Data Processing Agreement
How TODO: registered company name (or your full name if sole trader) processes personal data on behalf of Pulse customers.
Last updated
1. Scope
This Data Processing Agreement ("DPA") is part of the Terms of Service between the customer ("Controller") and TODO: registered company name (or your full name if sole trader) ("Processor"). It applies whenever the Processor processes personal data on the Controller's behalf through Pulse, and prevails over the Terms on data protection matters.
2. Details of the processing
| Subject matter | Provision of Pulse |
|---|---|
| Duration | The term of the subscription, plus the deletion period below |
| Nature and purpose | Hosting, storage, transmission and display of data as instructed through the Service |
| Data subjects | The Controller's users, organization members and any person whose data the Controller stores in the Service |
| Personal data | Identification and contact data, account and usage data, and any content the Controller uploads |
| Special categories | None, unless the Controller chooses to upload them (it should not without our written agreement) |
3. Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions, including these Terms and the Controller's use of the Service;
- ensure that people authorized to process the data are bound by confidentiality;
- implement appropriate technical and organizational security measures (GDPR art. 32), including encryption in transit and at rest, access control and backups;
- assist the Controller, as far as possible, in answering data subject requests and with data protection impact assessments;
- notify the Controller of a personal data breach without undue delay, and within 48 hours of becoming aware of it;
- make available the information needed to demonstrate compliance, and allow audits by the Controller or an auditor it mandates, with reasonable notice and at most once a year.
4. Sub-processors
The Controller authorizes the Processor to use the sub-processors below. The Processor imposes on them the same data protection obligations and remains liable for their work. It will announce new sub-processors at least 30 days in advance, during which the Controller may object; if the objection cannot be resolved, the Controller may terminate the affected services.
| Sub-processor | Purpose | Location |
|---|---|---|
| Neon | Database hosting | TODO: region of your Neon project |
| Stripe | Payment processing and invoicing | United States |
| Resend | Transactional emails (sign-in codes, invitations) and newsletter (with consent) | United States |
| Neon (object storage) | File storage (avatars, organization logos) | United States (us-east-2) |
| GitHub | Optional sign-in with GitHub | United States |
| Optional sign-in with Google | United States |
5. International transfers
Transfers outside the EEA rely on an adequacy decision or on the Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), which are incorporated by reference, together with supplementary measures where needed.
6. Return and deletion
The Controller can export its data at any time. At the end of the subscription, the Processor deletes the personal data from live systems within 30 days and from backups within 30 days, unless the law requires it to be kept.
7. Controller obligations
The Controller is responsible for the lawfulness of the processing, including having a legal basis and informing data subjects, and for the content it chooses to store.
8. Contact
Data protection contact: contact@launch-now.dev.