Data Processing Addendum
Customer is controller; Application operator is processor for tenant data.
Last updated 2026-09-01
Parties & Roles
This Data Processing Addendum (“DPA”) applies when a customer (“Customer”, “you”) uses Application to store or process personal data in a Business, and [Legal entity name] (“Processor”, “we”) processes that data on your behalf.
| Party | Role |
|---|---|
| Customer (Business account holder) | Controller for tenant CRM / ops personal data |
| [Legal entity name] (Application operator) | Processor for that tenant data |
| [Legal entity name] | Controller for account/login and platform admin data (outside this DPA’s processor role) |
Subject Matter & Duration
- Subject matter: hosting and processing of personal data that Customer submits into Application Business features.
- Duration: for the term of Customer’s use of Application and any post-termination retention period described in the Privacy Policy / this DPA.
- This DPA forms part of the Terms of Service between the parties.
Nature & Purpose
Processing is limited to providing Application features: storing, retrieving, updating, soft-deleting, displaying, and transmitting Business CRM/ops records, and related support/security operations.
Types of Personal Data & Subjects
Data subjects (typical)
- Customer’s own end customers, clients, company contacts, and other party records
- Customer’s team members invited into a Business (as relevant to membership data)
Personal data (typical)
- Names, emails, phone numbers, addresses, and other contact fields Customer enters
- Company affiliation and commercial records (invoices, quotes, expenses metadata)
- Files Customer uploads to object storage related to Business activity
Customer must not instruct us to process special-category data unless we have expressly agreed in writing.
Customer Obligations
- Ensure a lawful basis for all personal data uploaded into Application.
- Configure roles and Integration API credentials responsibly.
- Provide required notices to data subjects.
- Not use Application to violate privacy or other laws.
- Be the primary contact for data-subject requests about Customer’s CRM/ops records.
Processor Obligations
- Process tenant personal data only on documented Customer instructions (including via product configuration) unless law requires otherwise.
- Ensure personnel authorized to process data are bound by confidentiality.
- Implement appropriate technical and organizational security measures for Application.
- Assist Customer, where reasonably possible, with data-subject requests forwarded to [privacy@…].
- Notify Customer without undue delay after becoming aware of a personal-data breach affecting Customer tenant data.
- Not sell Customer tenant personal data.
Subprocessors
Customer authorizes us to engage the subprocessors listed at Subprocessors. We remain responsible for their performance as required by applicable law. Change-notice practices are described on that page.
International Transfers
Where personal data is transferred internationally, we will use appropriate safeguards (such as standard contractual clauses) as required. Production hosting region: [Confirm with product] / [Jurisdiction] context.
Deletion & Return
Many Application resources use soft-delete. Application does not currently offer a self-serve account deletion API or CSV export. Upon written request to [privacy@…], and subject to legal retention needs, we will delete or return Customer tenant personal data within a commercially reasonable period, or explain what cannot be deleted yet (for example backups or soft-deleted records still within retention).
Audit & Assistance
- We will provide information reasonably necessary to demonstrate compliance with this DPA.
- On-site audits, if required by law or a signed enterprise agreement, must be scheduled in advance, scoped narrowly, and subject to confidentiality.
- Security questionnaires may be answered by support/privacy contacts where available.
Contact
Privacy / DPA requests: [privacy@…]
Legal: [legal@…]
Support: [support@…]
Operator: [Legal entity name], [Registered address]
Related: Privacy Policy · Subprocessors · Terms of Service