any purpose, including any commercial purpose, other than the Business Purposes, or outside the direct business relationship between the Parties; or (c) combine it with Personal Information from any other source, except as the CCPA regulations permit a service provider to do.

Floburn shall: (a) comply with the CCPA's obligations on a service provider, give Personal Information the same level of privacy protection the CCPA requires of a business, and keep reasonable security procedures appropriate to it; (b) tell the Client in writing within five Business Days if it determines that it can no longer meet those obligations; (c) allow the Client to take reasonable and appropriate steps to check that Floburn uses Personal Information consistently with the Client's obligations under the CCPA, as "Questionnaire and audit" below states; (d) on written notice from the Client, stop and remediate any unauthorized use of it; and (e) enable the Client to answer Workers' requests under the CCPA, as "Workers' requests" below states.

Artificial intelligence: the two bounded tasks

The software that collects, stores and seals the Record is deterministic code; no AI model sits in that path.

Within the Software, AI performs two bounded tasks: where a payroll name could match more than one Worker record, a model suggests which and a person decides; and a model drafts the standard Worker messages, which a person edits and approves before any Worker sees them.

No model fires an attestation, changes a record, signs anything or presents a decision to a Worker; AI-drafted text is a draft until a person approves it.

What an AI provider receives

An AI provider receives only what its task needs: for message drafting, the message kind, the Worker type and the current wording, with no names and no records; for name matching, the name in the Client's payroll file, the names and Worker types of the records it might match and the match score, names kept as written because the task compares them. Clause 9 of the Agreement states what is never sent to a model.

The records diagnostic: the secure upload channel

Records sent for the records diagnostic travel only through the secure upload channel the Subprocessor List names for the records diagnostic, never as email attachments, and are held in the United States. Data the classes table below lists as not held is not sent; any that arrives is quarantined, redacted or returned, noted in Floburn's intake log, never loaded into the service, and destroyed on receipt, notwithstanding the retention period in clause 7 of the Agreement.

Workers' requests

A Worker's request to know, correct or delete their Personal Information goes to the Client, as the business. Floburn routes any it receives to the Client without acting on it, gives the Client the information and assistance it needs to answer within the period the CCPA allows a business, and acknowledges the Client's request for assistance within five Business Days, or any shorter time the service levels of the Implementation SOW state where they apply. The Custodian of Records may export one Worker's records as a verified package, like any other export. Floburn never deletes from or alters the Record on a Worker's request; whether a request reaches a record the Client keeps by law is the Client's counsel's question, and nothing is deleted until it is answered.

Questionnaire and audit

Once a year on request Floburn completes the Client's security questionnaire with the evidence behind its answers, and tells the Client within 30 days of any material reduction in the posture those answers describe. No on-site audit, except where a regulator with jurisdiction over the Client requires one, at the Client's cost and on reasonable notice.

Subprocessors

Floburn's Subprocessors, each with its function, the classes of Personal Information it touches, its region and its retention, are those the Floburn Subprocessor List names, published at floburn.com/terms/subprocessors, in the version the Agreement names by date. Floburn keeps every version of that list at that address and publishes a change as a new dated version after the notice the Agreement requires before a Subprocessor is added or replaced.

De-identified operating measures: the conditions

Floburn keeps and uses the de-identified, aggregated operating measures from the Client's instance that the Agreement permits only provided they cannot reasonably be associated with the Client, a site, a Worker or a household, Floburn does not attempt to re-identify them, and anyone Floburn shares them with agrees to the same. They never include names, contact details, hours, wages or the text of any attestation or message; are never placed in another client's record, shown to or used to serve another client, or used to train any model, by Floburn or by a provider; and sit outside the copy Floburn deletes under clause 7 of the Agreement.

The classes of Personal Information Floburn holds and does not hold

The table lists the classes of Personal Information Floburn holds and does not hold. A class is added only after Floburn tells the Client in writing, before it is collected, as the Agreement states; the table changes by that notice.