Introduction
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Parenting Docs (“Processor”) and business customers (“Controller”) who use our AI messaging services.
Definitions
Personal Data
Any information relating to an identified or identifiable natural person as defined under applicable data protection laws.
Processing
Any operation performed on personal data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, or destruction.
Scope and Purpose
Data Categories
We may process the following categories of personal data on behalf of Controllers:
- Contact information (names, email addresses)
- Communication content (messages created using our AI tools)
- Usage data and analytics
Processing Purposes
Personal data is processed solely for the purpose of providing our AI messaging services as outlined in the Terms of Service.
Controller and Processor Obligations
Controller Responsibilities
The Controller agrees to:
- Ensure lawful basis for processing personal data
- Provide appropriate privacy notices to data subjects
- Respond to data subject rights requests
- Maintain records of processing activities
Processor Responsibilities
Parenting Docs agrees to:
- Process personal data only on documented instructions from the Controller
- Ensure confidentiality of personal data
- Implement appropriate technical and organizational security measures
- Assist with data subject rights requests when feasible
Data Security
Security Measures
We implement industry-standard security measures including:
- Encryption of data in transit and at rest
- Access controls and authentication
- Regular security assessments
- Employee training on data protection
Data Breach Notification
In the event of a personal data breach, we will notify the Controller without undue delay and within 72 hours of becoming aware of the breach.
Data Transfers
International Transfers
Personal data may be transferred to and processed in countries outside of the European Economic Area. We ensure appropriate safeguards are in place for such transfers.
Third-Party Processors
We may engage sub-processors to assist in providing our services. All sub-processors are bound by equivalent data protection obligations.
Data Retention and Deletion
Retention Periods
Personal data will be retained only for as long as necessary to fulfill the purposes outlined in this DPA, unless a longer retention period is required by law.
Data Deletion
Upon termination of services or at the Controller’s request, we will delete or return all personal data, unless retention is required by law.
Data Subject Rights
We will assist Controllers in responding to data subject requests, including:
- Right of access
- Right to rectification
- Right to erasure
- Right to restrict processing
- Right to data portability
- Right to object
Compliance and Audits
Regulatory Compliance
Both parties agree to comply with applicable data protection laws, including GDPR, CCPA, and other relevant regulations.
Audit Rights
Controllers may request information about our data processing activities and security measures. Formal audits may be conducted upon reasonable notice and at the Controller’s expense.
Liability and Indemnification
Each party shall be liable for its own compliance with data protection laws. Neither party excludes or limits liability for death, personal injury, fraud, or gross negligence.
Contact Information
For questions about this DPA or data protection matters, please contact our Data Protection Officer at:
- Email: [email protected]
- Address: [Company Address]