Data Processing Addendum (DRAFT)

DRAFT for attorney review. Between the employer ("Business") and [LEGAL ENTITY NAME — TBD] ("Service Provider") for NoticeStamp.

Roles

Business controls employee personal information. Service Provider processes it only to provide the service, under CCPA service-provider terms (Cal. Civ. Code §1798.140(ag)).

Restrictions

• No selling or sharing; no use outside the direct business relationship; no combining with other data except as permitted.
• Confidentiality obligations on all personnel with access.

Security

Measures described on the Security page; app-level encryption of emergency-contact data with per-tenant keys.

Breach

Service Provider notifies Business without unreasonable delay and supports Business's notifications (Cal. Civ. Code §1798.82, as amended by SB 446).

Subprocessors

Vercel (hosting, US), Neon (Postgres, US), Resend (email), Twilio (SMS), Stripe (billing). Notice of changes.

Requests and deletion

Assist Business with consumer requests; delete or return data at end of service, subject to retention required by law.