Data Processing Addendum

Overview

This Data Processing Addendum (“DPA”) forms part of the Master Services Agreement (“MSA”) whenever Twirling Umbrellas Ltd. processes Personal Information on Client’s behalf under an Order. No separate opt-in is required. It governs that processing to the extent of conflict with the MSA. Section 14 of the MSA continues to govern Clutch Guarantee matters.

1. Relationship to the MSA

1. Relationship. The MSA and Order govern the Services, fees, and commercial terms. This DPA governs entrusted Client Personal Information. Changes follow Section 16.1 of the MSA; posting an update does not change an active Project Order. Our independent billing, sales, recruitment, and relationship records are governed by our Privacy Policy and applicable law.

2. Definitions

1. Applicable Privacy Laws. Privacy, data protection, and data security laws that apply to the particular processing under an Order.
2. Client Personal Information. Personal Information provided by or on behalf of Client, or collected, hosted, accessed, transmitted, migrated, tested, or otherwise processed on Client’s behalf in providing the Services.
3. Privacy roles. Controller, Processor, Business, Service Provider, Contractor, Data Subject, Consumer, and similar terms have the meanings given by Applicable Privacy Laws where those terms are used.
4. Security Incident. A breach of safeguards involving unauthorised access, collection, use, disclosure, copying, alteration, disposal, loss, destruction, or similar compromise of Client Personal Information under our control.
5. Subprocessor. A third-party provider we appoint to process Client Personal Information on Client’s behalf. Software installed locally is not a Subprocessor merely because it is used; a separate provider must receive or access the information.
6. MSA terms. Other capitalised terms have their meanings in the MSA.

3. Roles

1. Roles and responsibility. Client determines the purposes of its processing and provides lawful instructions, notices, and consents. We act as Client’s service provider or processor for entrusted information. Each Party remains responsible for its own legal duties. Calling a provider independent does not remove our responsibility for information under our control or processing we delegate.

4. Instructions and Use

1. Permitted processing. We will process Client Personal Information only to provide and secure the specified Services, follow Client’s documented instructions, or meet a legal requirement. We will not use entrusted information for unrelated product development, advertising, profiling, or general model training.
2. Documented instructions. The Order, this DPA, approved Change Orders, and authorised written requests record Client’s instructions. Requests may be communicated through email, support tickets, or the project system by an authorised contact. Access to a system is not unrestricted permission to use everything it contains.
3. Problematic instructions. We will flag instructions we reasonably believe are unlawful or materially unsafe and pause the affected processing while seeking clarification. A request outside the purchased scope may require a Change Order. Required legal safeguards and correction of our own breach are not conditional on purchasing extra Services.
4. Required disclosure. If law requires processing outside Client’s instructions, we will notify Client before that processing where legally permitted. Any disclosure will be limited to what the law requires.

5. Processing Description

1. Service description. The Order and relevant processing information identify the Services, purposes, duration, information categories, individuals affected, and any special safeguards or location restrictions. The description must be specific enough to identify the actual processing; the examples below do not authorise every listed activity.
2. Activities. Depending on the Order, processing may include hosting, development, maintenance, support, migration, deployment, form handling, integrations, email delivery, testing, and backups. Processing continues for the Services and the permitted transition or retention periods in Section 14.
3. Information categories. Relevant information may include names, contact details, account identifiers, usernames, membership or customer records, form submissions, transaction references, uploaded files, network addresses, usage records, and support information. We will minimise production Personal Information in development and testing.
4. Individuals. Depending on the Services, individuals may include Client’s personnel, members, registrants, customers, donors, applicants, account holders, or website visitors.
5. Sensitive information. Client should identify health, financial, child-related, public-sector, regulated, or other sensitive datasets before providing them. The Parties will record the necessary safeguards and authority in the Order or documented instructions. If such information is received unexpectedly, we will restrict the affected processing and consult Client; this does not excuse our existing protection duties.

6. Restrictions

1. Purpose restrictions. We will not sell Client Personal Information or share it for cross-context behavioural advertising. We will not combine entrusted client datasets for unrelated purposes. Required service-provider restrictions under an applicable privacy law apply to the relevant processing. Any new purpose requires lawful authority and Client’s documented approval.

7. Confidentiality

1. Confidentiality and access. Access is limited to people and providers who need the information for the permitted purpose and are bound by confidentiality duties. We remain responsible for authorised personnel and delegated processing, subject to the MSA’s liability provisions.

8. Security

1. Baseline safeguards. We will maintain reasonable administrative, technical, and physical safeguards appropriate to the information and risks. Baseline legal security duties do not depend on buying an additional service.
2. Access and credentials. Safeguards include proportionate access permissions, secure credential handling, strong authentication, multi-factor authentication where appropriate and available, confidentiality duties, and timely review of access when roles or Services change.
3. Systems and transmission. We will use appropriate protection for transmission and storage, review relevant providers, and maintain procedures for recognising and responding to suspected incidents. The measures must reflect the systems and information actually involved.
4. Purchased maintenance and backups. We will apply the maintenance, monitoring, updates, backups, and restoration support included in the Order. Client-managed systems remain Client’s responsibility. A service-specific limitation does not excuse our own handling, configuration, or legally required safeguards.
5. Shared responsibilities. Each Party protects the systems and access within its control and cooperates on issues spanning both environments. We do not guarantee prevention of every incident or uninterrupted availability. Formal certifications, fixed recovery objectives, or enhanced safeguards apply when expressly included in the Order.

9. Subprocessors

1. Appointment and terms. Client authorises relevant Subprocessors to provide the specified Services. We will appoint them under written terms protecting Client Personal Information appropriately and remain responsible for their delegated processing.
2. Relevant provider information. We will identify providers relevant to Client’s Services, their purposes, and material processing arrangements. Listing a possible provider does not mean it receives every client’s information.
3. Changes and notice. We will notify Client before a material addition or change, allowing a reasonable opportunity to raise a privacy or security objection. Notice must identify the relevant change; updating a general web page alone does not provide notice to an affected Client.
4. Objections. We will work with Client on a practical alternative or safeguards before starting disputed processing. If no reasonable solution is available, Client may end the affected processing without an agency cancellation penalty. Charges and unused fees are accounted for under Section 15.9 of the MSA.
5. Urgent replacement. A replacement needed urgently for security, law, or service continuity receives prompt notice and the same opportunity to raise concerns. We will limit any interim processing to what is reasonably necessary.

10. Providers and AI Tools

1. Provider information. The tables below identify providers that may be used for the relevant Services. They do not mean every provider receives every client’s information. Providers engaged directly by Client retain their own relationship with Client; our implementation and handling remain subject to our obligations. The actual service, relevant information, locations, and material retention arrangements must be identified for the engagement.
2. Service-specific information. Before entrusted Client Personal Information is processed in a provider or AI tool, we will identify the relevant product and account, purpose, information categories, processing locations, applicable data terms, and material retention arrangements in the Order or other written processing instructions. Approval of one product or purpose does not authorise additional products, connectors, or uses.
3. AI authorisation. AI processing of Client Personal Information must use an identified product and authorised purpose, with appropriate commercial data terms and settings preventing general-purpose model training on that information. Permission must cover relevant connected-system access as well as pasted prompts. Consumer tools or unspecified connectors are not assumed to be authorised. Sensitive or regulated information and production credentials require specific safeguards and authorisation. Client may request an alternative workflow; any effect on cost or timing requires approval.

Weglot and WPML accounts are provided by Client where used. Client-appointed translation and advertising platforms should be identified in the applicable Order. Our own advertising, lead management, and billing providers are addressed in our Privacy Policy. OpenAI, Anthropic, and Google Gemini currently support our public TwirlingGPT service; this does not authorise sending Client Personal Information to them for client work. Any such use requires the service-specific identification and authorisation described above.

Hosting, Infrastructure, Security, and Development

Provider	Typical purpose
Pantheon	Website hosting and related platform services
Google Cloud Platform	Cloud hosting, infrastructure, and application services where used
Canadian Web Hosting	Plesk server hosting for select client websites or systems
Cloudflare	CDN, DNS, WAF, security, bot mitigation, and performance services
GitHub	Source code hosting, version control, issue tracking, and development collaboration

Website, Platform, and Application Services

Provider	Typical purpose
Twilio SendGrid	Transactional email delivery, such as form notifications, account emails, or password resets
Google Analytics	Website analytics and measurement where configured for Client

Business, Design, Project, and Collaboration Systems

These providers may process Client contact information, project information, design assets, feedback, files, or communications in connection with project delivery and account administration.

Provider	Typical purpose
Google Workspace	Email, calendar, document storage, and internal collaboration
Productive.io	Project management, CRM, agency operations, time tracking, budgeting, and client communication
Figma	Design, prototyping, collaboration, and design review
Markup.io	Website and design feedback
Adobe cloud services	Design collaboration, shared assets, and document workflows where Client Personal Information is uploaded or shared

11. International Processing

1. Locations and safeguards. The relevant processing locations, including material remote support access, must be identified before restricted information is transferred. We do not promise Canadian-only processing unless the Order includes it and the configured providers support it. The Parties will put any legally required transfer mechanism and safeguards in place before the affected transfer. A general authorisation does not override a mandatory location or transfer restriction.

