This agreement sets out how Redefine Web LLC handles personal data on behalf of a client, under the GDPR, the UK GDPR, the CCPA as amended, and comparable privacy laws. It applies to every engagement where we touch a client's data, whether or not it is separately signed.
1. Who this agreement is between
This Data Processing Agreement forms part of the engagement between the client named in a signed Redefine Web proposal, statement of work or order form (the "Client") and Redefine Web LLC of 169 Madison Ave Ste 78883, New York, NY 10016 ("Redefine Web", "we", "us").
For personal data the Client gives us, or that we access on the Client's systems, the Client is the controller and Redefine Web is the processor. Where we process data about our own visitors and prospects we act as a controller in our own right, and the Privacy Policy governs that instead. This agreement applies to the first case only.
Where this agreement and a signed engagement disagree about data protection, this agreement governs. Where it and the Terms of Use disagree, this agreement governs on data protection and the Terms govern on everything else.
2. What we process, and why
We process personal data solely to deliver the services described in the Client's signed engagement, and only for the duration of that engagement.
Subject matter and duration. The provision of marketing, web development, search and advertising services, for as long as the engagement runs, plus the wind-down period in section 8.
Nature and purpose. Hosting, storage, retrieval, analysis, organization and deletion of data as needed to build, run, measure and report on the Client's website, search program and advertising accounts.
Types of personal data. Typically contact details submitted through forms on the Client's website, inquiry and call records, CRM records the Client gives us access to, advertising account data, and website usage data tied to an identifier. The engagement can narrow or widen this, in writing.
Categories of data subject. The Client's customers, patients, inquirers and website visitors, and where the Client gives us access, the Client's own staff.
We do not sell personal data, we do not share it for cross-context behavioral advertising, and we do not use it to train models or to build profiles for any purpose of our own.
3. Acting on the Client's instructions
We process personal data only on the Client's documented instructions, including on international transfers, unless a law we are subject to requires otherwise. Where that happens we tell the Client before processing, unless the law forbids us from saying so.
The engagement, this agreement and the Client's written requests in the ordinary running of the work are the instructions. If we think an instruction breaks data protection law, we say so.
The Client is responsible for having a lawful basis for the data it gives us, for the notices and consents its own visitors and customers receive, and for the accuracy of what it sends.
4. Confidentiality and who can see the data
Access is restricted to named team members who need it to do the work, each under a written confidentiality obligation that survives the end of their engagement with us.
Every account with access uses two-factor authentication. We remove access within one business day of a person leaving the project or the company, and we review the access list at least quarterly.
5. Security measures
We keep technical and organizational measures appropriate to the risk, taking into account the state of the art, the cost of implementation, and the nature and severity of the risk to the people concerned. Those measures include:
- Encryption of client data at rest and in transit.
- Access restricted to named team members, each with two-factor authentication.
- Audit logs of administrative access, retained for 12 months.
- Separation of production from staging and development environments.
- Patching of the platforms we run on a defined schedule, and backups tested by restore.
- Password managers and unique credentials for every system, never shared accounts.
Security measures change as the threats do. We may replace a measure with one at least as protective, and we will not weaken the overall level of security.
6. Sub-processors
The Client gives general authorization for us to appoint sub-processors. We use them for hosting and infrastructure, email delivery, analytics and reporting, advertising platforms, call tracking where the engagement includes it, and productivity and project tooling.
Every sub-processor is put under written terms no less protective than this agreement, and we remain liable to the Client for what they do with the Client's data.
We provide the Client with the current list of named sub-processors, with what each one is used for and where it processes data, on written request to the address in section 9. We give the Client at least 30 days written notice before adding or replacing one, and the Client may object within 15 days of that notice. If an objection cannot be resolved, either party may terminate the affected part of the engagement without penalty for the terminating party.
7. International transfers
We are established in the United States and some of our sub-processors process data outside the country where it was collected.
Where personal data protected by UK or EU law is transferred to a country without an adequacy decision, the transfer is made under the relevant Standard Contractual Clauses or the UK International Data Transfer Addendum, together with any additional measures the transfer risk assessment calls for. The Client's signature on the engagement is its entry into those clauses with us, as data exporter to our data importer, for the processing described in section 2.
8. Rights requests, incidents and the end of the engagement
Data subject rights. If a person contacts us directly about data we hold for the Client, we do not answer on the Client's behalf. We pass the request on without undue delay. We assist the Client in responding to requests for access, deletion, rectification, restriction, objection and portability within 15 business days of being asked, using appropriate technical and organizational measures.
Personal data breaches. If we become aware of a breach affecting the Client's personal data we notify the Client without undue delay and in any case within 48 hours, with what we know at the time: the nature of the breach, the categories and approximate number of people and records concerned, the likely consequences, and the measures taken or proposed. We keep the Client updated as we learn more, and we do not notify a regulator or a data subject on the Client's behalf unless the Client asks us to in writing.
Assessments and consultation. We give the Client reasonable assistance with data protection impact assessments and with prior consultation of a supervisory authority, for the processing we carry out.
Deletion and return. At the end of the engagement the Client chooses whether we delete or return the personal data we hold. We act on that choice within 30 days of the engagement ending, or of the Client asking, whichever is later. Backups are isolated from further processing and deleted on their ordinary cycle. We keep only what a law requires us to keep, and only for as long as it requires.
Records and audits. We keep records of the processing we carry out for the Client and make available the information needed to demonstrate compliance with this agreement. The Client may audit that compliance once in any 12 month period, on 30 days written notice, at its own cost and without disrupting our other clients, and more often if a regulator requires it or following a breach affecting the Client.
9. Changes, term and contact
This agreement takes effect when the engagement does and runs until all the Client's personal data has been deleted or returned under section 8.
We may update this agreement to reflect a change in law, in our sub-processors or in our security measures. Where a change materially reduces the protection given to the Client's data we give 30 days notice before it takes effect, by the same route as a sub-processor notice.
Questions, requests, audit notices and sub-processor objections go to Redefine Web LLC, 169 Madison Ave Ste 78883, New York, NY 10016, or hello@redefineweb.com. Related documents sit in the Legal Center.