Data Processing Addendum
This Data Processing Addendum ("DPA") is part of the Terms of Service between [Legal business name], doing business as Pro Site Link ("Pro Site Link"), and the business that uses the Service ("Customer"). It applies when Pro Site Link processes personal information contained in Customer Data on Customer's behalf.
1. Roles
Customer is the "business" or "controller" of Customer Data. Pro Site Link is Customer's "service provider" or "processor." Customer decides what information to store and is responsible for having a lawful basis and giving required notices.
2. Instructions and purpose
Pro Site Link processes Customer Data only to provide, secure, support and improve the Service as described in the Terms, and on Customer's documented instructions, which include Customer's use of the Service's features. Pro Site Link will tell Customer if it believes an instruction breaks the law.
3. California service provider terms
Pro Site Link will not: sell or share Customer Data; retain, use or disclose it for any purpose other than the business purposes in this DPA, including for its own commercial purposes or outside the direct business relationship with Customer; or combine it with personal information from other sources except as the law allows for service providers. Pro Site Link will comply with the California Consumer Privacy Act as it applies to service providers, give the same level of privacy protection the law requires, and notify Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and fix unauthorized use.
4. Confidentiality
People who can access Customer Data at Pro Site Link are bound by confidentiality and access it only as needed to provide the Service or support Customer.
5. Security
Pro Site Link maintains reasonable technical and organizational measures, including encryption in transit, separation of each company's records with access rules, role-based permissions, secure password hashing, session management and regular backups by our database provider.
6. Sub-processors
Customer authorizes the sub-processors listed on our Sub-processors page. Pro Site Link requires each to protect data at least as well as this DPA and remains responsible for their work. We will update that page and notify account owners at least 30 days before adding a new sub-processor. Customer may object on reasonable data protection grounds; if we cannot resolve it, Customer may cancel the affected plan.
7. Helping with requests
Pro Site Link gives Customer tools to access, correct, export and delete Customer Data, and will reasonably help Customer respond to requests from individuals. If we receive a request about Customer Data directly, we will forward it to Customer.
8. Security incidents
Pro Site Link will notify Customer without undue delay, and where feasible within 72 hours, after confirming a breach affecting Customer Data, and will share the information Customer reasonably needs to meet its own obligations.
9. Deletion and return
Customer can export Customer Data at any time. When a company is closed, Customer Data is erased 14 days later, and removed from backups as they expire on their normal schedule, unless the law requires us to keep it.
10. Information and audits
Pro Site Link will provide information reasonably needed to show compliance with this DPA, on reasonable notice and no more than once a year unless required by a regulator or after a breach.
11. International transfers
Customer Data is processed in the United States. Where data protection laws of the European Economic Area, the United Kingdom or Switzerland apply, the parties agree that the applicable Standard Contractual Clauses apply to the transfer.
12. Order of precedence
If this DPA conflicts with the Terms about personal information, this DPA controls.