12. Individual Rights and Assistance

1. Requests received by us. We will promptly forward requests concerning Client Personal Information to Client and follow its instructions, subject to law. Client determines the response where it controls the processing, including applicable access, correction, deletion, portability, restriction, or objection rights.
2. Assistance. We will provide reasonable assistance with individual requests, privacy assessments, regulator enquiries, and other required privacy duties, taking account of the processing and information available to us. We will explain material technical limits and work on a suitable alternative.
3. Costs. Required assistance and correction of our own breach are not excluded merely because they were not itemised in an Order. Substantial additional work unrelated to our breach may have a reasonable fee disclosed and approved in advance. A fee dispute does not suspend a mandatory legal duty.

13. Security Incidents

1. Prompt notice. We will notify Client without undue delay after becoming aware of a Security Incident affecting Client Personal Information. Initial notice will include information reasonably available and will not be delayed solely because an investigation is incomplete.
2. Notice contents. Where known, notice will describe the nature and timing of the incident, information and individuals affected, relevant systems or providers, containment and remediation steps, and a contact for follow-up. We will provide material updates as facts become available.
3. Response and cooperation. We will take reasonable containment and remediation steps, preserve relevant evidence appropriately, and cooperate on assessment and required reporting. Assistance relating to our own breach is not an additional charge.
4. Reporting responsibilities. Each Party remains responsible for notifications and records the law requires of it. We will coordinate communications where practical without delaying a mandatory notification. Notice is not itself an admission of fault.

14. Return and Deletion

1. Return or deletion. When Services end, or on Client’s lawful instruction, we will arrange return or deletion of Client Personal Information within the applicable documented retention and offboarding process. We will identify the available export, relevant systems, and any transition work. Client-owned information is not withheld over an unrelated or good-faith disputed invoice.
2. Permitted retention. Only information reasonably needed for legal obligations, a documented dispute, security, or routine backup cycles may remain. The reason and applicable period must be proportionate. Billing records do not justify retaining an entire client database, and indefinite retention for unspecified future use is not permitted.
3. Retained copies and backups. Retained copies remain protected, with access limited to their permitted purpose, and are deleted when that purpose ends. Backups may expire through their normal documented cycle. If a backup is restored, previously instructed deletions will be reapplied before ordinary use where reasonably practical, subject to legal requirements.
4. Service-specific periods. The applicable Order or written offboarding plan will identify achievable periods for returning or deleting active working copies and expiring backups, including relevant project, email, design, and AI records. Any provider-specific limits or required retained records will be identified. These arrangements remain subject to the limits on retention above and Applicable Privacy Laws.
5. Completion and limits. On reasonable request, we will explain what has been returned or deleted and any remaining copies, basis for retention, and expected expiry. We will identify provider constraints and seek an appropriate solution rather than treating technical difficulty as unlimited permission to retain information.

15. Compliance Information and Audits

1. Compliance information. On reasonable request, we will provide information needed to assess compliance, including relevant safeguard, processing, and provider information. Existing documentation may be used when it reasonably answers the request.
2. Audit access. We will arrange reasonable audit access where legally or contractually required, with proportionate notice and safeguards. Reviews must protect other clients’ information, confidential provider materials, and system security. We will cooperate on an alternative method if a proposed review would unnecessarily expose them.
3. Testing and cost. Intrusive testing requires prior coordination and authorisation. Any approved fee must be reasonable and must not prevent mandatory oversight or cover remediation of our breach. Routine commercial questionnaires or additional assessments outside the Services may be scoped and priced in advance.

16. Client Cooperation

1. Client cooperation. Client will provide lawful instructions, obtain required authority, identify special restrictions and sensitive information, supply only information reasonably needed, and protect its own access and systems. We will explain material issues we identify and cooperate on a suitable resolution. Client’s responsibilities do not transfer our own duties to Client.

17. Liability

1. Limits and mandatory rights. The mutual limits and exceptions in Section 13 of the MSA apply. Provider exclusions do not excuse our own breach or delegated processing. Nothing excludes mandatory privacy rights, regulatory powers, or liability that cannot lawfully be limited. Any additional service-specific cap or safeguard must be expressly accepted in the Order.

18. Duration

1. Duration and survival. This DPA applies while we process Client Personal Information on Client’s behalf. Confidentiality, protection of retained copies, return and deletion, and accrued rights continue for as long as needed to give them effect.

For privacy questions or processing requests, contact [email protected] or your project contact. Formal notices follow the MSA.