Data Processing Addendum

Last updated: 26-07-12

This Data Processing Addendum (“DPA”) forms part of the ModMount.io Terms Of Service between MODMOUNT LLC (“ModMount”) and Client. It applies only where ModMount processes personal data as Client’s processor or service provider under applicable privacy law.

1. Roles And Scope

Client controls the purposes and instructions for processing its customer, contact, order, review, recipient, and related business data. ModMount processes that data for Client as needed to provide and operate the Service.

Client instructs ModMount to process personal data as reasonably needed to:

Provide, configure, support, secure, monitor, troubleshoot, and enforce the Service.
Follow Client’s settings, approvals, workflows, and requests.
Prevent fraud, abuse, security incidents, unwanted contact, and provider risk.
Perform analytics, debugging, service improvement, and development permitted by law.
Meet legal, provider, audit, and operational requirements.
Perform the activities described in the Terms and Privacy Policy.

ModMount may act as an independent controller or business for account administration, billing, support, security, fraud prevention, legal compliance, enforcement, referral administration, and other processing where ModMount determines the purposes and means.

Processing may continue while ModMount provides the Service and afterward for retention periods allowed by the Terms, Privacy Policy, or law.

2. Processing Restrictions

Where ModMount acts as Client’s processor or service provider, ModMount will:

Process personal data under Client’s documented instructions, including the Terms, account settings, support requests, and approved workflows.
Not sell personal data or share it for cross-context behavioral advertising.
Not use personal data outside the parties’ direct business relationship where prohibited by law.
Notify Client if an instruction appears unlawful, unless ModMount is legally prohibited from doing so.

These restrictions do not limit ModMount’s permitted use of aggregated or deidentified data. ModMount will not attempt to reidentify data it treats as deidentified.

3. Confidentiality And Security

ModMount will limit personal-data access to personnel and service providers who need it for authorized work and are subject to appropriate confidentiality obligations.

ModMount will maintain reasonable administrative, technical, and organizational safeguards appropriate to the Service and the personal data processed.

4. Subprocessors

Client generally authorizes ModMount to use subprocessors needed to provide the Service. ModMount will maintain a public subprocessor list, require subprocessors to protect covered personal data, and remain responsible for their processing to the extent required by law.

Where required, ModMount will provide reasonable notice of material subprocessor additions. Client may raise a reasonable, legally grounded objection, and the parties will work in good faith toward a practical resolution.

5. Assistance And Security Incidents

ModMount will reasonably assist Client with applicable data requests, regulatory inquiries, data-protection assessments, and similar legal obligations.

After confirming a security incident involving covered personal data, ModMount will notify Client without undue delay and provide available information reasonably needed for Client’s response.

6. Return, Deletion, And Compliance

After termination or a verified request, ModMount will delete or return covered personal data within 90 days unless retention is required or permitted by the Terms, Privacy Policy, or law.

Upon reasonable request, ModMount will provide available documentation showing compliance with this DPA. An on-site audit requires a legal obligation or reasonable evidence that written documentation is insufficient.

If this DPA conflicts with the Terms concerning personal data processed as Client’s processor or service provider, this DPA controls only for that processing.

7. Contact

For DPA questions or requests, contact help@modmount.io.