Clients
Data Processing Addendum
In short
When we handle personal data inside a system we build, host or operate for a client, the client decides why and how that data is used and we act only on its instructions. This addendum sets out the protections the law requires — confidentiality, security, approved sub-processors, help with data-subject requests, breach notification within 72 hours, lawful international transfers, and deletion or return of data at the end. It forms part of our Client Terms of Engagement.
This summary is for convenience. The full text below is what applies.
1. Scope and roles
1.1 This Data Processing Addendum ("DPA") forms part of the agreement between TAKE OVER ALL LLC ("Processor", "we") and the client named in the applicable statement of work ("Client") under our Client Terms of Engagement (the "Agreement").
1.2 It applies whenever we process Personal Data on behalf of the Client in the course of providing the Services. In respect of that Personal Data, the Client is the controller (or a processor acting on behalf of its own controller) and we are the processor (or sub-processor). Under U.S. state privacy laws, the Client is the "business" or "controller" and we are its "service provider", "contractor" or "processor".
1.3 This DPA does not apply to personal data we process as a controller for our own purposes (for example our communications with the Client's representatives), which is covered by our Privacy Policy.
2. Definitions
In this DPA: "Data Protection Laws" means all laws applicable to the processing of Personal Data under the Agreement, which may include the EU General Data Protection Regulation 2016/679 ("GDPR"), the GDPR as retained in UK law and the UK Data Protection Act 2018 ("UK GDPR"), the Swiss Federal Act on Data Protection, Türkiye's Law No. 6698 on the Protection of Personal Data ("KVKK"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and other U.S. state privacy laws. "Personal Data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the applicable Data Protection Laws. "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data processed by us under the Agreement. "Sub-processor" means any third party we engage to process Personal Data under the Agreement.
3. Processing on documented instructions
3.1 We will process Personal Data only on the Client's documented instructions, which consist of the Agreement, this DPA, the applicable statement of work and any additional written instructions the Client gives that are consistent with them, unless processing is required by law to which we are subject; in that case we will inform the Client before processing unless the law prohibits it.
3.2 We will promptly inform the Client if, in our opinion, an instruction infringes Data Protection Laws. We are not required to carry out such an instruction.
3.3 The details of processing (subject matter, duration, nature, purpose, types of Personal Data and categories of data subjects) are set out in Annex 1.
3.4 The Client is responsible for the lawfulness of the processing it instructs, including having a lawful basis, providing required notices and obtaining required consents, and for the accuracy of the Personal Data it provides.
4. U.S. service-provider commitments
To the extent the CCPA or similar U.S. state laws apply, we will not: (a) sell or share Personal Data (as those terms are defined in the CCPA); (b) retain, use or disclose Personal Data for any purpose (including any commercial purpose) other than the business purposes specified in the Agreement, or outside the direct business relationship with the Client; or (c) combine Personal Data received from the Client with personal information we receive from others or collect ourselves, except as permitted by law. We will comply with applicable obligations under those laws, provide the same level of privacy protection they require, and notify the Client if we determine we can no longer meet our obligations. The Client may take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Data. We certify that we understand and will comply with these restrictions.
5. Confidentiality
We ensure that persons authorized to process Personal Data are bound by appropriate obligations of confidentiality and receive access only to the extent necessary to perform the Services.
6. Security
6.1 We implement and maintain appropriate technical and organizational measures to protect Personal Data, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risks for data subjects. Our baseline measures are described in Annex 2.
6.2 We may update our measures over time, provided that the overall level of security is not materially reduced.
6.3 Where the Services include systems hosted or administered by the Client or its other vendors, the Client is responsible for the security of those environments.
7. Sub-processors
7.1 The Client grants general authorization for us to engage Sub-processors. Our current Sub-processors are listed in Annex 3, and project-specific Sub-processors (for example an AI model provider or a messaging API selected for the project) will be identified in the applicable statement of work or in writing before use.
7.2 We will notify the Client in writing (email is sufficient) at least fourteen (14) days before engaging a new Sub-processor or replacing one. The Client may object on reasonable data-protection grounds within that period; the parties will then discuss in good faith, and if no resolution is reached, either party may terminate the affected Services without penalty.
7.3 We will impose on each Sub-processor, by written contract, data-protection obligations that provide at least the same level of protection as this DPA, and we remain liable to the Client for the performance of our Sub-processors' obligations.
8. International transfers
8.1 We may process Personal Data in the countries where we and our Sub-processors operate, including the United States, the European Union and Türkiye. We will not transfer Personal Data to a country that does not provide an adequate level of protection under Data Protection Laws unless an appropriate safeguard applies.
8.2 EU/EEA. Where Personal Data subject to the GDPR is transferred to us or our Sub-processors in a country without an adequacy decision, the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 ("SCCs") are incorporated by reference: Module Two (controller to processor) or Module Three (processor to processor), as applicable, with Clause 7 (docking clause) included, Option 2 (general authorization) in Clause 9 with the notice period in Section 7.2 of this DPA, the optional language in Clause 11 omitted, Clause 17 governed by the law of Ireland and Clause 18 disputes resolved by the courts of Ireland. Annexes I to III of the SCCs are completed with the information in Annexes 1 to 3 of this DPA, and the competent supervisory authority is determined in accordance with Clause 13.
8.3 United Kingdom. For transfers subject to the UK GDPR, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner applies and is incorporated by reference, with the tables completed using the information in this DPA.
8.4 Switzerland. For transfers subject to Swiss law, the SCCs apply with the necessary adaptations, with the Swiss Federal Data Protection and Information Commissioner as the competent supervisory authority.
