Legal

Data Processing Agreement

Effective 2026-10-01 · Version dpa-2026-10-v1

1. Roles and scope

This Data Processing Agreement ("DPA") applies whenever CAMF Solutions Inc. ("CAMF") processes personal data on behalf of the client named in the order ("you") while providing a service, including hosting a landing page and the data its forms collect, and working on, monitoring or backing up a Drupal site. You are the controller and CAMF is the processor, as those terms are used in the EU and UK General Data Protection Regulation ("GDPR"). Where you are yourself a processor for someone else, CAMF is your sub-processor and you confirm that your controller has authorised it. Annex 1 describes the processing.

2. Your instructions

CAMF processes the personal data only on your documented instructions, which are the Terms of Service, the plan conditions, this DPA and the requests you send us through our support channels, unless the law requires otherwise, in which case we tell you first where the law allows. If we believe an instruction breaks data protection law, we tell you and may pause that work. You are responsible for having a lawful basis for the processing and for the notices and consents it needs.

3. Confidentiality and security

Everyone at CAMF who can access the personal data is bound to keep it confidential. We apply the technical and organisational measures in Annex 2, which we may improve over time but not weaken.

4. Sub-processors

You authorise CAMF to use the sub-processors in Annex 3. We tell you by email at least 30 days before adding or replacing one. If you object on reasonable data protection grounds, we will try to find an alternative; if we cannot, you may cancel the affected service and we refund any fees paid for the period after the change. Each sub-processor is bound by a written contract with data protection obligations equivalent to this DPA, and CAMF remains responsible to you for its performance.

5. Helping you meet your obligations

• If a person contacts us to exercise their rights over data we process for you, we pass the request to you and do not answer it ourselves unless you ask us to.
• We help you respond to such requests and meet your obligations on security, breach notification, data protection impact assessments and prior consultation, taking into account the nature of the processing and the information available to us. Help that goes beyond the plan uses support hours or is quoted.

6. Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting data we process for you. We tell you what we know about its nature, the data and people affected, its likely consequences and the measures taken or proposed, and update you as we learn more. Notifying a breach is not an admission of fault.

7. International transfers

CAMF is based in the United States, and our main sub-processor stores data in the United States. Where personal data subject to the EU GDPR is transferred to CAMF or onward from it to a country without an adequacy decision, the Standard Contractual Clauses adopted by the European Commission in Decision (EU) 2021/914 apply and are incorporated into this DPA by reference: Module 2 where you are a controller, Module 3 where you are a processor. For those clauses: the optional docking clause applies; under Clause 9 the general written authorisation and 30-day notice in section 4 apply; the optional wording in Clause 11 does not apply; under Clause 13 the competent supervisory authority is the one determined by your establishment or representative in the EU; Clauses 17 and 18 select the law and courts of Ireland; and Annexes 1 to 3 of this DPA supply the clauses' annexes. For data subject to the UK GDPR, the UK International Data Transfer Addendum to those clauses applies, and for Swiss data, the clauses apply with the adjustments required by Swiss law. If the clauses conflict with this DPA, the clauses prevail.

8. Return and deletion

When a service ends, we return the personal data we hold for it on request and delete it, including copies, within 60 days, unless the law requires us to keep it. Backups are overwritten in their normal cycle and are not restored except to recover your data at your request.

9. Audits

We make available the information you reasonably need to show compliance with this DPA, and answer your written questions about our security. If that is not enough, you may audit our compliance once a year, yourself or through an independent auditor bound by confidentiality, on at least 30 days' written notice, during business hours and without disrupting our other clients' data, at your own cost. Audits required by a supervisory authority are not limited in number.

10. US and other privacy laws

Where the California Consumer Privacy Act or a similar US state law applies, CAMF acts as your service provider or processor: we do not sell or share the personal data, do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than providing the service, do not combine it with data from other sources except as the law permits, and tell you if we can no longer meet these obligations. Where another country's data protection law applies (for example Brazil's LGPD), the obligations in this DPA apply to the equivalent roles under that law.

11. Liability and precedence

Each party's liability under this DPA is subject to the limitation of liability in the Terms of Service, except where data protection law does not allow it to be limited, and nothing here restricts the rights of the people whose data is processed. On data protection matters, this DPA prevails over the Terms of Service, and the Standard Contractual Clauses prevail over both. This DPA lasts as long as CAMF processes personal data for you.

Annex 1: Description of the processing

• Parties: you as data exporter (controller, or processor) and CAMF Solutions Inc., 30 N Gould St Ste R, Sheridan, WY 82801, United States, as data importer (processor), contact info@camfsolutions.com.
• People concerned: visitors, users, customers, subscribers and contacts of your website, and your staff who use it.
• Data: whatever your website holds or collects, typically names, contact details, account details, form submissions, order details and technical data such as IP addresses and logs. The services are not designed for special categories of data or data about criminal convictions; tell us before your site processes any, so we can agree the extra measures needed.
• Nature and purpose: hosting, storage, backup, maintenance, updates, troubleshooting, monitoring and development of your website, and the reviews included in your plan.
• Frequency and duration: continuous, for as long as the service runs, then until deletion under section 8.

Annex 2: Security measures

• Encryption of data in transit (TLS) and, on our infrastructure, at rest.
• Access limited to the people who need it for your service, with individual accounts, multi-factor authentication where the system supports it, and access removed when no longer needed.
• Credentials you give us kept in an encrypted password or secrets manager, never in email or chat history.
• Security updates applied to the systems we manage, monitoring, and logging of administrative access.
• Regular backups of the systems we host, with restores tested.
• A documented incident response process, including the notifications in section 6.
• Confidentiality obligations and data protection guidance for everyone who works on client data.

Annex 3: Sub-processors

Your own hosting provider, when we work on a site you host elsewhere, is your processor, not ours.