Data Processing Addendum

This Data Processing Addendum ("DPA") applies to customers of the hosted OpenPartner service. It forms part of the OpenPartner Terms of Service and takes effect when you accept them, so there's nothing to sign. If you need a countersigned copy for your records, email [email protected].

It's built on the Common Paper DPA Standard Terms, a standard agreement written by a committee of attorneys. This page is the Cover Page that completes them for OpenPartner.

Using this DPA

This DPA has 2 parts: (1) the Key Terms on this Cover Page and (2) the Common Paper DPA Standard Terms Version 1.1 posted at commonpaper.com/standards/data-processing-agreement/1.1/ ("DPA Standard Terms"), which is incorporated by reference. If there is any inconsistency between the parts of the DPA, the Cover Page will control over the DPA Standard Terms. Capitalized and highlighted words have the meanings given on the Cover Page. However, if the Cover Page omits or does not define a highlighted word, the default meaning will be "none" or "not applicable" and the correlating clause, sentence, or section does not apply to this Agreement. All other capitalized words have the meanings given in the DPA Standard Terms or the Agreement.

Common Paper DPA Standard Terms Version 1.1 free to use under CC BY 4.0.

Key Terms

Agreement

This DPA supplements the OpenPartner Terms of Service at openpartner.dev/terms, as accepted by Customer and in effect from time to time, or any signed order form or agreement between the parties that incorporates them (the "Agreement"). Provider is Brightyard, Inc., a Delaware corporation operating OpenPartner. Customer is the customer that has accepted the Agreement for the hosted OpenPartner service.

Approved Subprocessors

The Subprocessors listed at openpartner.dev/subprocessors. As of the date above:

PostHog is listed for completeness: it serves Provider's own product analytics, which Provider carries out as an independent controller (see Change 3).

Provider Security Contact

[email protected] for security matters and [email protected] for data protection requests. Postal address: Brightyard, Inc., c/o Corporation Service Company, 251 Little Falls Drive, Wilmington, DE 19808, USA.

Security Policy

The Security Policy available at openpartner.dev/security, together with the measures described in Annex II below. Provider does not currently hold a SOC 2, ISO 27001 or other certification, and has no third-party audit Report (see Change 2).

Changes to the Agreement

• DPA Covered Claim: none.
• DPA Liability Cap: none. The waivers, exclusions and limitations of liability in the Agreement apply, subject to Section 8.3 (Exceptions) of the DPA Standard Terms.
• Governing Law and Chosen Courts: not selected. The governing law and courts in the Agreement apply, except as the EEA SCCs and UK Addendum provide.

Service Provider Relationship

To the extent California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq ("CCPA") applies, the parties acknowledge and agree that Provider is a service provider and is receiving Personal Data from Customer to provide the Service as agreed in the Agreement and detailed below (see Nature and Purpose of Processing), which constitutes a limited and specified business purpose. Provider will not sell or share any Personal Data provided by Customer under the Agreement. In addition, Provider will not retain, use, or disclose any Personal Data provided by Customer under the Agreement except as necessary for providing the Service for Customer, as stated in the Agreement, or as permitted by Applicable Data Protection Laws. Provider certifies that it understands the restrictions of this paragraph and will comply with all Applicable Data Protection Laws. Provider will notify Customer if it can no longer meet its obligation under the CCPA.

In addition:

• Provider will not retain, use or disclose Customer Personal Data outside its direct business relationship with Customer, or combine it with personal information from other sources, except as expressly permitted by the CCPA and its regulations.
• Provider will provide the same level of privacy protection required of businesses under the CCPA.
• Customer may take reasonable and appropriate steps to verify Provider's compliance and, upon notice, to stop and remediate unauthorized use of Customer Personal Data. Change 2 below does not restrict these rights.

Restricted Transfers: Governing Member State

• EEA Transfers: Ireland
• UK Transfers: England and Wales

Changes to the DPA Standard Terms

The following changes to the DPA Standard Terms are made by this Cover Page.

1. Subprocessor notice.
   • In Section 2.6.1 of the DPA Standard Terms, "at least 10 business days" is replaced with "at least 30 days". In Section 3.2.3.2 (Clause 9, Option 2 of the EEA SCCs), the minimum prior-notice period of "10 business days" is replaced with "30 days".
   • Provider gives notice by email to the owner of Customer's account and by updating the list at openpartner.dev/subprocessors.
2. Security Reports.
   • Certifications. Provider is not currently audited by independent third-party auditors and does not hold a Report.
   • Security Reports. Section 5.2 of the DPA Standard Terms (Security Reports) does not apply until Provider obtains a Report, and Provider will tell Customer when it does.
   • Audits. Provider will ordinarily respond to audit requests first with documentation and questionnaires under Section 5.3 (Security Due Diligence). This does not restrict any audit, inspection or information right required by Applicable Data Protection Laws, the EEA SCCs or the UK Addendum. Audits will use reasonable notice where appropriate, and reasonable safeguards for confidentiality and for other customers' data.
3. Customer Personal Data. "Customer Personal Data" (Section 11.5 of the DPA Standard Terms) includes Personal Data that the Service collects or receives on Customer's behalf. That covers:
   • data from Customer's partners, for example partner details and payout details a partner enters in the Service's partner portal;
   • data from visitors who click a partner's link;
   • data from systems Customer connects, such as Customer's Stripe account through the Stripe App.

