1. About this addendum
This Data Processing Addendum (“DPA”) is part of the Terms of Service between your firm (“you”) and Requestpack (“we”, “us”). It applies whenever we handle personal information in Client Data for you. If this DPA and the Terms disagree about personal information, this DPA applies.
2. Definitions
- Client Data: everything you and your clients put into the Service, as defined in the Terms.
- Personal Information: any information in Client Data that identifies or relates to a person.
- Processing: anything done with Personal Information, such as storing, sending, showing or deleting it.
- Sub-processor: a company we use to process Personal Information for you.
- Security Incident: access to, or loss, change or disclosure of, Personal Information that we didn’t permit.
- Privacy Laws: the laws that apply to the Processing, such as the California Consumer Privacy Act and other US state privacy laws, and the Gramm-Leach-Bliley Act and the FTC Safeguards Rule where they apply to your firm.
3. Roles
You decide why and how Personal Information in Client Data is processed. We process it for you, as your service provider, contractor or processor (whichever term the Privacy Laws use).
You are responsible for having the right to collect the Personal Information you ask your clients for, and for giving them any notices the Privacy Laws require.
4. What we process
- Purpose: providing the Service: sending requests and reminders, receiving, storing and delivering files, and showing you your information.
- Duration: while your account is open, and until deletion under section 11.
- People involved: your clients and the people they work with, the people your clients’ documents mention, and your staff.
- Types of information: names, email addresses, and anything in the files and messages your clients send, which may include financial account details, tax identification numbers, payroll information and other sensitive financial information.
5. Your instructions
We process Personal Information only to provide the Service and on your documented instructions. These Terms, this DPA and the way you use the Service’s settings are your instructions. If we think an instruction breaks the law, we’ll tell you.
We will not:
- sell or share Personal Information, as those terms are used in the Privacy Laws;
- keep, use or disclose it for any purpose other than providing the Service to you, or outside our direct business relationship with you;
- combine it with personal information we get from anyone else, except as the Privacy Laws allow; or
- use it to train artificial intelligence.
6. Our people
Only people who need access to run the Service can reach Personal Information, and they are bound to keep it confidential.
7. Security
We keep appropriate technical and organizational safeguards in place, including:
- encryption on the way (HTTPS) and while stored;
- a malware scan of every file before anyone can open it;
- each firm’s information kept separate and checked on every request;
- a private, random link for each client, which stops working when its request is closed;
- sign-in by emailed code or passkey, with an optional authenticator app;
- an owner and staff role in each firm, and a record of who did what and when;
- databases and storage that can’t be reached directly from the internet;
- encrypted backups, with restores tested; and
- automated security tests before every change goes live.
Our Security page describes these in more detail. We may improve them over time, but never in a way that lowers the overall protection.
8. Security Incidents
If we become aware of a Security Incident involving your Personal Information, we will tell you without undue delay, and within 72 hours. We’ll explain what happened and what information was involved as far as we know, keep you updated, take steps to contain it, and help you meet any duty you have to notify others.
9. Sub-processors
You agree that we may use the Sub-processors listed on our sub-processors page. Each one is bound by a written agreement with data protection terms at least as protective as this DPA, and we are responsible for their work.
Before we add or replace a Sub-processor, we’ll update that page and email the account owner at least 30 days in advance. If you object on reasonable data protection grounds, tell us within that time. If we can’t resolve your concern, you can cancel and we’ll refund any fees paid for the time after the change.
10. Requests from people and authorities
If someone asks us directly to see, correct or delete their Personal Information in Client Data, we’ll pass the request to you and won’t answer it ourselves unless you ask us to. The Service lets you find, download and delete Client Data. If you need more help to answer a request, we’ll give it.
If a government or court asks us for your Personal Information, we’ll refer them to you where we can, and tell you before we disclose anything unless the law prevents it.
11. Deletion when your account ends
You can download all Client Data from Settings, Your data at any time. Thirty days after your plan ends, we delete Client Data, including Personal Information, from the Service. Copies in encrypted backups are deleted as those backups expire. We’ll confirm deletion in writing if you ask.
12. Location
We store and process Personal Information in the United States.
13. Checking our compliance
We’ll answer reasonable written questions about how we protect Personal Information, once a year or after a Security Incident, and share the information you need to show that we meet this DPA. If the Privacy Laws require it, you may take reasonable steps to stop and fix any processing that breaks this DPA.
14. Liability
Each party’s liability under this DPA is subject to the limits in the Terms.
15. Changes
We may update this DPA to reflect changes in the law or the Service. We’ll email the account owner at least 30 days before a change that reduces your protection, and you can cancel before it takes effect.
Contact
Requestpack
30 North Gould Street, Sheridan, Wyoming 82801, United States
[email protected]