This Data Processing Addendum ("DPA") forms part of the agreement between Elrod Technologies Group, LLC ("ETG") and a business customer ("Customer") for WAXBOARD (the "Agreement") when the Agreement incorporates it. It applies when ETG processes personal data on Customer's behalf. If this DPA conflicts with the Agreement on data protection matters, this DPA controls.
1. Definitions
"Personal data," "controller," "processor," "business," "service provider," "data subject," and "processing" have the meanings given in applicable data protection law. "Customer Personal Data" means personal data contained in Customer's workspace content that ETG processes on Customer's behalf.
2. Roles
For Customer Personal Data, Customer is the controller (or business) and ETG is the processor (or service provider). ETG is an independent controller for personal data it processes for its own account administration, billing, security, and legal compliance, as described in the Privacy Policy.
3. Processing Instructions
ETG will process Customer Personal Data only on Customer's documented instructions, which are set out in the Agreement, this DPA, and Customer's use and configuration of WAXBOARD. ETG will not sell or share Customer Personal Data, use it for any purpose other than providing the Service, or combine it with personal data from other sources except as permitted by law. ETG will inform Customer if it believes an instruction violates applicable law.
Details of the processing are set out in Annex 1.
4. Confidentiality
ETG will ensure that personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations.
5. Security
ETG will maintain the technical and organizational measures described in Annex 2, designed to protect Customer Personal Data against unauthorized or unlawful processing and against accidental loss, destruction, or damage.
6. Personal Data Breaches
ETG will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will include the information reasonably available to ETG to help Customer meet its own notification obligations, and ETG will take reasonable steps to contain and remediate the breach.
7. Subprocessors
Customer authorizes ETG to engage the subprocessors listed at elrodtg.com/legal/subprocessors. ETG will impose data protection obligations on each subprocessor that are at least as protective as this DPA and remains responsible for their performance. ETG will give at least 30 days' notice of a new subprocessor. Customer may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused term.
8. Assistance
Taking into account the nature of the processing, ETG will provide reasonable assistance to Customer in responding to data subject requests, conducting data protection impact assessments, and responding to regulators. If ETG receives a request directly from a data subject about Customer Personal Data, it will refer the request to Customer.
9. International Transfers
Where Customer Personal Data is transferred from the European Economic Area, United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree that the applicable Standard Contractual Clauses (and the UK Addendum, where relevant) are incorporated into this DPA by reference.
10. Deletion or Return
At the end of the Agreement, ETG will, at Customer's choice, return Customer Personal Data through the export features of WAXBOARD or delete it, within the periods set out in the Data Retention Policy, unless the law requires ETG to keep it.
11. Audits
ETG will make available information reasonably necessary to demonstrate compliance with this DPA, such as security documentation, completed security questionnaires, and any third-party audit reports ETG holds. If that is not sufficient, Customer may conduct an audit once per year, on 30 days' notice, during business hours, at Customer's expense, and subject to reasonable confidentiality and security conditions.
Annex 1: Details of Processing
- Subject matter and duration: provision of WAXBOARD for the term of the Agreement.
- Nature and purpose: hosting, storage, document processing, AI-assisted analysis, and support, as instructed by Customer.
- Categories of data subjects: Customer's authorized users, and individuals whose personal data appears in content Customer uploads.
- Categories of personal data: names, contact details, and other personal data contained in Customer's content. Customer should not upload special categories of personal data.
Annex 2: Security Measures
ETG maintains the following measures, which it will expand as WAXBOARD matures:
- Established infrastructure providers. WAXBOARD runs on established providers, including Supabase (database, authentication, and storage), Stripe (payments), Amazon Web Services (cloud infrastructure), and Microsoft, each of which operates its own security program. ETG does not store full payment card numbers.
- Passwordless authentication. User accounts sign in without passwords, which removes password reuse and credential-stuffing risk.
- Contractual protections. ETG personnel, contractors, and subprocessors are bound by written confidentiality, data protection, and intellectual property obligations.
- Abuse enforcement. ETG enforces its Acceptable Use Policy, including by suspending or terminating accounts that abuse or attack the Service.