A DPA that says what we do.
Our commitments when we handle personal data inside your systems: roles, instructions, security, sub-processors, international transfers, breach notice and deletion.
The short version.
Four things worth knowing before you read the detail. Each clause below also starts with its own one-line summary.
For personal data in your systems, you are the controller and BoldBellows is your processor.
We process personal data only to deliver the order and follow your documented instructions.
We tell you without undue delay and within 72 hours of becoming aware of a personal data breach affecting your data.
Within 90 days after handover we delete working copies, or return them, as you choose.
What this agreement covers in practice.
The details Article 28 asks a processing agreement to state, in a table you can hand to your compliance team.
| Item | Detail |
|---|---|
| Subject matter | Building, testing and supporting automations that move data between the client’s business systems. |
| Duration | From the start of work until deletion or return of working data, no later than 90 days after handover. |
| Nature and purpose | Reading, copying, transforming and writing records between the client’s systems, and testing those flows. |
| Types of personal data | Whatever the connected systems hold for the automation: typically contact details, order and payment status, support records and, if the client chooses, other business records. |
| Categories of data subjects | The client’s customers, prospects, employees, contractors and partners. |
| Special categories | Not required. The client tells us before work starts if the automation touches them, and the quote reflects the extra safeguards. |
What we owe you as a processor.
If you are subject to data protection law, you need a processor who behaves predictably. This is what you get.
Only your instructions
We process personal data only to deliver your order and as you instruct.
Confidential
Only people who need access have it, and they are bound by confidentiality.
Secure
Least-privilege access, encrypted connections, separate credentials and logging.
Sub-processors on a leash
Bound by equal duties, with changes shared on request.
Breach notice in 72 hours
We tell you without undue delay and within 72 hours.
Delete or return
Within 90 days of handover, as you choose.
Purpose and scope
This agreement applies when we handle personal data on your behalf while delivering an order.
This Data Processing Agreement (“DPA”) forms part of the agreement between the client (“Controller”) and BoldBellows is a trading name of Sunglasses Cent LLC, a Delaware limited liability company (“Processor”) and applies whenever the Processor processes personal data on the Controller’s behalf in delivering an order. It reflects Article 28 of the GDPR and the UK GDPR, and is intended to meet similar requirements in other laws. Terms such as controller, processor, personal data, processing and data subject have the meanings given in those laws.
Instructions
We follow your documented instructions, and tell you if one looks unlawful.
The Processor processes personal data only on the Controller’s documented instructions, which are the order, the quote and written messages from the Controller, unless the law requires otherwise. If the Processor believes an instruction infringes data protection law, it will tell the Controller promptly.
Confidentiality
Only people who need it, under a duty of confidence.
The Processor limits access to personal data to personnel who need it to deliver the order and who are bound by confidentiality obligations.
Security
Appropriate technical and organizational measures, described on the security page.
The Processor implements appropriate technical and organizational measures to protect personal data, including those described in security and access practices: least-privilege access, encrypted connections, separate credentials per client, access logging, and secure deletion. The Processor does not hold SOC 2 or ISO 27001 certifications and does not claim to.
Sub-processors
We use a small number of providers and keep them bound to the same duties.
The Controller gives general authorization for the Processor to use sub-processors for hosting, email delivery, communications and project management. The Processor binds each sub-processor to data protection duties no less protective than this DPA, remains responsible for their performance, and will tell the Controller of material changes on request, giving the Controller a reasonable opportunity to object. A current list is available through the contact form under ‘Privacy or data request’.
International transfers
Where data leaves the EEA or UK, approved safeguards apply.
The Processor may process personal data in the United States and other countries where its sub-processors operate. Where this involves a transfer from the EEA, UK or Switzerland to a country without an adequacy decision, the parties agree that the Standard Contractual Clauses (Module Two, controller to processor) and, for the UK, the UK addendum, are incorporated by reference, with the Controller as exporter and the Processor as importer, and the details in the processing table above as annexes.
Assistance
We help you answer rights requests and meet your own obligations.
Taking into account the nature of the processing, the Processor will reasonably assist the Controller in responding to data subject requests, carrying out data protection impact assessments and consulting regulators. The Processor will forward to the Controller any request it receives directly from a data subject and will not respond to it except on the Controller’s instructions.
