Data Processing Addendum
- For your customers' data, you are the controller and we are your processor.
- We use it only to provide the Service, under your instructions.
- We keep it secure, help you answer your customers' requests, and tell you quickly about any breach.
- Our subprocessors are listed here, and you are told before we add new ones.
- When you leave, you can export the data and we delete it.
1. Scope and parties
This Data Processing Addendum ("DPA") forms part of the agreement between you ("Customer", the controller) and A Digital Motive ("Processor") under the Terms of Service. It applies whenever we process personal data on your behalf while providing ADigitalMotive, including data about your customers, leads, website visitors, patients, clients, members or team members ("Customer Personal Data"). It is designed to meet the requirements of Article 28 of the GDPR and UK GDPR and comparable laws elsewhere.
2. Details of processing
| Subject matter | Provision of the ADigitalMotive Service |
|---|---|
| Duration | For the term of the agreement and the export period that follows |
| Nature and purpose | Hosting, storage, organisation, display, transmission and analysis of data to provide websites, bookings, orders, invoices, customer records, messaging, reviews, reports and support |
| Data subjects | Your customers, prospects, website visitors, patients or clients, and your staff |
| Categories of data | Names, contact details, booking and order history, balances and payment status, messages, review content, notes you add, and website form submissions |
| Special categories | Only if you choose to record them (for example health information in a clinic's appointment notes), in which case you must have a lawful basis and enable the extra protections we offer |
3. Our obligations as processor
- Process Customer Personal Data only on your documented instructions, which include these Terms and your use of the Service's settings, unless the law requires otherwise (in which case we will tell you, unless prohibited).
- Ensure that people authorised to process the data are bound by confidentiality.
- Implement the technical and organisational measures described below.
- Assist you, taking into account the nature of processing, in responding to requests from data subjects exercising their rights, and in data protection impact assessments and consultations with authorities.
- Notify you without undue delay, and in any case within 48 hours of becoming aware, of a personal data breach affecting Customer Personal Data, with the information you need to meet your own obligations.
- At the end of the agreement, let you export Customer Personal Data and then delete it, unless the law requires us to keep it.
- Make available the information needed to demonstrate compliance and allow reasonable audits as described below.
4. Your obligations as controller
You are responsible for having a lawful basis to collect and use Customer Personal Data, for giving your customers the information the law requires (such as a privacy notice on your website, which the Service can help you publish), for obtaining consent for marketing messages, and for the accuracy of the data you enter. Do not instruct us to process data in a way that would breach the law.
5. Security measures
- Encryption of data in transit (TLS) and at rest.
- Logical separation of each customer's data and strict role-based access controls with least privilege.
- Multi-factor authentication for our staff and administrative systems.
- Logging and monitoring of access, with alerts for unusual activity.
- Regular backups stored separately, with restoration tests.
- Secure development practices, dependency scanning and independent security testing.
- Staff training on privacy and security, and confidentiality agreements.
- Business continuity and incident response plans.
6. Subprocessors
You give us general authorisation to engage subprocessors. We impose data protection obligations on them that are at least as protective as this DPA and remain responsible for their performance. We maintain the current list below and will notify you at least 30 days before adding or replacing a subprocessor, giving you the opportunity to object on reasonable data protection grounds.
| Function | Purpose | Region |
|---|---|---|
| Cloud hosting and storage | Running the platform and storing data and backups | United States |
| Content delivery and security | Serving websites quickly and blocking attacks | Global edge network |
| AI language and speech services | Understanding requests and preparing content | United States |
| Messaging delivery | Sending WhatsApp, SMS and email messages you request | Provider regions |
| Payment partner | Subscription billing for your account (not your customers' payments) | Provider regions |
| Support and monitoring tools | Helping you and keeping the Service healthy | United States |
The named providers in each function are listed in the admin-maintained subprocessor register available at adigitalmotive.com/legal/subprocessors/.
7. International transfers
Where Customer Personal Data is transferred to a country without an adequacy decision, the parties agree that the applicable standard contractual clauses (and, for the UK, the international data transfer addendum) are incorporated into this DPA, with us as data importer where relevant, together with supplementary measures appropriate to the transfer.
8. Audits
On written request, and no more than once a year unless a breach or authority requires otherwise, we will provide summaries of independent security assessments and answer reasonable questionnaires. If those do not meet a legal requirement, you may conduct an audit with reasonable notice, during business hours, at your cost and under confidentiality, in a way that does not compromise other customers' data.
9. Order of precedence
If this DPA conflicts with the Terms of Service regarding the processing of Customer Personal Data, this DPA prevails. If the standard contractual clauses apply and conflict with this DPA, the clauses prevail.