Legal / Data Processing Addendum
Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the Terms of Service between [COMPANY LEGAL NAME] ("Processor") and a Hosting Business ("Controller") that uses StandardWorks to serve its End Customers.
1. Scope
The Processor processes End Customer personal data only to provide StandardWorks to the Controller: storefront accounts, orders, subscriptions, invoices, service provisioning and support emails.
2. Instructions
The Processor processes personal data only on the Controller's documented instructions, which are the Terms, this DPA, and the Controller's configuration of StandardWorks. The Processor will tell the Controller if it believes an instruction breaks data protection law.
3. Confidentiality
Everyone authorized to process the personal data is bound by confidentiality.
4. Security
The Processor maintains the measures in Annex B.
5. Sub-processors
The Controller authorizes the sub-processors listed in the Privacy Policy. The Processor will give [SUB-PROCESSOR NOTICE PERIOD] notice of new sub-processors, and the Controller may object on reasonable grounds.
6. Assistance
The Processor helps the Controller respond to data-subject requests, mainly through the export tools in the dashboard, and with security, breach notification and impact assessments where required.
7. Personal data breaches
The Processor will notify the Controller without undue delay, and in any case within [BREACH NOTICE HOURS] hours of becoming aware of a personal data breach, with the information the Controller needs.
8. Return and deletion
During the term, the Controller can export its data at any time. After termination, the Processor deletes End Customer personal data within [DELETION PERIOD], except where law requires retention (such as financial records) or a legal hold applies.
9. Audits
The Processor will make available the information reasonably needed to show compliance with this DPA, and allow audits [AUDIT TERMS].
10. International transfers
[TRANSFER MECHANISM.]
Annex A: Processing details
- Data subjects: the Controller's End Customers.
- Categories of data: name, email address, password hash, orders, subscriptions, invoices and payment status, service configuration and generated credentials, and any personal data the End Customer stores in their Service. The Processor does not inspect the contents of Services.
- Duration: for the term of the Terms, plus the deletion period above.
Annex B: Security measures
- Encryption at rest for credentials, service specifications and task payloads, with key rotation.
- Password hashing with scrypt; session, enrollment and reset tokens stored only as hashes.
- Tenant isolation, checked by automated tests that attack every route from another organization.
- Strict content-security policies; CSRF protection; signed, idempotent payment webhooks.
- Mandatory two-factor sign-in for platform operators.
- An append-only financial ledger, enforced by the database.
- Verified backups, and archive-before-release with a 30-day retention period.