Data Processing Addendum

1. Roles

You decide why and how Client Personal Data is processed. We process it only to build, configure, maintain, and support your Client Accounts and perform the tasks in your Order. We follow your documented instructions: your Order and the requests your authorized contacts send us. Under the California Consumer Privacy Act and similar state laws, we act as your service provider or processor.

2. Details of Processing

3. What We Won’t Do

• Sell Client Personal Data or share it for cross-context behavioral advertising
• Use, keep, or disclose it for any purpose other than the Services, or outside our direct business relationship with you
• Combine it with personal information from other sources, except as the law allows for the Services
• Contact your customers except as part of the Services you direct
• Put it into an AI tool except through an approved business account whose provider doesn’t train its models on it

We certify that we understand these restrictions and will follow them. If we can no longer meet our obligations under applicable privacy law, we will tell you, and you may take reasonable steps to stop unauthorized use of the data.

4. Your Obligations

You are responsible for having the notices, consents, and legal basis needed to collect Client Personal Data and to send the messages you direct us to set up or send.

Don’t give us protected health information, payment card numbers, government ID numbers, or other sensitive personal information unless we agree in writing first. If your Client Accounts hold protected health information, tell us before work starts. We work in accounts that hold protected health information only after we both sign a business associate agreement, and we don’t sign one by default.

5. Our Team

Only Team Members assigned to your account access Client Personal Data, and only as their work requires. Every one of them signs a nondisclosure agreement. We remove a Team Member’s access within 1 US business day after they leave your account, or ask you to remove any user we can’t.

6. Security Measures

• Individual logins for every Team Member, never shared accounts
• Multi-factor authentication on Client Accounts and our own systems wherever the platform supports it
• Logins stored in a password manager, never in chat or email
• An export of the affected data and a snapshot of the account’s assets before any import, migration, bulk edit, or deletion
• Client data downloaded to a device only when a task requires it, and deleted when the task is done
• Approved AI tools only, through business accounts

7. Service Providers

We use the service providers listed in our Privacy Policy, under written terms that impose data protection obligations consistent with this DPA. We email active clients at least 14 days before adding a provider that will process Client Personal Data. If you object and we can’t resolve it, you may cancel without serving the 30-day notice period.

8. International Access

Team Members and service providers access Client Personal Data from outside the United States, never from a country the US government lists as a country of concern for data security. This DPA applies wherever the data is accessed.

9. Security Incidents

If we confirm a security incident affecting Client Personal Data, we notify you without undue delay and within 72 hours after we confirm it. We share what we know, take steps to contain it, and cooperate with your response. We don’t notify your customers or regulators for you unless you direct us to or the law requires it.

10. Requests and Assistance

If one of your customers asks us to access, correct, or delete their information, we send the request to you and help you respond within the scope of the Services. We give reasonable help with your privacy assessments that involve our work.

11. Return and Deletion

When the Services end, we remove our access within 1 US business day, or ask you to remove any user we can’t. Within 30 days, we return any Client Data you ask for in a standard export format and delete the copies we hold outside your Client Accounts, except records the law requires us to keep and backups that expire on their normal schedule. We keep build documentation that contains no personal information, so we can support you if you come back.

12. Security Questionnaires

Once a year, on 30 days’ notice, we answer a reasonable written security questionnaire about how we handle Client Personal Data. Where your privacy law requires it, we also cooperate with a reasonable assessment by an independent assessor you choose, at your cost.

13. Order of Precedence

If this DPA conflicts with the Terms on how we handle Client Personal Data, this DPA controls. Liability under this DPA is subject to the Terms’ limitation of liability.

14. Contact Us

Questions about this page go to hello@highleveladmins.com, or by mail to: