Bluu Data Processing Addendum

Last updated: November 13, 2026

This Data Processing Addendum ("DPA") is part of the agreement between LA Media Group LLC, a Florida limited liability company at 3134 Peachtree Cir, Davie, FL 33328 ("LA Media Group", "we" or "us"), and the business that uses Bluu ("you" or "Customer") under our Terms of Service. It applies automatically when you accept the Terms of Service, and no separate signature is needed. Words such as "Customer Data", "Your Customers" and "Agreement" have the meanings given in the Terms of Service.

1. Definitions

• "Data Protection Laws" means the US federal and state laws on privacy and data protection that apply to the processing of Customer Personal Data under the Agreement, including the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations ("CCPA"), and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states.
• "Customer Personal Data" means personal data in Customer Data that we process on your behalf under the Agreement.
• "Personal data" means information that identifies, relates to or could reasonably be linked to an individual or household, and includes "personal information" as defined by the CCPA.
• "Processing" means any operation performed on personal data, such as collecting, storing, using, disclosing or deleting it.
• "Subprocessor" means a third party we engage to process Customer Personal Data.
• "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to, Customer Personal Data in our systems or those of our Subprocessors. Unsuccessful attempts that don't compromise Customer Personal Data, such as pings, port scans, blocked sign-in attempts and denial-of-service attacks, are not Security Incidents.
• "Controller", "processor", "business" and "service provider" have the meanings given in the Data Protection Laws.

2. Roles

2.1 You are the controller. For Customer Personal Data, you are the controller (a "business" under the CCPA), and we are your processor (a "service provider" under the CCPA). You decide why and how Customer Personal Data is processed. We process it on your behalf.

2.2 Our own data. We are an independent controller for personal data about you and your Team Members, such as account, billing and usage information, and for visitors to our own websites. Our Privacy Policy covers that data, not this DPA.

2.3 Your responsibilities. You are responsible for:

• having a lawful basis for collecting and processing Customer Personal Data, and for giving every notice and getting every consent the Data Protection Laws and other laws require, including for texts, emails, chat recording and AI processing;
• making sure your instructions to us comply with the law;
• the accuracy and quality of Customer Personal Data;
• not putting protected health information into Bluu unless a Business Associate Agreement is signed with us, as Section 17 of the Terms of Service requires, and complying with any state consumer health data laws that apply to you;
• not putting into Bluu the categories of data that Section 14.6 of the Terms of Service prohibits; and
• responding to requests from Your Customers about their personal data.

3. Details of the processing

• Subject matter: providing Bluu to you under the Agreement.
• Duration: for as long as the Agreement is in effect, and afterwards until the data is deleted under Section 10.
• Nature and purpose: hosting, storing, organizing, displaying, analyzing, transmitting and deleting Customer Personal Data to provide Bluu's features as you use and configure them, including your CRM, leads, chat and AI chat, booking, reviews, forms, pipeline, email and text messaging, social posting, listings, analytics, events, products and packages and AI tools; providing support; and keeping Bluu secure.
• Types of personal data: names; contact details such as email addresses, phone numbers and postal addresses; the content of messages, chats, form answers, reviews and notes; appointment and booking details; consent and unsubscribe records; email and text delivery and engagement data; payment details received from your connected Stripe account, such as amounts, status and payer name and email; files you upload; IP addresses and device information of visitors who use your chat, forms and booking pages; and any other personal data you choose to put into Bluu.
• People the data is about: Your Customers, including your customers, leads, website visitors, people who book with you, fill in your forms, chat with you, leave reviews or receive your messages; your Team Members; and anyone else whose data you put into Bluu.
• Sensitive data: you should not put sensitive personal data into Bluu except where you have every consent the law requires. Section 2.3 lists the data you must never put into Bluu.

