Data Processing Addendum

This Data Processing Addendum (“DPA”) is part of the Terms of Service between Ivan Balboa, doing business as Respark (“Respark”) and the customer using Respark (“Customer”). It applies to personal information in Customer’s data that Respark processes to provide the Service (“Customer Personal Data”).

• Customer is the “controller” (or “business”) and Respark is the “processor” (or “service provider”) under U.S. state privacy laws, including the California Consumer Privacy Act as amended (CCPA), the Indiana Consumer Data Protection Act (IC 24-15), and similar laws in other states (“Privacy Laws”).
• If this DPA and the Terms conflict about Customer Personal Data, this DPA wins.

• Purpose: providing the Service as described in the Terms: hosting Customer’s campaigns, pages, and forms; storing and organizing contacts and sales; sending Customer’s emails; producing reports; support; security.
• People involved: Customer’s contacts, leads, customers, supporters, fundraising participants, and Customer’s own Users.
• Types of data: names, email addresses, phone numbers, optional city, consent records, purchase records, campaign activity (sign-ups, views, email opens and clicks), participant first names and last initials, and other information Customer chooses to add (excluding sensitive data, which Customer must not add).
• Duration: for the term of the Terms, plus the deletion period in Section 9.

• Respark processes Customer Personal Data only to provide the Service, on Customer’s documented instructions (the Terms, this DPA, and Customer’s use and settings of the Service), or as the law requires (in which case Respark will tell Customer first unless the law forbids it).
• Respark will tell Customer if it believes an instruction violates Privacy Laws.
• Customer is responsible for the lawfulness of its instructions and of how it collected the data, including notices and consents.

Respark will not:

• sell or share Customer Personal Data (including for cross-context behavioral advertising);
• keep, use, or disclose it for any purpose other than the business purposes in this DPA, or outside the direct business relationship with Customer;
• combine it with personal information Respark receives from other sources, except as Privacy Laws allow for service providers;
• use it to train artificial-intelligence models.

Respark will comply with Privacy Laws that apply to it, give the same level of protection they require, notify Customer if it can no longer meet its obligations, and allow Customer to take reasonable steps to stop and fix unauthorized use. Respark certifies that it understands and will comply with these restrictions.

Everyone at or working for Respark who can access Customer Personal Data is bound by a duty of confidentiality and has access only as needed to provide the Service.

Respark maintains reasonable technical and organizational security measures appropriate to the risk, including:

• encryption in transit (HTTPS/TLS) and encryption at rest by hosting providers;
• database-level rules that separate each customer’s data from all others, with automated tests of that separation;
• access limited by role, with secret keys kept only on servers;
• signature checks on incoming payment and webhook messages;
• rate limits and other abuse protections;
• regular backups by the database provider.

Customer authorizes Respark to use these subprocessors:

• Respark has written agreements with each subprocessor that require protections at least as strong as this DPA, and remains responsible for their performance.
• Respark will update this list and notify Customer (by email or in the app) at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data-protection grounds; if we can’t resolve it, Customer may cancel and receive a refund of prepaid fees for the unused period.

• The Service lets Customer find, export, correct, and delete Customer Personal Data to answer requests from individuals. If Respark receives a request directly, it will pass it to Customer and won’t answer it itself unless Customer asks.
• Respark will give reasonable help, using information available to it, with Customer’s data protection assessments and with Customer meeting its security and breach-notification duties.

If Respark confirms a breach of security that leads to unauthorized access to, or loss or disclosure of, Customer Personal Data, Respark will notify Customer without undue delay and within 72 hours of confirming it, with the information Respark has about what happened, the data affected, and the steps taken. Respark will take reasonable steps to contain the incident and will reasonably cooperate with Customer’s notifications to individuals and regulators. Notice of an incident is not an admission of fault.

Customer can export its data at any time. When the Terms end, Customer has 30 days to export; Respark then deletes Customer Personal Data from the live system within 30 days, and from backups as they expire in the ordinary course, unless the law requires keeping it (in which case it stays protected by this DPA). On request, Respark will confirm deletion in writing.

On reasonable written request (no more than once a year, unless required by a regulator or after a security incident), Respark will provide the information needed to show its compliance with this DPA, and will allow and cooperate with reasonable assessments by Customer or an independent assessor bound by confidentiality, at Customer’s cost, at a mutually agreed time, and in a way that doesn’t compromise other customers’ data or security.

• This DPA is subject to the limits of liability and dispute-resolution terms in the Terms.
• This DPA lasts as long as Respark processes Customer Personal Data.
• Questions about this DPA, or to request a countersigned copy: support@resparkgroup.com.