Effective: October 19, 2026 · For customers whose personal data we process
This Data Processing Addendum (“DPA”) forms part of the agreement (the Terms of Service and any SOW) between the customer (“Customer,” the controller or business) and Adam Proksch, doing business as adamapi (“adamapi,” the processor or service provider). It applies when we process personal data on Customer’s behalf in providing the Services, including personal data we can access or handle while performing Professional Services and operating Hosted Tools (together, “Customer Personal Data”). It does not apply to personal data we handle as a controller for our own purposes, which is covered by the Privacy Policy.
Terms such as “controller,” “processor,” “data subject,” “personal data,” and “processing” have the meanings given in the GDPR, the UK GDPR, and (as to “business,” “service provider,” and “personal information”) the CCPA/CPRA, and other applicable data protection laws (“Data Protection Laws”). By agreeing to the Terms, Customer accepts this DPA; it is effective on the same date and needs no separate signature. If Customer needs a countersigned copy, email [email protected].
We will process Customer Personal Data only on Customer’s documented instructions, which are the agreement, the SOW, and Customer’s use of the Services, unless law requires otherwise (in which case we will tell Customer first, where legally allowed). We will tell Customer if we believe an instruction breaches Data Protection Laws. Customer confirms it has a lawful basis and has given all notices and obtained all consents required to provide Customer Personal Data to us and for the processing described here.
We ensure that anyone we authorize to process Customer Personal Data is bound by confidentiality duties and has access only as needed for the Services.
We implement and maintain appropriate technical and organizational measures to protect Customer Personal Data, taking account of the risks, as summarized in Annex 1. We may update the measures if the level of protection is not reduced.
Customer gives general written authorization for us to use the sub-processors in Annex 2 and to engage others. We will give at least 15 days’ notice (by email or by updating Annex 2) before adding or replacing a sub-processor, and Customer may object on reasonable data protection grounds within that period; if we cannot resolve the objection, Customer may terminate the affected Services and receive a pro-rata refund of prepaid fees for the unused period. We bind sub-processors to written terms providing substantially the same data protection obligations as this DPA, and we remain responsible for their performance.
Taking into account the nature of the processing, we will provide reasonable assistance (a) to respond to data subject requests: if we receive one directly relating to Customer Personal Data, we will redirect the person to Customer where we can identify the Customer and will not respond substantively unless Customer instructs us or the law requires; and (b) with Customer’s security, breach notification, data protection impact assessment, and prior consultation obligations. Customer may delete data using any tools we provide for that purpose, or by contacting us under our Takedown / Data Requests process. We may charge reasonable fees for assistance that goes beyond the standard functionality of the Services.
On termination or expiry of the Services, or on Customer’s written request, we will delete or, at Customer’s choice, return Customer Personal Data within 30 days, and delete remaining copies (including from backups on their normal rotation, generally within 90 days) unless law requires us to retain it. We will certify deletion in writing on request.
We will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the data and approximate number of records and data subjects affected, likely consequences, and the measures taken or proposed. We will cooperate with Customer’s investigation and keep Customer updated. Notification is not an admission of fault.
We will provide information reasonably necessary to demonstrate compliance with this DPA, such as written answers to a reasonable security questionnaire. If that is not enough to satisfy Data Protection Laws, Customer may, once a year or after a breach, audit our relevant practices on at least 30 days’ written notice, during business hours, subject to confidentiality and without unreasonable disruption, at Customer’s cost and through a reputable independent auditor bound by confidentiality duties.
We process Customer Personal Data in the United States. Where the GDPR, UK GDPR, or Swiss law applies and Customer Personal Data is transferred to us in a country without an adequacy decision, the parties agree that the Standard Contractual Clauses (EU 2021/914), Module Two (controller to processor), are incorporated by reference, with: Clause 7 (docking) included; Clause 9(a) Option 2 (general authorization, 15 days’ notice); Clause 11 optional language omitted; Clause 17 Option 1 and Clause 18(b): the law and courts of Ireland; and Annexes I–III completed by this DPA, with Customer as exporter and adamapi as importer. For UK transfers, the UK International Data Transfer Addendum is incorporated; for Swiss transfers, the SCCs apply with references to the GDPR read as references to the Swiss FADP. If a transfer mechanism is invalidated, the parties will work in good faith on a replacement.
To the extent the CCPA/CPRA applies, adamapi is a service provider and processes personal information only for the business purposes in the agreement. We will not sell or share Customer Personal Data; will not retain, use, or disclose it for any purpose other than performing the Services or outside our direct business relationship with Customer, or as the law permits; will not combine it with personal information from other sources except as permitted; will comply with applicable CCPA/CPRA obligations and provide the same level of privacy protection; will notify Customer if we can no longer meet those obligations; and permit Customer to take reasonable steps to stop and remediate unauthorized use.
Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, except where Data Protection Laws or the SCCs do not allow that. If this DPA conflicts with the rest of the agreement on the protection of personal data, this DPA prevails; if it conflicts with the SCCs, the SCCs prevail.
Data protection questions and requests to adamapi: [email protected].
| Sub-processor | Purpose | Location |
|---|---|---|
| Railway Corp. | Application hosting, databases, and infrastructure for adamapi.com and Hosted Tools | United States |
| Stripe, Inc. | Payment processing and billing (account and billing data only) | United States |
We will update this list before making changes, as described in Section 7.