4. Processing on your instructions

4.1 Your instructions. We process Customer Personal Data only on your documented instructions. The Agreement, your configuration and use of Bluu, and the requests you send us through the dashboard or by email are your complete instructions. Instructions outside the scope of the Agreement must be agreed in writing and may carry a fee.

4.2 Unlawful instructions. If we believe an instruction breaks the Data Protection Laws, we will tell you, and we may decline to follow it.

4.3 When the law requires otherwise. We may process Customer Personal Data where the law requires it. We will tell you first unless the law forbids it.

5. Confidentiality of our people

We make sure that everyone we authorize to process Customer Personal Data is bound by a duty of confidentiality and has access only to the extent they need it to provide Bluu.

6. Subprocessors

6.1 Permission. You give us general permission to use Subprocessors to provide Bluu. We use Subprocessors in these categories:

• hosting providers;
• database and file storage providers;
• email delivery providers;
• SMS and phone providers;
• AI providers;
• publishing providers that help us post your content and business information to the platforms and directories you choose;
• scheduling and customer support tools; and
• security and monitoring providers.

When you connect your own accounts with Google, Meta, Stripe or another platform, that platform processes data under its own agreement with you. It is not our Subprocessor.

6.2 Our commitments. We put a written agreement in place with each Subprocessor that requires it to protect Customer Personal Data at least as well as this DPA requires, to the extent relevant to its services. We remain responsible to you for our Subprocessors' performance of those obligations.

6.3 New categories. If we add a new category of Subprocessor, we will tell you by email at least 15 days before it starts processing Customer Personal Data. If you have a reasonable objection based on data protection, email us within those 15 days. We will discuss it with you in good faith. If we can't address your objection, you may cancel the affected part of Bluu under the Terms of Service.

7. Security

We use technical and organizational measures designed to protect Customer Personal Data against Security Incidents, appropriate to the risk. Schedule 1 summarizes them. We may update these measures as technology and threats change, as long as we don't materially reduce the overall protection of Customer Personal Data.

8. Security Incidents

8.1 Notice. We will tell you without undue delay, and in any case within 72 hours after we confirm a Security Incident affecting your Customer Personal Data.

8.2 What we tell you. As far as we know it at the time, and updated as we learn more, we will describe what happened, the categories and approximate number of people and records involved, the likely consequences, and the steps we have taken or will take to contain it and reduce harm.

8.3 Our help. We will take reasonable steps to contain and investigate the incident and will give you reasonable help with notices you must give to individuals or regulators.

8.4 Who notifies. As controller, you are responsible for notifying Your Customers and regulators where the law requires, unless the law requires us to do it directly.

8.5 No admission. Notifying you of a Security Incident is not an admission of fault or liability.

8.6 How we notify. We send notices to the Account Owner's email address. Keep it current.

9. Help with requests and assessments

9.1 Requests from individuals. Bluu has tools that let you find, correct, export and delete personal data about Your Customers. If we receive a request from one of Your Customers about Customer Personal Data, we will pass it to you and will not respond ourselves, except to tell the person to contact you, unless the law requires otherwise. Where you can't fulfil a request with Bluu's tools, we will give you reasonable help.

9.2 Assessments and regulators. We will give you reasonable information and help with data protection assessments and with inquiries from regulators about our processing, to the extent you can't get that information yourself.

9.3 Cost. Help beyond what Bluu's tools provide, or beyond a reasonable amount, may carry a reasonable fee.

10. Deleting and returning data

10.1 During your subscription. You can export Customer Personal Data with the tools in the dashboard, and can ask us by email for a copy of anything they don't cover.

10.2 After your account ends. We keep Customer Personal Data for 30 days after your account ends, so you can restart your plan or ask for an export. We then permanently delete it within the following 30 days. Copies in our encrypted backups are gone within 7 more days as the backups roll over. Uploaded files are deleted immediately and permanently, with no backup copy. You can ask us to delete it sooner.