8.5 Türkiye. For transfers of Personal Data subject to KVKK to countries without an adequacy decision, the parties will rely on the standard contracts announced by the Personal Data Protection Board under Article 9 of KVKK (or another mechanism permitted by Article 9), and the party required to do so will notify the standard contract to the Board within the statutory period.
8.6 If a transfer mechanism is invalidated or amended, the parties will cooperate in good faith to put an alternative lawful mechanism in place.
9. Assistance
9.1 Data-subject requests. Taking into account the nature of the processing, we will assist the Client by appropriate technical and organizational measures, insofar as possible, in responding to requests from data subjects to exercise their rights. If we receive such a request directly, we will promptly forward it to the Client and will not respond except to direct the data subject to the Client, unless the Client authorizes us or the law requires otherwise.
9.2 Other assistance. We will provide reasonable assistance to the Client in ensuring compliance with its obligations regarding security of processing, Personal Data Breach notification, data protection impact assessments and prior consultation with supervisory authorities, taking into account the nature of processing and the information available to us. Assistance beyond what is reasonably required may be charged at our then-current rates.
10. Personal Data Breaches
10.1 We will notify the Client without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Personal Data we process for the Client.
10.2 The notice will describe, to the extent known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address the breach and mitigate its effects; and a contact point. Where information is not available at once, it will be provided in phases without undue further delay.
10.3 We will take reasonable steps to contain, investigate and remediate the breach and cooperate with the Client. Our notification of a breach is not an acknowledgment of fault or liability. The Client is responsible for notifications to supervisory authorities and data subjects, unless otherwise agreed.
11. Return and deletion
At the end of the Services, or earlier on written request, we will, at the Client's choice, return Personal Data to the Client in a commonly used format and/or delete it, within thirty (30) days, and delete existing copies unless retention is required by law. Personal Data in backups will be deleted in the ordinary course of backup rotation, no later than ninety (90) days after the end of the Services, and remains protected under this DPA until then. On request, we will confirm deletion in writing.
12. Audits and information
12.1 We will make available to the Client the information reasonably necessary to demonstrate compliance with this DPA, such as written responses to security questionnaires and descriptions of our measures.
12.2 Where that information is insufficient, or where a supervisory authority requires it, we will allow and contribute to an audit by the Client or an independent auditor bound by confidentiality, no more than once in any twelve-month period (unless following a Personal Data Breach or required by an authority), on at least thirty (30) days' written notice, during normal business hours and in a manner that does not disrupt our operations or compromise the security of other clients' data. Each party bears its own costs of an audit unless the audit reveals a material breach by us.
13. Liability and precedence
13.1 Each party's liability under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement, except to the extent such limitations are not permitted by Data Protection Laws or the SCCs.
13.2 In case of conflict, the SCCs (where applicable) prevail over this DPA, and this DPA prevails over the rest of the Agreement in relation to the processing of Personal Data.
13.3 This DPA remains in effect for as long as we process Personal Data on behalf of the Client.
Annex 1 — Details of processing
| Item | Description |
|---|---|
| Subject matter | Provision of the Services described in the applicable statement of work, which may include building, integrating, hosting, maintaining and supporting software, websites, AI assistants, automations, databases and integrations. |
| Duration | For the term of the Agreement and the return/deletion period in Section 11. |
| Nature and purpose | Hosting, storage, retrieval, transmission, structuring, analysis, testing, migration, support and deletion of Personal Data as necessary to provide the Services, in accordance with the Client's instructions. |
| Categories of data subjects | As determined by the Client and described in the statement of work; typically the Client's customers, prospects, end users, employees, contractors and business contacts. |
| Types of Personal Data | As determined by the Client; typically contact details (name, email, phone), account and identification data, communication content (for example chat or message content), transaction and order data, and technical data (IP addresses, logs, device information). |
| Special categories / sensitive data | None, unless expressly agreed in the statement of work with additional safeguards. |
| Frequency | Continuous for the duration of the Services. |
Annex 2 — Technical and organizational security measures
- Encryption in transit: HTTPS/TLS for web traffic and encrypted protocols (SSH) for administration.
- Access control: key-based administrative access with password login disabled on servers we operate; unique accounts; least-privilege access; prompt revocation when access is no longer needed.
- Network protection: firewalls, a reverse proxy in front of applications, and automated blocking of repeated failed login attempts.
- Hardening and maintenance: timely operating-system and dependency updates; services run in isolated containers; minimized exposed ports.
- Secrets management: credentials and API keys stored outside source code in restricted environment configuration.
- Data minimization: collecting and retaining only the Personal Data needed for the Services; using test or anonymized data in development where practicable.
- Backups and resilience: backups where included in the Services, with restoration procedures; monitoring and alerting for availability where included in the Services.
- Logging: logging of administrative and security-relevant events, retained for a limited period.
- Personnel: confidentiality obligations for everyone with access; access only on a need-to-know basis.
- Incident response: documented process to detect, contain, assess, notify and remediate Personal Data Breaches in line with Section 10.
- Vendor management: Sub-processors selected for their security and bound by written data-protection terms.
Annex 3 — Sub-processors
| Sub-processor | Service | Location |
|---|---|---|
| Contabo GmbH | Virtual server and infrastructure hosting for systems we host | European Union (data center); other regions only if agreed for a project |
| Google (Google Workspace) | Business email and documents used to communicate with the Client | Global, including the United States |
| GitHub, Inc. | Hosting of source-code repositories, where used for a project | United States |
| Project-specific providers | For example AI model providers, messaging APIs or cloud services selected for a project | As identified in the statement of work or notified under Section 7 |