This Data Processing Addendum ("DPA") is part of the agreement between [LEGAL ENTITY NAME] ("Provider") and the Customer named in the Order Form. It applies to personal data that Provider processes for the Customer in providing Certified Arborist Pro ("Customer Personal Data", a part of Customer Data).
1. Roles
The Customer is the controller (or, under U.S. state laws, the "business") and Provider is the processor (the "service provider"). Provider processes Customer Personal Data only to provide the Service, on the Customer's documented instructions, which are the agreement, the Customer's use of the Service's features, and written support requests. Provider will tell the Customer if it believes an instruction breaks the law. Provider does not sell or share Customer Personal Data, does not retain, use or disclose it outside the direct business relationship or for any purpose other than providing the Service (including commercial purposes of its own), and does not combine it with personal data from other sources, except as the law permits for security and fraud prevention. Provider certifies that it understands and will follow these restrictions.
2. Details of the processing
| Subject matter and purpose | Hosting and operating the Customer's dedicated field-service system: scheduling, routing, documentation, invoicing, email, reminders, reporting, and support |
|---|---|
| Duration | The term of the agreement plus the return window and deletion period in Section 6 of the Terms |
| Data subjects | The Customer's clients and their contacts; the Customer's employees, contractors and applicants; people who email the Customer; the Customer's users |
| Categories of personal data | Names, addresses, map coordinates, phone numbers, emails, job and invoice history, photographs, notes, account details; for staff, pay, certifications and licence numbers, time off, reviews, injury records, and (optionally) Social Security numbers; email message content when a mailbox is connected |
| Special categories | No special categories are intended. Employee Social Security numbers and injury records are sensitive; the Customer must limit them to what it lawfully needs (Terms, Section 4) |
| Frequency and nature | Continuous: storage, retrieval, transmission, backup, and deletion, plus the operations the Customer's users perform in the Service |
3. Provider's obligations
- Confidentiality. Everyone at Provider with access to Customer Personal Data is bound by confidentiality duties and has access only as needed for the Service.
- Security. Provider maintains the measures in Annex A and may improve them but will not materially weaken them.
- Subprocessors. The Customer authorizes the subprocessors in Annex B. Provider will give at least [30] days' notice (by email to the account owner or on this page) before adding or replacing one that receives Customer Personal Data, and the Customer may object on reasonable data-protection grounds within that period; if the objection cannot be resolved, the Customer may terminate the affected Service and receive a pro-rata refund of prepaid fees. Provider binds each subprocessor to data-protection terms no less protective than this DPA and remains responsible for it. Services the Customer itself connects (its own Microsoft 365, QuickBooks or Stripe account) are the Customer's choice, not Provider subprocessors, and are listed for transparency.
- Assistance. Taking into account the nature of the Service, Provider will help the Customer answer requests from individuals (access, correction, deletion, portability, restriction, objection); the Service's search, edit, archive and Export Everything features let the Customer do most of this itself. If an individual contacts Provider directly, Provider will refer them to the Customer. Provider will reasonably assist with data-protection impact assessments and regulator enquiries that relate to the Service, at the Customer's cost beyond a reasonable amount of time.
- Incidents. Provider will notify the Customer's account owner without undue delay and within [72 hours] after confirming a personal-data breach affecting Customer Personal Data, with the information it has (nature, data and individuals affected, likely consequences, measures taken), and will keep the Customer informed. The Customer is responsible for notices to individuals and regulators.
- Return and deletion. As set out in Section 6 of the Terms: the Customer can export at any time; after termination Provider keeps the Instance for the return window, then deletes Customer Personal Data from production systems and lets backups roll off (today about [14] nightly copies), and provides a deletion certificate on request, unless the law requires Provider to keep some of it.
- Audits. Provider will provide, on reasonable request and no more than once a year (or after an incident), information needed to show compliance with this DPA, such as a completed security questionnaire and a description of its controls. Because Provider does not hold a third-party audit report today, an on-site or remote audit may be agreed on reasonable notice, during business hours, under confidentiality, and at the Customer's cost.
- Transfers. Customer Personal Data is stored and processed in the United States. [COUNSEL: if the Customer is in the EEA, UK or Switzerland, add the Standard Contractual Clauses or other transfer mechanism here: TRANSFER MECHANISM.]
4. The Customer's obligations
The Customer will have a lawful basis for the data it puts in the Service and will give the notices and obtain the consents the law requires (including for staff location and photos, appointment-reminder and campaign emails, and recording of Social Security numbers); will keep its administrators' and users' credentials secure and set roles and permissions appropriately; and will not give Provider instructions that would break the law.