   Provider acts as an independent controller, under its Privacy Policy, for:

   • operating the accounts of Customer's administrators;
   • Provider's billing, invoices and payment records;
   • Provider's product analytics;
   • Provider's own security and compliance activities, including sanctions-compliance records about where Customer and its partners are located and whether a name matches a sanctions list;
   • accounts that creators hold directly with the OpenPartner Network.

   Those activities are outside the processing instructions in this DPA. Partner-program records processed on Customer's behalf remain Customer Personal Data.

4. Deletion.
   • Section 7.1 is replaced with: "Customer may remove partner payout details through the Service. Revoking portal access does not erase a partner's records. Provider will carry out other lawful correction or deletion instructions sent to [email protected] as soon as reasonably practicable, except where retention is legally required."
   • Section 7.2. By default, Customer may restore its account for 30 days after closing it. After that, Provider deletes Customer Personal Data from the Service, and copies in database backups expire within about 7 days. The 30-day restoration period does not limit Customer's right to instruct return or earlier deletion under Section 7.2.1.
   • Section 7.2.2 is replaced with: "Where required by the EEA SCCs or UK Addendum, Provider will certify completion of deletion without requiring a separate request from Customer."
   • Exports. Customer can export the records included in the documented data-portability bundle in CSV, JSON or SQL at any time. Customer may request help obtaining other Customer Personal Data.
5. Inquiries. In Section 6.1, Provider may, without Customer's prior consent:
   • acknowledge receipt of a request and direct the requester to Customer, without disclosing Customer Personal Data or responding on the merits;
   • respond where Applicable Law requires it, and will notify Customer unless legally prohibited.

   Nothing in this Change limits Provider's obligations under the EEA SCCs or UK Addendum.

Annex I(A): List of Parties

Data Exporter

• Name: Customer, as identified in its OpenPartner account or a signed order form.
• Address: as given in Customer's billing details, in a signed order form, or by Customer by email to [email protected].
• Contact person: the owner of Customer's OpenPartner account (name, role and email address as recorded in the account), or the contact in a signed order form. Customer may name a different contact, position or address by email to [email protected].
• Activities relevant to transfer: see Annex I(B).
• Role: Controller, or Processor where Customer processes the Personal Data on behalf of its own controller.

Data Importer

• Name: Brightyard, Inc. (OpenPartner)
• Address: Brightyard, Inc., c/o Corporation Service Company, 251 Little Falls Drive, Wilmington, DE 19808, USA
• Contact person: Keith Fawcett, Founder, [email protected]
• Activities relevant to transfer: see Annex I(B).
• Role: Processor (or Subprocessor, where Customer is a Processor).

Annex I(B): Description of Transfer and Processing Activities

Service

The hosted OpenPartner partner program service: referral link tracking, attribution of signups and payments to partners, commission and payout calculation, partner portal, and related API, webhooks and integrations.

Categories of Data Subjects

• Customer's end users or customers: people whose signups or payments are attributed to a partner.
• Customer's employees: Customer's users of the Service (administrators and team members), as they appear in Customer's program records, for example who approved a commission. Provider operates their accounts as an independent controller (Change 3).
• Customer's partners: affiliates, referrers, creators and other people Customer invites, approves or pays to promote it, including customers who refer others.
• Visitors who click a partner's link or use a partner's code.

Categories of Personal Data

• Name: partners, Customer's users, and payout account holders.
• Contact information: partner and user email addresses; a payout account holder's postal address, where a currency requires it.
• Financial information: partner payout details (PayPal email, bank account details, UPI ID or other payment instructions), commission and payout amounts, and the Stripe Connect account ID where used.
• Transactional information: conversion events (type, amount, currency and Customer's own references, such as invoice or order IDs), commissions, adjustments and payouts. Where Customer connects Stripe, the customer, subscription, invoice, charge, dispute and promotion-code identifiers and amounts in the Stripe events the Service reads.
• User activity and device information: for each click, a hashed IP address (not the address itself), browser user agent, referring URL, landing URL and timestamp; and activity in the Service by Customer's users and partners.
• Location information: approximate country, where available.
• Identifiers Customer chooses for its end users, linked to a click. These may be pseudonymous, for example a salted hash.
• Event metadata Customer chooses to send.
• Partner application and profile information: websites, social links, audience information and application messages.
• Partner-portal authentication records: salted password hashes, where a partner sets a password, and session records.

Special Category Data

Not processed. The Service does not need special category data, and Customer will not send it.

Frequency of Transfer

Continuous, while Customer uses the Service.

