Data Processing Addendum

This addendum is part of our Terms of Service. It sets out how StrivBridge handles the personal information our customers put into the Service about their residents, applicants, prospects, owners and vendors, and the commitments US state privacy laws require of a service provider. It applies automatically; no signature is needed.

1. Roles

The Customer is the business (controller) for Customer Personal Data: personal information in Customer Data, as defined in the Terms. StrivBridge is the Customer's service provider and processor. StrivBridge is a controller only for its own account, billing, website and security information, which our Privacy Policy covers.

2. Processing only on instructions

StrivBridge processes Customer Personal Data only to provide the Service, as described in Annex 1, and on the Customer's documented instructions -- the Terms, this addendum, and the Customer's settings and use of the Service. If we believe an instruction breaks the law, we will tell the Customer.

3. Service provider commitments

For the California Consumer Privacy Act, as amended, and similar state laws, StrivBridge:

• will not sell or share Customer Personal Data, including for cross-context behavioural advertising;
• will not retain, use or disclose it for any purpose other than the business purposes in Annex 1, or outside the direct business relationship with the Customer;
• will not combine it with personal information from other sources, except as those laws allow a service provider to;
• will comply with those laws and give Customer Personal Data the level of privacy protection they require;
• will tell the Customer if it can no longer meet these obligations;
• allows the Customer to take reasonable and appropriate steps to ensure StrivBridge uses Customer Personal Data in line with the Customer's obligations, and to stop and remedy unauthorised use.

4. Confidentiality

Everyone at StrivBridge with access to Customer Personal Data is bound by a duty of confidentiality and has access only as their role requires.

5. Security

StrivBridge maintains the technical and organisational measures in Annex 2, appropriate to the risk, and may improve them over time without reducing the overall level of protection.

6. Subprocessors

The Customer authorises StrivBridge to use the subprocessors on our Subprocessors page. StrivBridge binds each by written contract to data protection obligations no less protective than this addendum, and remains responsible for their performance. We give at least 30 days' notice before adding or replacing a subprocessor. The Customer may object on reasonable data protection grounds within that period; we will work in good faith to resolve it, and if we cannot, the Customer may end the affected part of the Service and receive a refund of prepaid fees for it.

7. Helping the Customer

• Requests from individuals: the Service lets the Customer find, correct, export and delete personal information. If an individual sends a request to StrivBridge, we pass it to the Customer and do not respond ourselves unless the Customer asks us to or the law requires it.
• Assessments: we provide information the Customer reasonably needs for data protection or risk assessments of its use of the Service.

8. Security incidents

If StrivBridge becomes aware of a breach of security leading to unauthorised access to, or loss, destruction or disclosure of, Customer Personal Data, we will notify the Customer without undue delay and in any case within 72 hours, with the information we have and as it becomes available, and take reasonable steps to contain and remedy it.

9. Return and deletion

During the agreement the Customer can export Customer Personal Data at any time. When the agreement ends, the Customer has 30 days to export it; StrivBridge then deletes it within a further 30 days, except encrypted backups, which are overwritten on their regular cycle, and copies the law requires us to keep, which we continue to protect under this addendum.

10. Audits

On request, no more than once a year, StrivBridge will answer reasonable written questions about its compliance with this addendum and share relevant policies and, once available, third-party audit reports. Where the law requires more, the Customer may arrange an audit by an independent auditor bound by confidentiality, on 30 days' notice, during business hours, at its own cost.

11. Location

StrivBridge hosts and processes Customer Personal Data in the United States.

12. Precedence

If this addendum conflicts with the Terms about personal data, this addendum wins. Limits of liability in the Terms apply to this addendum.

Annex 1: Details of processing

Annex 2: Security measures

• Encryption: TLS for all connections; data encrypted at rest; sensitive fields (tax identification numbers, connection credentials, secrets) encrypted again with AES-256-GCM, with keys kept outside the database and rotated.
• Isolation: each customer's data is separated at the database level by row-level security, and every request is checked against the signed-in user's organisation and permissions.
• Access: role-based permissions, two-step sign-in, passwords hashed with Argon2id, sign-in lockout, session expiry, and periodic access reviews.
• Monitoring: a security event log, an optional audit log of record changes, error monitoring without request contents, and an incident response plan.
• Resilience: managed database with continuous backups and point-in-time recovery.
• Data minimisation: no Social Security numbers collected; card and bank numbers held by payment processors; tax identification numbers shown masked.
• People: confidentiality obligations and least-privilege access for staff.