5. Liability and order of precedence
Liability under this DPA is subject to the limits in the Terms [COUNSEL: confirm; some regulators and customers expect a separate or higher cap for data-protection claims]. If this DPA conflicts with the Terms on the processing of Customer Personal Data, this DPA prevails.
Annex A — Security measures
These describe what is in place today. They are not a certification.
- Isolation. A dedicated server and database for each Customer; the Customer's data is not co-mingled with other customers' data.
- Encryption. HTTPS (TLS) for all web and app traffic; Social Security numbers and stored credentials for mail, payment and accounting integrations are encrypted at rest in the database with AES-256-GCM, with the key held outside the database; photos and the database are on the server's disk and in the backup server's storage [VERIFY: whether full-disk encryption is enabled on the hosting and backup volumes before claiming it].
- Authentication. Passwords stored only as salted hashes; sign-in rate limiting and account lockout; one active session slot per user with expiry and refresh-token reuse detection; optional two-factor sign-in (authenticator app) with recovery codes; password-reset links that expire and work once.
- Access control. Role-based access (owner, manager, technician and others); pay history and Social Security numbers require explicit HR access; revealing a Social Security number is logged; the Customer's administrators manage who has a login.
- Logging and monitoring. An audit log of important changes; server logs with sign-in tokens and passwords removed, rotated automatically; the public address is monitored for availability.
- Backups. Nightly database and file copies pulled to a separate backup server operated by Provider; automatic integrity checks; flags for stale or failed backups; periodic restore tests.
- Application security. Security response headers on the web app (a content-security policy is deployed in report-only mode); server-side input validation; dependency vulnerability checks run on a schedule [VERIFY: the scheduled audit workflow has been failing — fix and confirm before keeping this sentence].
- Server hardening. Only SSH, HTTP and HTTPS are open on the server's firewall; SSH logins use keys only; database, cache and storage ports are not exposed to the internet; deployments are triggered manually by the owner; production secrets are kept out of source control. [VERIFY on each Instance; these are the steps in the provisioning runbook.]
- Personnel. Access to Customer Data is limited to Provider's personnel who need it to run or support the Service.
- Not in place today: a third-party security audit or certification (for example SOC 2), a hot standby server, and intrusion-detection software. We will not describe them as in place until they are.
Annex B — Subprocessors and connected services
Current as of [EFFECTIVE DATE]. The same list appears in the Privacy Policy.
| Service | What it does for us | What it receives | Where / when |
|---|---|---|---|
| DigitalOcean, LLC | Hosts each Customer's dedicated server, database and uploaded files; optional server backups | All Customer Data, encrypted in transit | United States (San Francisco region). Always |
| Provider's own backup server | Receives the nightly encrypted-in-transit copy of the database and uploaded files, kept for the rotation period in the Service Level Terms | A full copy of Customer Data | United States. Hardware owned and operated by Provider, not a third party |
| Microsoft (Microsoft 365 / Outlook, Microsoft Graph) | Reads and sends the Customer's own company email when the Customer connects a mailbox | Mailbox contents and the messages sent from the app | Customer-directed; only if connected |
| Intuit (QuickBooks) | Accounting integration when the Customer connects QuickBooks Online | Invoice and customer records the Customer chooses to sync | Customer-directed; only if connected (not yet generally available) |
| Stripe, Inc. | Card payments for invoices, on Stripe's own pages | Invoice amount and customer contact details needed to take payment; card numbers go to Stripe, never to us | Customer-directed; only if connected |
| Postmark | Optional delivery of system emails (password links, reminders) when no company mailbox is connected | Recipient address and message content | Only if the Customer's Instance is configured to use it |
| OpenStreetMap Nominatim (OpenStreetMap Foundation) | Turns an address into map coordinates | The address text (and a contact address in the request header) | Public service; when an address is saved or located |
| U.S. Census Bureau Geocoder | Backup address-to-coordinates lookup | The address text | Public service; when an address is saved or located |
| MapTiler or OpenFreeMap / OpenStreetMap tile servers | Draw the base map on the route planner and crew link | The viewer's IP address and the map area requested (no client names) | When a map is shown |
| Apple (App Store, Apple Maps) | Distributes the iOS app; "Navigate" opens Apple Maps | App downloads and crash/usage data under Apple's own terms; a destination address when you tap Navigate | On the user's device |
| Expo (EAS Update) | Delivers over-the-air updates of the iOS app's code | App version and device type; no Customer Data | When the app checks for an update |
Services that never receive Customer Data: our domain registrar and DNS, Let's Encrypt (security certificates), our uptime monitor (it checks that the public address answers), and GitHub (source code and deployments; builds run on our own hardware).