Personal data breaches
We tell you without undue delay, and within 72 hours.
The Processor will notify the Controller without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting the Controller’s personal data, and will provide the information reasonably available to help the Controller meet its own notification duties, including the nature of the breach, likely consequences and measures taken.
Return and deletion
At the end, we delete or return your working data within 90 days.
Within 90 days after handover, or earlier on the Controller’s request, the Processor will delete or return, at the Controller’s choice, personal data held as working copies, and delete existing copies unless the law requires storage. Backups are deleted in the ordinary course of their cycle.
Audits and information
We give you what you need to check we comply.
The Processor will make available the information reasonably necessary to demonstrate compliance with this DPA and allow for audits by the Controller, no more than once a year unless there is a breach or a regulator requires it, on reasonable notice, during business hours and subject to confidentiality. Where possible, the Processor will satisfy audit requests with written answers or documentation first.
Liability and order of precedence
The main terms’ liability rules apply here too.
Each party’s liability under this DPA is subject to the limitations in the terms of service, except where the law does not allow them. If this DPA conflicts with the terms of service about personal data, this DPA prevails.
Signing and requests
This DPA applies automatically. If you need a signed copy, ask.
This DPA applies automatically to the Controller’s orders. If you need a signed copy, a different template or a transfer addendum, ask through the contact form under ‘Privacy or data request’ and we will respond within 24 hours.
Common questions about this policy.
10 short answers to what people ask most. If yours is missing, ask it and a person replies within 24 hours.
Do I need to sign this?
No. The data processing agreement applies automatically to every order, so you do not need to sign anything to be covered. If your compliance or procurement team needs a signed copy for their records, ask through the contact form and we will provide one, usually within a day or two.
Are you SOC 2 or ISO 27001 certified?
No, and we do not claim to be. Those certifications are costly audits of larger organizations, and implying one that we lack would be misleading. Instead, we describe our practices openly on the security page, so your team can judge them directly, and we answer written security questionnaires as best we can.
Who are your sub-processors?
We use providers for hosting, email delivery, communications and project management, each under a written agreement that requires them to protect your data. The current list, with what each one does, is available on request through the contact form. We tell clients before we add one that would process their data in a materially new way.
How fast do you report a breach?
Without undue delay, and in any case within 72 hours of becoming aware of it. Our notice tells you what happened, which data was affected, what we have done and what we recommend you do. We keep a written incident process so that response does not depend on who happens to be available.
Do I need a separate signature?
No. The agreement applies automatically to every order, and accepting our terms covers it. If your compliance team needs a signed copy for audits, ask through the contact form and we will send one.
Who is the controller?
You are, for personal data inside your own systems, such as your customers’ names and orders. We act as your processor when we handle that data to build or support your automation, and only on your documented instructions. For the details you give us to run your account, we are the controller, as the privacy policy explains.
Where is data processed?
Mainly in the United States, and wherever our sub-processors operate. When personal data is transferred from the European Economic Area, the United Kingdom or Switzerland, we rely on approved safeguards such as standard contractual clauses. If you need processing kept in a particular region, tell us before you order so we can say whether it is possible.
Can I audit you?
Yes, once a year on reasonable notice, and after a breach. We start with written answers and documents, such as our practices and sub-processor list, because that is faster and less disruptive for both sides. If those do not satisfy a legal requirement, we will agree a reasonable way for you to verify our compliance.
What if a data subject writes to you?
We forward the request to you promptly and do not respond to it ourselves except on your instructions, because you are the controller and the decision is yours. If you ask us to help, for example by finding or deleting a person’s records inside the automation, we do it and confirm in writing.
Do you use customer data to train AI?
No. Your data, and the data inside your systems that we handle for your order, is never used to train artificial intelligence models, ours or anyone else’s. We use it only to build, test and support your automation, and we delete working copies on the schedule in the data processing agreement.
Other policies and guides.
Our policies are written to work together. These are the ones most often read alongside this page.
Questions about this policy?
Ask us in plain words and a person will answer within 24 hours. We would rather clarify than leave you guessing.