Data Processing Agreement (DPA)

• “Personal Data” means personal information as defined by the Israeli Privacy Protection Law, 5741–1981, as amended, including by Amendment No. 13, and any personally identifiable information uploaded to the System by the Controller, such as Leads, inquiries, and customer details.
• “Controller” means a build it up business customer that determines the purposes and means of processing its Personal Data.
• “Processor” means build it up, which processes Personal Data on the Controller’s behalf under its instructions and this Addendum.
• “Sub-Processor” means an external service provider to which build it up transfers Personal Data to provide the Service, as listed in Section 5.
• “Data Security Incident” has the meaning assigned to it under the Israeli Privacy Protection Regulations (Data Security), 5777–2017.

Subject matter: hosting landing pages, managing content, and receiving Leads and contact forms for the Controller.

Types of Personal Data: name, email address, phone number, message content, IP address, and any other field configured by the Controller in a form.

Categories of Data Subjects: end Users of the Controller’s websites, including prospective customers and Visitors.

Duration: for as long as the engagement remains in effect and for a reasonable retention period afterward, as described in Section 8.

build it up will process Personal Data solely in accordance with the Controller’s documented instructions and subject to applicable law.

build it up undertakes to:

• Process Personal Data solely to provide the Service to the Controller and in accordance with the Controller’s instructions.
• Implement reasonable technical and organizational security measures, including HTTPS/TLS encryption in transit, password encryption, role-based access controls (RBAC), backups, and log retention.
• Impose confidentiality obligations on employees, contractors, and stakeholders who access Personal Data, and limit access to personnel with a need to know.
• Assist the Controller, to the extent reasonably possible, in fulfilling its legal obligations, including responding to Data Subject requests under Section 6.
• Not transfer Personal Data to a third party without the Controller’s consent or instruction, except to the Sub-Processors listed in Section 5.

In accordance with the Israeli Privacy Protection Regulations (Data Security), 5777–2017 and the risks relevant to the Service, build it up implements measures including the following, as applicable to each component and its configuration:

• TLS 1.2+ encryption in transit and HTTPS-only access.
• Encryption-at-rest protections and backup capabilities provided by the database infrastructure.
• Strong authentication, including encrypted passwords and OAuth, and role-based permission management.
• Separation of development and production environments and access controls.
• Event and material-change logging where such mechanisms are configured.
• Security, permission, and software-dependency checks as part of development and launch processes.

The Controller authorizes the transfer of Personal Data to the following Sub-Processors, which are subject to corresponding data-security and privacy obligations:

build it up will notify the Controller of the replacement or addition of a material Sub-Processor, and the Controller may object on reasonable grounds.

Payment services (Grow), maps, Google sign-in, and Meta, WhatsApp, Telegram, or other integrations are used only when the relevant action or connection is selected. In those cases, the provider may also act as an independent controller under its own terms, and the Customer remains responsible for ensuring that the connection matches its purposes and privacy notices.

build it up will assist the Controller, through reasonable measures and subject to the System’s technological capabilities, in responding to Data Subject requests to exercise rights under applicable law, including access, correction, deletion, and objection.

The Controller is responsible for receiving and documenting requests from its Data Subjects and submitting them in writing to support@builditup.io.

Privacy inquiries (Amendment 13): inquiries concerning privacy and processing under this Addendum may be submitted through the official support address above.

In the event of a material Data Security Incident affecting the Controller’s Personal Data, build it up will notify the Controller without undue delay, targeting notice within 24 hours after discovery and in all cases no later than 72 hours, unless applicable law requires earlier notice. The notice will include the reasonably available information, including:

• The nature and time of the Incident.
• The types of Personal Data that may be affected.
• Measures taken or proposed to mitigate harm.
• A contact person for further inquiries.

Upon termination of the engagement, and at the Controller’s choice, build it up will return Personal Data to the Controller in a commonly used format, such as a CSV or JSON export of Leads, and/or delete it from its systems within a reasonable period, except for information that must be retained by law.

The Controller acknowledges that the Sub-Processors listed in Section 5 may store or process Personal Data in countries outside Israel, including the United States and the European Union. build it up will ensure that such transfers are subject to reasonable safeguards under applicable Israeli law, including the Israeli Privacy Protection Regulations (Transfer of Data to Databases Outside the State Borders), 5761–2001.

build it up’s liability under this Addendum is subject to the limitations of liability in the System’s Terms of Use. The Controller is responsible for determining processing purposes, establishing a lawful basis for collecting Personal Data from its end Users, obtaining required consents, and meeting obligations that apply to it under the Israeli Privacy Protection Law and its regulations.

The Controller determines the content of its forms, consent notices, marketing messages, website privacy policy, and use of Leads after delivery. build it up remains responsible for processing performed under this Addendum, its security controls, and legal obligations that apply to it.

This Addendum is governed by the laws of the State of Israel. Proceedings shall be brought before the court that has jurisdiction under applicable law. Where the law permits the parties to agree on venue and the engagement is not a consumer transaction, venue shall be in the Southern District unless the parties agree otherwise in writing.

This Addendum automatically applies to every build it up business customer that processes Personal Data through the System. Customers requiring a physically signed copy or customized commercial terms may contact us: