Version 1.0. This Data Processing Agreement (“DPA”) is part of our Terms of Service and applies automatically to every client that accepts them. No signature is required, but if your organization needs a countersigned copy for its records, email hello@colinmakessoftware.com and we'll provide one.
This DPA forms part of the agreement for our design, build, hosting and editing services (the “Services”), made up of our Terms of Service and any Order Form (together, the “Agreement”), between:
- This Meeting Matters, LLC, an Indiana limited liability company doing business as Colin Makes Software, 9783 E 116th St PMB 2448, Fishers, IN 46037, United States (“Processor,” “we,” “us”); and
- the client that has accepted the Agreement (“Controller,” “you”).
If you're acting as a processor for your own client (for example, an agency that has us host a website for its customer), you enter into this DPA as that client's processor, we act as your sub-processor, and Module Three of the Standard Contractual Clauses applies.
Capitalized terms not defined here have the meanings given in the EU General Data Protection Regulation 2016/679 (“GDPR”). If this DPA conflicts with the rest of the Agreement, this DPA controls for the Personal Data it covers.
1. Subject matter and roles
1.1 This DPA governs our Processing of Personal Data on your behalf in connection with the Services: chiefly, Personal Data about the visitors to the website we host for you, and Personal Data contained in your website's content. For that Personal Data, you are the Controller (or a processor acting for your own controller) and we are the Processor (or sub-processor).
1.2 This DPA does not apply to Personal Data for which we are an independent controller, such as your account and billing contacts, your team members' sign-in details, and usage of our own website and dashboard. Our Privacy Policy describes that Processing.
1.3 The details of the Processing (its subject matter, duration, nature and purpose, the types of Personal Data and the categories of Data Subjects) are set out in Annex I.
2. Processing instructions
2.1 We will Process Personal Data only on your documented instructions, including with regard to international transfers, unless the law requires otherwise. If it does, we'll tell you first, unless the law prohibits that.
2.2 The Agreement, this DPA, and your configuration and use of the Services, including requests you make to us and changes you make through the dashboard or a connected AI assistant, are your complete and documented instructions.
2.3 We will tell you if, in our opinion, an instruction infringes the GDPR or other applicable data protection law.
2.4 Your compliance responsibilities. You're responsible for your own compliance with the data protection laws that apply to you, including having a lawful basis for the Personal Data your website collects, publishing a privacy notice for your visitors, obtaining any consent required for cookies or analytics, and meeting any obligations those laws place on you directly (for example, appointing a representative under Article 27 of the GDPR or UK GDPR where required).
2.5 Sensitive data. The Services aren't designed for special category data (GDPR Article 9), criminal offence data (Article 10), or similarly sensitive data under other laws. As our Terms of Service describe, you won't collect such data through your website unless an Order Form expressly allows it.
3. Confidentiality
We ensure that everyone authorized to Process the Personal Data is bound by an appropriate duty of confidentiality, and that they access it only as needed to provide the Services.
4. Security
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as described in Annex II, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the Processing.
5. Sub-processors
5.1 You give us general authorization to engage sub-processors to support the Services. The current list is in Annex III.
5.2 We'll give at least 30 days' notice before adding or replacing a sub-processor, by updating Annex III and emailing clients who have asked to be told about sub-processor changes. You can opt in by emailing hello@colinmakessoftware.com. During that notice period you may object on reasonable data protection grounds. If you object and we can't reasonably accommodate the objection, you may end the affected Services without an Early Buyout Fee.
5.3 We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain responsible for each sub-processor's performance.
5.4 Controller-Enabled Third-Party Services. You can choose to use third-party services with your website through your own accounts, or to have third-party code added to your website. Examples include your own analytics account, advertising pixels, chat or booking widgets, embedded media, and the AI assistant you connect to edit your site. Where you do: (i) you authorize and instruct us to make the relevant Personal Data available to that service, or to add its code to your website; (ii) that provider is engaged by you, not by us: it is your processor or an independent controller, not our sub-processor, and Section 5 and the Standard Contractual Clauses in Section 11 don't apply to its Processing; (iii) you are responsible for assessing it, for any consent it requires, and for any data protection terms (including any transfer mechanism) with it; and (iv) we remain responsible only for securing the Personal Data within our systems and in transit to the service you chose. Common examples are listed in Annex III, Section D.
6. Data subject rights
Taking into account the nature of the Processing, we'll assist you through appropriate technical and organizational measures, insofar as possible, in responding to requests from Data Subjects exercising their rights. If we receive a request directly that relates to your website, we'll forward it to you and won't respond except on your instructions or as the law requires. You can export and delete your visitors' form submissions yourself, or ask us to.
7. Assistance
Taking into account the nature of the Processing and the information available to us, we'll assist you in meeting your obligations under Articles 32 to 36 of the GDPR (security, breach notification, data protection impact assessments and prior consultation).
8. Personal Data breaches
We'll notify you without undue delay, and where feasible within 72 hours, after becoming aware of a Personal Data breach affecting Personal Data we Process for you. We'll provide the information reasonably available to us to help you meet your own notification obligations, and update you as we learn more.
9. Deletion or return
When your Services end, we'll make your Personal Data available for export for 30 days, as our Terms of Service describe. After that, we'll delete it, including existing copies, within a further 30 days, unless the law requires us to keep it. Copies in backups are deleted on our providers' normal backup cycle and are never restored to active use except to recover from a disaster.
10. Audits
We'll make available the information necessary to demonstrate compliance with Article 28 of the GDPR, and allow for and contribute to audits conducted by you or an auditor you appoint. We'll first try to satisfy an audit request with written documentation, including Annex II and answers to a reasonable written security questionnaire. If that isn't enough to demonstrate compliance, you may conduct an audit no more than once every 12 months (unless a supervisory authority requires more), on at least 30 days' written notice, subject to confidentiality, at your own cost, and remotely. Audits don't extend to our sub-processors' facilities; for those, we'll provide the third-party certifications or reports they make available.
11. International transfers
11.1 To the extent our Processing involves transferring Personal Data from the European Economic Area, the United Kingdom or Switzerland to us in the United States, or to any other country without an adequacy decision, the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, available at eur-lex.europa.eu) are incorporated into this DPA by reference and completed as follows:
- Module Two (controller to processor) applies where you are a Controller. Module Three (processor to processor) applies where you are a processor and we are your sub-processor.
- Clause 7 (docking clause): applies.
- Clause 9 (sub-processors): Option 2 (general written authorization), with the notice period in Section 5.2.
- Clause 11 (redress): the optional independent dispute resolution body is not selected.
- Clause 17 (governing law): the law of Ireland.
- Clause 18 (forum and jurisdiction): the courts of Ireland.
- Annexes I, II and III of the Clauses are completed by Annexes I, II and III of this DPA.
11.2 United Kingdom. The International Data Transfer Addendum issued by the UK Information Commissioner is incorporated and amends the Clauses for transfers subject to the UK GDPR. Tables 1 to 3 are completed by the Annexes to this DPA, and for Table 4, both the importer and the exporter may end the Addendum.
11.3 Switzerland. The Clauses apply with the amendments the Swiss Federal Act on Data Protection (“FADP”) requires: references to the GDPR are read as references to the FADP, the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner, and the term “member state” doesn't prevent Data Subjects in Switzerland from bringing claims where they live.
11.4 If the Clauses are invalidated or replaced, we'll work with you in good faith to put an alternative lawful transfer mechanism in place.
12. U.S. state privacy laws
12.1 Where U.S. state privacy laws apply, such as the California Consumer Privacy Act, we are your “service provider” or “processor” for the Personal Data this DPA covers, and the business purpose is providing the Services described in Annex I.
12.2 We will not: (i) sell or share that Personal Data, as those terms are defined in those laws; (ii) retain, use or disclose it for any purpose other than providing the Services, or outside our direct business relationship with you, except as those laws permit; or (iii) combine it with Personal Data we receive from or on behalf of anyone else, or collect from our own interactions with individuals, except as those laws permit for service providers.
12.3 We'll comply with the obligations those laws place on us, provide the same level of privacy protection they require, and tell you if we determine we can no longer meet our obligations. You may take reasonable and appropriate steps to stop and remediate any unauthorized use of the Personal Data. We certify that we understand and will comply with the restrictions in this Section 12.
13. General
13.1 This DPA stays in effect for as long as we Process Personal Data on your behalf, even after the rest of the Agreement ends.
13.2 Each party's liability under this DPA is subject to the limitations in the Agreement, except where the law or the Standard Contractual Clauses don't allow it to be limited.
13.3 We may update this DPA to reflect changes in the law, our sub-processors or the Services. We won't make a change that materially reduces the protection of your Personal Data without your agreement, except where the law requires it.
Annex I: Description of the Processing
A. List of parties
- Data exporter: the Controller (client) identified in the Agreement. Contact: the account owner's email address.
- Data importer: This Meeting Matters, LLC (d/b/a Colin Makes Software), 9783 E 116th St PMB 2448, Fishers, IN 46037, United States. Contact: hello@colinmakessoftware.com.
B. Description of the transfer
- Categories of Data Subjects: visitors to the Controller's website; people who submit forms on it; and people whose information the Controller includes in its website content or project materials (for example, its staff, customers or people quoted in testimonials).