Nature and Purpose of Processing

Provider will Process Customer Personal Data as instructed in Section 2.3 of the DPA Standard Terms. The nature of processing includes:

• Receiving data, including collection, accessing, retrieval, recording and data entry: through partner links, the OpenPartner script, the API, the partner portal, and integrations Customer connects.
• Holding data, including storage, organization and structuring.
• Using data, including analysis: attributing signups and payments to partners; calculating commissions and payouts under Customer's program rules; reporting to Customer and its partners; and producing payment files at Customer's request. The Service does not make decisions about individuals that produce legal or similarly significant effects, other than calculating amounts under rules Customer sets.
• Updating data, including correcting, adaptation, alteration, alignment and combination: for example, linking a click to Customer's user, and adjusting commissions for refunds.
• Protecting data, including restricting, encrypting and security testing.
• Sharing data, including disclosure and making available: to Customer and to each partner (that partner's own data); to destinations Customer or its partners configure (webhooks, postbacks, integrations); to the OpenPartner Network, where Customer participates; and to the Approved Subprocessors.
• Returning data to the data exporter or data subject: exports of the documented data-portability bundle in CSV, JSON or SQL, and help obtaining other Customer Personal Data on request.
• Erasing data, including destruction and deletion: see Change 4.

Duration of Processing

Provider will process Customer Personal Data as long as required (i) to conduct the Processing activities instructed in Section 2.2(a)-(d) of the Standard Terms; or (ii) by Applicable Laws. Deletion after account closure is described in Change 4.

Annex I(C): Competent Supervisory Authority

The supervisory authority will be the supervisory authority of the data exporter, as determined in accordance with Clause 13 of the EEA SCCs or the relevant provision of the UK Addendum.

Annex II: Technical and Organizational Security Measures

The Security Policy, and:

• Pseudonymization and encryption of personal data. Click logs store a hashed IP address, not the IP address. The Service accepts pseudonymous identifiers for Customer's end users. Partner payout details are encrypted at the application level with AES-256-GCM before storage, and shown masked except where needed: the partner's own payout-details page, Customer's view of them, payment files Customer downloads, and data exports. Integration credentials are also encrypted at the application level: Customer's SMTP password and email-provider token, outbound webhook signing secrets, partners' postback URLs (which can carry a partner's tracker secret), Stripe App connection tokens, and OpenPartner Network connection tokens. API keys and session tokens are stored only as SHA-256 hashes.
• Confidentiality, integrity, availability and resilience. Normal tenant-scoped API requests use a database role subject to PostgreSQL row-level security, and the multi-tenant API refuses to start if that connection could bypass it. Separate privileged connections support migrations, authentication, platform operations and cross-tenant background work. Conversion events are recorded as events. Click fraud flags may be updated. Fraud review may delete and recompute accrued commissions and attributions; approved and paid commissions are preserved in that process. Refund processing uses reversals, replacement commissions and adjustment entries.
• Restoring availability after an incident. The managed database is backed up daily, with point-in-time recovery for the previous seven days. Customer can export the documented data-portability bundle at any time.
• Testing and evaluation. Changes reach production through pull requests that run automated type-checking, tests and production-dependency vulnerability checks. GitHub code scanning (CodeQL) and Dependabot run on the repository. There's a public vulnerability disclosure route at openpartner.dev/security, and good-faith reports are acknowledged within 2 business days.
• User identification and authorization. Customer users and partners sign in with emailed sign-in links, passwords or Google sign-in, and every request is checked against their role. API keys can be limited to specific scopes. Access to production data is limited to authorized personnel.
• In transit. TLS on every public endpoint. The hosting provider's managed database encrypts connections in transit with SSL/TLS. Outgoing webhooks are signed (HMAC), and incoming Stripe webhooks are verified before they take effect.
• At rest. Application-level encryption, as above. The hosting provider's managed database encrypts data at rest (LUKS), and its backups are stored off-site and encrypted.
• Physical security. Provided by the hosting Subprocessor's data centers (DigitalOcean). Provider runs no physical servers of its own.
• Events logging. Changes in Provider's operations console are recorded in an audit log. Server logs are kept for a short rolling period set by the hosting provider.
• Systems configuration. The Service is deployed automatically from the main branch of its code repository, using a defined application configuration. Database migrations run automatically, and the Service refuses to start if they fail.
• Data minimization. IP addresses are hashed, pseudonymous end-user identifiers are supported, and Customer chooses which event metadata to send.
• Limited data retention. See Change 4.
• Data portability and erasure. Export of the documented data-portability bundle in CSV, JSON or SQL at any time, with help obtaining other Customer Personal Data on request. Erasure as described in Change 4.

Annex III: Subprocessors

The Approved Subprocessors listed under Key Terms above.

Acceptance

Provider and Customer have not changed the DPA Standard Terms except for the details on the Cover Page above. By accepting the Agreement, or by signing a copy of this Cover Page, each party agrees to enter into this DPA as of the date Customer accepted the Agreement or the last date of signature.