10.3 What we keep. We may keep Customer Personal Data where the law requires it, or where we reasonably need it to establish or defend legal claims. We also keep the records of consent and unsubscribes for messages sent from your account for at least 5 years, because they are the evidence of consent you may need and they stop people who opted out from being contacted again. Anything we keep stays protected by this DPA and is used only for those purposes.

10.4 Confirmation. If you ask, we will confirm in writing that deletion is complete.

11. Information and audits

11.1 Information. We will make available the information reasonably needed to show that we comply with this DPA. Once a year, if you ask, we will answer a reasonable written security questionnaire.

11.2 Audits. We don't offer on-site audits except where the Data Protection Laws require one and the information in Section 11.1 isn't enough. In that case, you must give us at least 30 days' written notice; the audit is limited to once in any 12 months, takes place during business hours, is conducted by you or an independent auditor bound by confidentiality and is at your cost; and it must not access other customers' data or compromise our security.

12. CCPA and other state law commitments

As your service provider and processor, we:

• will not sell or share Customer Personal Data, as "sell" and "share" are defined in the CCPA;
• will not keep, use or disclose Customer Personal Data for any purpose other than the business purposes set out in the Agreement, including for any commercial purpose other than providing Bluu, or outside our direct business relationship with you, except as the Data Protection Laws allow;
• will not combine Customer Personal Data with personal data we receive from or on behalf of anyone else, or collect from our own interactions with individuals, except as the CCPA's regulations allow, such as to provide Bluu or keep it secure;
• will comply with the Data Protection Laws that apply to us as your processor, and give Customer Personal Data the level of privacy protection they require;
• will tell you if we decide we can no longer meet our obligations under the Data Protection Laws;
• allow you to take reasonable and appropriate steps to make sure we process Customer Personal Data in line with the Data Protection Laws, and to stop and fix any unauthorized processing; and
• certify that we understand and will comply with these restrictions.

We may create de-identified or aggregated information from Customer Personal Data, as the Data Protection Laws allow, and won't try to re-identify it.

13. Where data is processed

We store and process Customer Personal Data in the United States. Bluu is offered to businesses located in the United States and is designed for US data protection laws. If you collect personal data from people outside the United States, you are responsible for making sure that putting it into Bluu complies with the laws that apply to it.

14. HIPAA

This DPA is not a Business Associate Agreement. Section 17 of the Terms of Service applies to protected health information.

15. Liability

Our liability under or in connection with this DPA is subject to the limits and exclusions in Section 28 of the Terms of Service, as if this DPA were part of it. Your indemnity in Section 29 of the Terms of Service covers claims arising from your instructions, your collection of Customer Personal Data and your breach of this DPA.

16. Duration and conflicts

This DPA lasts for as long as we process Customer Personal Data for you. If it conflicts with the Terms of Service on the processing of Customer Personal Data, this DPA controls. If we update this DPA, Section 33 of the Terms of Service applies, and we won't reduce the protection of Customer Personal Data without notice.

Schedule 1: Summary of security measures

• Encryption: all traffic encrypted in transit; stored data encrypted at rest by our database provider; backups encrypted.
• Separation between businesses: each business's data is kept separate from every other business's at the database row level, and we regularly test that one business can't read another's.
• Access control: access to production systems limited to the few people who need it; access inside each Bluu account controlled by the roles you set.
• Connected accounts: access tokens for Google, Meta and other platforms stored on our servers, where no browser can read them.
• Payments: card payments handled by Stripe, so card numbers never reach our systems.
• Public endpoints: limits on the rate and size of requests to the chat, forms and booking pages to prevent abuse.
• Backups: daily database backups kept for about 7 days.
• Testing and monitoring: automated tests of security and data separation, regular security scans and logging of server activity.
• Messaging safeguards: automatic handling of opt-outs, unsubscribes, bounces and spam complaints, and sending limits for new accounts.
• Response: a process for investigating and responding to Security Incidents, including the notice in Section 8.