Data Processing Agreement
Last updated: September 14, 2026
1. Scope
This Data Processing Agreement (“DPA”) applies when DangWire LLC (“Processor”) processes personal data on behalf of a customer (“Controller”) through the DangWire platform. This DPA supplements and is incorporated into the Terms of Service. It applies to all processing of personal data that occurs through use of the Service.
2. Data Processing
The Processor shall process personal data only on documented instructions from the Controller, and only for the purpose of providing the Service. Processing activities include: receiving and routing form submissions, storing workflow configurations, executing automations, and delivering notifications. The Processor shall not process personal data for any other purpose without prior written consent.
3. Sub-processors
The Processor engages sub-processors to support service delivery. Current sub-processors include: Amazon Web Services (infrastructure), Stripe (payments), and Vercel (hosting). The Processor will notify the Controller of any new sub-processors at least 30 days before engagement. The Controller may object to a new sub-processor within 30 days of notice; if the objection cannot be resolved, either party may terminate this DPA.
4. Data Security
The Processor implements appropriate technical and organizational measures to protect personal data, including:
- Encryption of data in transit (TLS 1.3) and at rest (AES-256)
- Regular security assessments and penetration testing
- Access controls and least-privilege principles
- Incident response and breach notification within 72 hours
- Annual SOC 2 Type II compliance audits
5. Data Subject Rights
The Processor shall assist the Controller in fulfilling data subject rights requests, including: access, rectification, erasure, data portability, and restriction of processing. The Processor will promptly notify the Controller if it receives a direct request from a data subject, unless prohibited by law. The Processor shall provide commercially reasonable technical assistance to fulfill these requests.
6. Cross-Border Transfers
Personal data may be transferred to and processed in the United States. The Processor ensures that cross-border transfers comply with applicable law through: Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions where available, and supplementary technical measures including encryption and access controls. The Processor will cooperate with the Controller to complete Transfer Impact Assessments as needed.
7. Liability
The Processor's liability under this DPA is subject to the limitations set forth in the Terms of Service. Each party is liable only for damages caused by its own failure to comply with this DPA. The Processor is not liable for damages arising from the Controller's instructions or from processing performed in compliance with such instructions. This DPA shall remain in effect for the duration of the processing relationship.
Contact
For questions about this DPA, contact us at [email protected].