Data Processing Addendum

“Data Protection Laws” means laws that apply to the processing of Customer Personal Data, including the EU GDPR, the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended (CCPA), other US state privacy laws, and India’s Digital Personal Data Protection Act 2023. “Customer Personal Data” means personal data in Customer Content (as defined in the Terms) that we process for you. “Controller”, “processor”, “data subject”, “personal data breach”, and “processing” have the meanings given in the GDPR.

For Customer Personal Data, you act as controller or as processor for your own clients, and we act as your processor or sub-processor. If you act as a processor, you confirm your clients have authorized you to use us.

We will:

• process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and your use and settings of the Service, unless the law requires otherwise (in which case we will tell you unless the law forbids it);
• tell you if we believe an instruction breaks Data Protection Laws;
• ensure people authorized to process Customer Personal Data are bound by confidentiality;
• apply the security measures in Annex 2;
• taking into account the nature of processing, help you respond to data subject requests and meet your obligations on security, breach notification, impact assessments, and consultations with regulators;
• not sell Customer Personal Data, not share it for cross-context behavioral advertising, not retain, use, or disclose it for any purpose other than providing the Service, and not combine it with personal data from other sources except as the CCPA allows a service provider to; and
• comply with Data Protection Laws that apply to us as a processor.

You are responsible for having a lawful basis and giving any notices needed for the Customer Personal Data you put into or collect through the Service, for the accuracy of that data, and for your instructions complying with Data Protection Laws. Do not upload special-category data unless it is strictly necessary and lawful.

You give general authorization for us to use sub-processors. Our current sub-processors are listed in our Privacy Policy (Supabase, Vercel, Paddle, Resend, OpenAI, and Google). We impose data protection terms on each sub-processor that are at least as protective as this DPA and remain responsible for their performance.

We will give at least 14 days’ notice (by email or in the app) before adding or replacing a sub-processor that processes Customer Personal Data. You may object on reasonable data protection grounds within that period. If we cannot reasonably address the objection, you may cancel the affected Service and receive a pro-rated refund of prepaid fees for the remaining period.

We will notify you without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will share the information we reasonably can about the nature of the breach, likely consequences, and measures taken, and update you as we learn more. Notifying us of a breach is not an admission of fault.

You can export documents and delete clients, privacy requests, and other Customer Personal Data in the Service at any time. When your account is closed, we delete Customer Personal Data within 30 days (after a 14-day period during which the closure can be reversed), unless the law requires us to keep it. Copies in backups expire on their normal backup schedule and are not used in the meantime.

On written request, we will provide information reasonably necessary to show compliance with this DPA, such as a description of our security measures and our sub-processors’ certifications. If that is not enough to meet a requirement of Data Protection Laws, you may conduct an audit once per year, at your cost, with at least 30 days’ notice, during business hours, under confidentiality, and without access to other customers’ data.

We are based in India and our sub-processors may process data in the United States and other countries. To the extent Customer Personal Data subject to the EU GDPR is transferred to a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) are incorporated by reference: Module 2 where you are a controller and Module 3 where you are a processor, with you as data exporter and us as data importer, the optional docking clause and clause 11 option not applying, general authorization under clause 9(a) with the notice period in section 5, the governing law and courts of Ireland under clauses 17 and 18, and Annexes 1 and 2 of this DPA completing Annexes I and II. For data subject to the UK GDPR, the UK International Data Transfer Addendum to those clauses applies. If these clauses conflict with the rest of this DPA, the clauses prevail.

Each party’s liability under this DPA is subject to the limitations in the Terms, except where Data Protection Laws do not allow such limitations. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails. This DPA lasts as long as we process Customer Personal Data for you.

• Subject matter and duration: providing the Service for the term of the Customer’s account and the deletion period after it.
• Nature and purpose: storing and organizing client records; generating compliance documents; hosting privacy-center pages and request forms; recording cookie-consent choices; sending notifications to the Customer; producing reports.
• Data subjects: the Customer’s clients’ staff and contacts; individuals who submit privacy requests through a privacy center; visitors to the Customer’s clients’ websites who make a cookie-consent choice.
• Categories of data: names, business email addresses, roles; request type and free-text messages; consent choices, timestamps, and browser user-agent strings.
• Special-category data: none intended. Free-text messages may contain whatever a requester chooses to write.
• Frequency: continuous, while the Service is in use.

• Encryption in transit (TLS) for all traffic; provider-managed encryption at rest.
• Logical separation of each agency’s data; every request is checked against the signed-in agency before data is read or changed.
• Passwords stored hashed by our authentication provider; optional Google sign-in.
• In the app, documents are served through links that check the signed-in agency, not raw storage URLs. Documents the Customer publishes on a privacy center are public by design.
• Production access limited to the people who operate the Service.
• Hosting and database providers with independent security certifications (such as SOC 2).
• Backups maintained by our database provider.
• Audit history of key actions in each client workspace.

Data protection questions or requests for a countersigned copy: hello@compliagency.com.