1. Application and roles
Use this addendum only where DealDot processes personal data on Client’s behalf in the accepted Engagement. Client ordinarily determines the purpose and lawful basis for its customer or lead processing; DealDot acts on the documented instructions for the agreed processing. Separate independent processing, such as DealDot’s own business correspondence, must be identified and is not silently converted into Client-instructed processing.
BlueDotHost, email, AI, CRM and infrastructure roles must be assessed using their actual contracts. This draft does not claim a universal controller/processor relationship or compliance with every jurisdiction. Determine applicable law and any additional mandatory terms before processing begins.
2. Processing record
Complete $PROCESSING_RECORD with subject matter, purpose, duration, data subjects, data fields, sources, operations, recipients, locations, systems and deletion/return instructions. Typical scoped data may concern homeowner inquiries and Client business contacts, but the exact categories must be identified.
Do not include sensitive categories or data about children unless a separate lawful need, suitable safeguards and express authorization are established. The approved record, SOW and lawful written instructions define the permitted processing; a vague instruction to “use all customer data” is insufficient.
3. Instructions and lawful collection
Client provides lawful documented instructions, appropriate notices, permissions and required consent evidence. DealDot processes only for those accepted purposes, unless applicable law requires otherwise, and should inform Client of a conflicting legal requirement where permitted.
If an instruction appears unlawful or materially changes scope, DealDot should raise the concern and pause the affected activity while seeking clarification. Client does not instruct DealDot to conceal disclosures, misuse credentials, create unlawful outreach or reuse unrelated personal data. Changes require an updated record and, where necessary, a Change Order.
4. Confidentiality and security
Restrict personal-data access to authorized people with confidentiality duties and an actual need. Complete $SECURITY_MEASURES with access controls, authentication, secure transfer, logging, backup handling and other controls appropriate to the data and risks.
No certification, encryption arrangement, hosting location or security SLA is asserted without verification. Both parties protect the credentials and systems under their control. Do not send personal records through public inquiry forms when a project requires an approved secure transfer method.
5. Providers and subprocessors
List $AUTHORIZED_PROVIDERS, their functions, data access, locations and applicable terms. Establish the Client authorization process, notification of changes and any lawful objection or alternative procedure $PROVIDER_CHANGE_PROCESS. DealDot should impose appropriate data-protection obligations on processors it engages for Client processing.
Client-selected providers and direct contracts require a separate responsibility allocation. Naming BlueDotHost as Hosting Manager does not establish all data terms. No provider is authorized for unrelated Client-data training or reuse by implication; assess and document any provider practice before use.
6. Rights requests and assistance
Client handles data-subject requests concerning its processing and determines the lawful response. DealDot should relay a request concerning Client data and provide the assistance within its agreed capabilities and applicable duties, rather than disclose records to an unverified requester.
Identify contact channels, verification procedures, required time coordination and any additional agreed assistance costs. Do not charge or refuse assistance in a way inconsistent with mandatory law. The addendum does not supply an unverified universal response deadline or waive Client’s obligations.
7. Security incidents
DealDot must notify Client of a confirmed personal-data incident affecting the Client processing without undue delay as applicable law requires, using the agreed incident contact. Provide known information about scope, likely consequences, containment and mitigation, updating as facts develop. Do not delay a legally required notice merely because every detail is unknown.
Client coordinates regulator and data-subject notifications for its role with relevant providers and advisers. Each party performs its own mandatory duties and cooperates appropriately. This candidate addendum does not impose an invented hour-based deadline or promise that incidents will never occur.
8. Retention, return and deletion
Set the processing duration and $DATA_DISPOSITION. On completion or termination, return or delete Client personal data as lawfully instructed, subject to required retention and documented technical constraints. Record export format, backup handling and any delay inherent in actual provider deletion mechanisms.
Retained legal records or protected backup copies must not be reused for unrelated purposes. State the reason, safeguards and eventual disposition. Do not promise immediate deletion from every provider system unless verified and accepted. Account cancellation alone is not proof that all copies have been erased.
9. Transfers, audits and documentation
Identify international transfers and the lawful mechanism required for the actual jurisdictions and provider roles. This draft is not a substitute for mandatory transfer clauses, a completed impact assessment or an executed certification-based arrangement. Add the relevant reviewed instruments where needed.
DealDot should provide reasonable information demonstrating the agreed processing obligations and cooperate with appropriate documented review, while protecting other clients, security and confidentiality. Set $REVIEW_PROCESS for evidence, scope, access, frequency and any costs, subject to mandatory law. Do not imply unrestricted access to shared infrastructure.
10. Priority and adoption checklist
This addendum takes priority over inconsistent Engagement terms on personal-data processing, subject to mandatory law. Client-specific terms may add safeguards but may not remove mandatory protections. The master agreement otherwise applies.
Before acceptance, complete the legal parties, processing record, contacts, provider list, security measures, transfer arrangements, assistance process and data-disposition instructions. Review consistency with actual forms, privacy notices, assistant settings and hosting responsibilities. Merely publishing this draft does not complete those obligations.