Legal
Data Processing Addendum
Template addendum for customers, such as agencies, for whom LaunchFaro processes personal data as a processor under GDPR and UK GDPR.
- Version
- 0.1
- Last updated
Draft for legal review
This is a template. It becomes part of the agreement only when you accept it, for example by asking for it at [to be completed: operator.legalEmail], and then applies on top of the Terms of Service. Draft for lawyer review.
1. Parties and roles
The customer (the "Controller") is the person or company named in the order. [to be completed: operator.legalName], [to be completed: operator.address] (the "Processor") processes personal data for the Controller while providing the Service. For data the Processor handles for its own purposes (accounts, billing, security) it is a controller and the Privacy Policy applies. Where the Controller is itself a processor for its clients, this addendum applies as between the Controller and the Processor, and the Controller confirms it has authority to give these instructions.
2. What is processed
| Item | Detail |
|---|---|
| Subject matter | Running directory-submission campaigns for the Controller's products |
| Duration | The term of the agreement, plus the deletion period in section 9 |
| Nature and purpose | Storing, adapting for format, transmitting to directories the Controller chose, and verifying the resulting listings |
| Types of personal data | Names and email addresses placed on a listing as contacts; the email alias created for a product; any personal data inside descriptions the Controller writes |
| Data subjects | The Controller's staff, clients or contacts named on listings |
| Special categories | None intended. The Controller must not submit them |
3. Instructions
The Processor processes the data only on the Controller's documented instructions, which are: the agreement, the campaigns the Controller creates and starts, and the settings in the dashboard. It tells the Controller if it believes an instruction breaks data-protection law.
4. Confidentiality
People who process the data are bound by confidentiality.
5. Security
The Processor applies the measures on the Security page and those in Annex 1, and reviews them as the risk changes.
6. Subprocessors
The Controller gives general authorisation for the subprocessors on the Subprocessors page. The Processor binds each by contract to obligations no less protective than these, stays responsible for them, and gives 30 days' notice of an addition or replacement, during which the Controller may object in writing. Directories that receive a listing on the Controller's instruction are recipients chosen by the Controller, not subprocessors.
7. Assisting the Controller
The Processor helps the Controller answer requests from data subjects (access, correction, deletion, restriction, portability, objection) by forwarding any request it receives within 5 business days and by providing the export and delete tools in the dashboard. It helps with impact assessments and prior consultation as far as the nature of the processing and the information it holds allow.
8. Personal data breaches
The Processor tells the Controller without undue delay, and in any case within 48 hours of confirming a breach affecting the Controller's data, with the information it then has: what happened, the data and people affected, likely consequences and the steps taken. It then updates the Controller as facts emerge.
9. Deletion and return
The Controller can export and delete its data at any time. When the agreement ends the Processor deletes the data after 14 days unless the law requires it to keep some, and it leaves backups within 365 days. Data already sent to a directory cannot be recalled by the Processor.
10. Audits
The Processor makes available the information needed to show compliance, and allows reasonable audits by the Controller or its auditor, with notice, during business hours, at the Controller's cost, no more than once a year unless a breach requires it, without access to other customers' data.
11. International transfers
The Processor transfers personal data outside the EEA or the UK only under an adequacy decision or the Standard Contractual Clauses (and the UK Addendum where relevant), which are incorporated here by reference with the Controller as exporter and the Processor, or its subprocessor, as importer. [The lawyer must select the modules and complete the annexes.]
12. Liability and precedence
Liability under this addendum is subject to the limits in the Terms of Service, to the extent the law permits. If this addendum and the Terms conflict on data protection, this addendum prevails.
Annex 1: security measures
- Encrypted connections between the visitor and the service, with security headers on every response.
- Access to the staff area by token or session, with lock-out after repeated failures.
- Tenant separation: every campaign record is tied to its owner and queries are scoped by it.
- Directory passwords generated per product, kept outside the database in a restricted file, never written to logs or reports.
- Outbound requests filtered against internal addresses; robots.txt and rate limits respected.
- An append-only record of campaign events.
- Rate limits on public write endpoints.
- Backups copied off the server, with the rotation stated in the Privacy Policy.
Annex 2: contacts
Processor: [to be completed: operator.privacyEmail]. Controller: as stated in the order.
Previous versions
There are no earlier versions: this is the first.