Data Processing Addendum

Template version 0.1 · Effective [EFFECTIVE DATE]

This Data Processing Addendum ("DPA") is part of the agreement (the "Agreement") between [COMPANY LEGAL NAME] ("IdeaLine") and the customer organization that uses the IdeaLine service ("Customer"). It applies when IdeaLine processes personal data on behalf of Customer and reflects the requirements of Article 28 of the EU and UK General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act as amended ("CCPA") and similar laws ("Data Protection Laws"). Customer may request a signed copy at [PRIVACY CONTACT EMAIL].

1. Roles

For personal data in Customer's workspace (projects, comments, contacts and similar content), Customer is the controller (or business) and IdeaLine is the processor (or service provider). For account, billing and security data about Customer's users, IdeaLine acts as an independent controller as described in the Privacy Policy.

2. Processing instructions

IdeaLine will process personal data only on Customer's documented instructions, which are the Agreement, this DPA and Customer's use of the product (including export, delete and role settings), unless law requires otherwise, in which case IdeaLine will tell Customer first unless the law forbids it. IdeaLine will tell Customer if it believes an instruction infringes Data Protection Laws.

3. Details of processing (Annex I)

4. Confidentiality

IdeaLine ensures that people authorized to process personal data are bound by confidentiality duties and receive appropriate training, and limits access to those who need it.

5. Security measures (Annex II)

• Encryption of data in transit (TLS, HSTS) and at rest (provider-managed).
• Invitation-only access, role-based permissions and database row-level security that isolates each workspace.
• Append-only audit logging of changes, sign-ins and exports.
• Session time-outs with warning, and strong password requirements with email sign-in links as an alternative.
• Full encrypted backups every hour (AES-256-GCM) of the database and account list to storage held by a separate provider, with 35 days of hourly and 90 days of daily copies, integrity checks, failure alerts, and a documented restore procedure. [Confirm the backup job is live before signing]
• Separation of duties: service keys are stored only in the hosting provider's secret store, never in code.
• Vendor review of subprocessors; incident response and breach notification process.
• Regular review of access, dependencies and security headers. [Add penetration tests or certifications only when completed]

6. Subprocessors

Customer gives general authorization for IdeaLine to use the subprocessors listed in the Data Policy. IdeaLine will give at least [30] days' notice of any new subprocessor by email or in the product. Customer may object on reasonable data-protection grounds within that period; if the parties cannot resolve it, Customer may terminate the affected service and receive a pro-rata refund of prepaid fees. IdeaLine remains responsible for its subprocessors and binds them to terms no less protective than this DPA.

7. Assisting Customer

Taking into account the nature of processing, IdeaLine will help Customer respond to requests from data subjects (access, correction, deletion, portability, restriction, objection). Much of this is self-service: Customer can export all data, edit and delete content, and remove people. IdeaLine will also help with data protection impact assessments and prior consultations as reasonably required, at Customer's cost where significant effort is needed.

8. Personal data breach

IdeaLine will notify Customer without undue delay, and within [72] hours, after confirming a personal data breach affecting Customer's personal data, with the information it then has about the nature, likely consequences, data and people affected, and the measures taken or proposed. Updates follow as more is learned.

9. Return and deletion

Customer can export its data at any time. After the Agreement ends, IdeaLine will delete or anonymize Customer's personal data within [30] days, except that encrypted backups are overwritten on their normal cycle (hourly copies after 35 days, daily copies after 90 days) and IdeaLine may keep what the law requires. Data in backups is kept secure and is not used for any other purpose.

10. Audits and information

IdeaLine will make available the information needed to show compliance with this DPA, including its security statement, subprocessor list, accessibility and compliance documents, and will answer reasonable security questionnaires. Where that is not enough or a regulator requires, Customer may audit IdeaLine once a year on [30] days' notice, during business hours and under confidentiality, at Customer's cost, without access to other customers' data.

11. International transfers

Customer authorizes the transfers described in the Privacy Policy. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, the parties incorporate the EU Standard Contractual Clauses (Module Two: controller to processor, and Module Three where Customer is itself a processor), the UK International Data Transfer Addendum, and the Swiss amendments, with the details in Sections 3 and 5 above serving as Annexes I and II. [Select and complete options: Clause 7 docking, Clause 9 option 2 (general authorization, 30 days), Clause 11 optional redress not used, Clause 17 law of Ireland or another EU member state, Clause 18 courts. Check whether each provider also certifies under the EU-US Data Privacy Framework.]

12. California and other US state laws

IdeaLine is Customer's service provider (and processor). IdeaLine will not sell or share personal information, will not retain, use or disclose it for any purpose other than the business purposes in the Agreement or outside the direct business relationship with Customer, will not combine it with personal information from other sources except as permitted by law, will comply with applicable obligations and give the same level of privacy protection as the CCPA requires, will tell Customer if it can no longer meet them, and grants Customer the right to take reasonable steps to stop and remediate unauthorized use.

13. Liability and order of precedence

Liability under this DPA is subject to the limits in the Agreement, except where Data Protection Laws or the Standard Contractual Clauses do not permit it. If this DPA and the Agreement conflict about personal data, this DPA applies; if the Standard Contractual Clauses conflict with either, the Clauses apply.

14. Signatures