Data Processing Addendum (DPA)

This Data Processing Addendum ("DPA") supplements the Stackon Terms of Service and applies whenever Stackon processes Customer Personal Data subject to European Data Protection Legislation (GDPR / UK GDPR) on behalf of the Customer in providing the Service.

• Customer as Data Controller: The Customer (Agency) is the Data Controller for personal data uploaded regarding agency team members, contractors, and agency clients.

• Stackon as Data Processor: Stackon acts as a Data Processor processing personal data solely on behalf of and in accordance with the Customer’s documented instructions.

• Subject Matter: Provision of the Stackon client work operating system and collaboration platform.

• Duration: The duration of the Customer’s subscription plus applicable data retention and deletion periods.

• Nature and Purpose: Hosting, storing, transmitting, and organizing project deliverables, comments, tasks, timesheets, and invoices.

• Categories of Data Subjects: Agency employees, project managers, contractors, client contacts, and invoice recipients.

• Types of Personal Data: Names, business email addresses, avatars, project comments, visual feedback annotations, timesheet entries, and invoice metadata.

Stackon agrees to:

1. Process Customer Personal Data solely in accordance with documented instructions from the Customer, including regarding international data transfers;

2. Ensure all personnel authorized to process Customer Personal Data are committed to confidentiality obligations;

3. Implement technical and organizational security measures to protect Customer Personal Data against accidental or unlawful destruction, loss, or unauthorized disclosure;

4. Notify the Customer without undue delay upon becoming aware of a confirmed Personal Data Breach affecting Customer Data;

5. Provide reasonable assistance to the Customer in responding to data subject requests under GDPR Chapter III;

6. At the choice of the Customer, delete or return all Customer Personal Data upon termination of the subscription, subject to statutory storage requirements.

Customer grants general authorization for Stackon to engage subprocessors to support delivery of the Service. Stackon maintains contractual agreements with each subprocessor ensuring equivalent data protection obligations.

Our verified subprocessors include: Dodo Payments, Inc. (Merchant of Record for SaaS subscriptions), cloud server and managed PostgreSQL hosting providers, S3-compatible cloud object storage providers, and transactional email service providers.