- Categories of Personal Data: the contents of form submissions, which are whatever the Controller's forms ask for (typically name, email address, phone number and message), along with the page and language each submission came from and a spam score; technical data needed to deliver and protect the website, such as IP addresses and browser details; where we manage analytics for the Controller, analytics events and session recordings with form inputs masked; and Personal Data contained in website content and project materials, such as names, photos and biographies.
- Special category data: none intended. See Section 2.5.
- Frequency: continuous, for as long as the Services are provided.
- Nature and purpose: designing, building, hosting, maintaining and supporting the Controller's website, including receiving, storing, filtering for spam and delivering its form submissions, and, where the Controller asks us to, providing website analytics.
- Retention: for the duration of the Agreement, unless the Controller deletes the data sooner, and then as set out in Section 9.
- Sub-processor transfers: as listed in Annex III, for the duration of their engagement.
C. Competent supervisory authority: the supervisory authority of the EEA member state where the data exporter, or its EU representative, is established. Where the data exporter isn't established in the EEA and has no representative, the Irish Data Protection Commission.
Annex II: Technical and organizational measures
These are the measures in place as of the date of this version.
- Hosting and location. The Services run on Cloudflare's infrastructure. Our database and file storage are located primarily in the United States, and websites are delivered through Cloudflare's global network.
- Encryption. All traffic to the Services and to the websites we host is served over HTTPS/TLS. Our database, key-value storage and file storage are encrypted at rest by Cloudflare.
- Separation between clients. Every record and file is scoped to one client's organization. Files are stored under keys that include the organization, and each website can serve only its own organization's files.
- Private files. Project materials uploaded during signup and media waiting to be checked are stored privately and are never served publicly. Uploads go directly to storage through short-lived, single-use signed links.
- Form submissions. Submissions are validated, checked for spam, and stored in our database. They are never published on the website, and they're delivered to the Controller by email.
- Access control. Access to the dashboard and editing tools requires signing in. Passwords are stored only as secure hashes. Each AI assistant connection is authorized by a signed-in user, is limited to a single organization, and has its user's membership and role checked on every request. Access to production systems and our infrastructure accounts is limited to authorized personnel on a need-to-know basis and protected by multi-factor authentication.
- Audit trail. Every change requested through a connected AI assistant is logged with who made it, when and what it did.
- Bot protection. Signup and sign-in forms are protected by Cloudflare Turnstile.
- Analytics safeguards. Where we manage analytics for a Controller, session recordings mask what visitors type into form fields and other inputs, and analytics doesn't run before consent where the law requires consent.
- Secrets. Credentials and signing keys are stored as encrypted platform secrets, never in source code.
- Backups and recovery. Our database provider keeps point-in-time recovery data for a limited period.
- Organizational. Personnel are bound by confidentiality. Changes go through code review and automated tests before deployment. Sub-processors are reviewed before they're engaged.
Annex III: Sub-processors
A. Core sub-processors (always involved in providing the Services):
- Cloudflare, Inc. (United States, with a global network): hosting, content delivery, database, file storage, custom domains, email delivery of form notifications, and bot protection (Turnstile). Processes all categories of Personal Data in Annex I.
- Anthropic, PBC (United States): AI tools we use when designing, building and maintaining websites. Processes website content and project materials we work with, under terms that don't allow it to train its models on that data. We don't send visitors' form submissions to it.
B. Conditional sub-processors (engaged by us only when the Controller asks):
- PostHog, Inc. (United States): website analytics and session replay, when the Controller asks us to set up and manage analytics for its website in our account. Processes analytics events, technical data and masked session recordings of the Controller's website visitors.
C. Not sub-processors. These providers process data for which we are the controller, such as our clients' billing details and usage of our own website and dashboard. They're listed here for transparency only: Stripe, Inc. (payments and billing) and PostHog, Inc. (analytics for our own website and dashboard).
D. Controller-Enabled Third-Party Services (under Section 5.4, engaged by the Controller, not by us, and not our sub-processors):
- The AI assistant the Controller connects to edit its website, such as Claude by Anthropic, under the Controller's own account with that provider. It receives the website content and data it requests on the Controller's instructions.
- The Controller's own analytics account, such as its own PostHog account, when the Controller provides it rather than using ours.
- Third-party code the Controller adds or asks us to add to its website, such as advertising pixels, chat or booking widgets, and embedded maps or videos. These run in visitors' browsers and collect data directly under their providers' terms.
Acceptance
This DPA takes effect when you accept the Agreement and doesn't require a signature. If your organization needs a countersigned copy, email hello@colinmakessoftware.com and we'll provide one.