Data Processing Agreement

1. Purpose and parties

This Data Processing Agreement (“DPA”) is between MEDIAMAKR LLC, doing business as PaywallProject (“PaywallProject,” “we,” or “us”), and the customer that uses our services (“Customer” or “you”). It forms part of our Terms of Service or any other agreement for our services (the “Agreement”).

It applies when we process personal data on your behalf while providing our services, most often information about your readers, subscribers, donors, and the people who submit content to your site. It takes effect when you accept the Terms of Service or when both parties sign it, whichever comes first.

2. Definitions

• Data Protection Laws means the privacy laws that apply to the processing, which may include the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, Swiss data protection law, the California Consumer Privacy Act as amended (“CCPA”), and other U.S. state privacy laws.
• Customer Personal Data means personal data we process on your behalf in providing the services, as described in Annex 1.
• Subprocessor means a third party we engage to process Customer Personal Data.
• Security Incident means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
• Terms such as “controller,” “processor,” “data subject,” “personal data,” “processing,” “service provider,” and “sell” have the meanings given in the applicable Data Protection Laws.

3. Roles

You are the controller (or, under U.S. laws, the business) for Customer Personal Data. We are your processor (or service provider). You decide why and how Customer Personal Data is processed, and you are responsible for having a lawful basis for it and for giving your readers the notices required by law, including your own privacy policy.

4. Your instructions

We process Customer Personal Data only on your documented instructions. The Agreement, this DPA, and your use and configuration of the services are your instructions. We may also process it when required by law, in which case we’ll tell you first unless the law prohibits it. If we believe an instruction breaks Data Protection Laws, we’ll let you know.

5. What we won’t do with your data

We will not:

• Sell or share Customer Personal Data, as those terms are defined under the CCPA, or use it for targeted or cross-context behavioral advertising.
• Use Customer Personal Data or your content to train, fine-tune, or improve artificial intelligence or machine learning models, or allow our Subprocessors to do so.
• Use Customer Personal Data to market our own or anyone else’s products to your readers.
• Retain, use, or disclose Customer Personal Data for any purpose other than providing the services, or outside our direct business relationship with you.
• Combine Customer Personal Data with personal data we receive from other sources, except as needed to provide the services and as permitted by law.

We may create anonymized, aggregated data that can’t reasonably be used to identify you or any individual, and use it to operate and improve our services.

6. Confidentiality

We make sure that everyone who can access Customer Personal Data, including our employees and contractors, is bound by a duty of confidentiality and has access only to what they need to do their job.

7. Security

We maintain appropriate technical and organizational measures to protect Customer Personal Data, taking into account the nature of the processing and the risks involved. Our current measures are described in Annex 2. We may update them over time, as long as the overall level of protection doesn’t decrease.

8. Subprocessors

You authorize us to use Subprocessors to provide the services. Our current Subprocessors are listed in Annex 3. We:

• Put a written agreement in place with each Subprocessor that includes data protection obligations at least as protective as this DPA.
• Remain responsible to you for our Subprocessors’ performance.
• Give you at least 30 days’ notice by email before adding or replacing a Subprocessor. If you have a reasonable data protection objection, tell us within that period and we’ll work with you in good faith to resolve it. If we can’t, you may terminate the affected services and receive a refund of any prepaid fees for the period after termination.

Services you connect and contract with directly, such as your own Stripe account or email service provider, are your vendors, not our Subprocessors.

9. Helping you meet your obligations

• Requests from individuals. If a reader or other person asks us directly to access, correct, delete, or export their data, we’ll forward the request to you and won’t respond ourselves unless you tell us to. We’ll help you respond to these requests through the services or with reasonable assistance.
• Assessments and authorities. We’ll give you reasonable help with data protection impact assessments and consultations with regulators, where they relate to our processing.

10. Security incidents

If we become aware of a Security Incident affecting Customer Personal Data, we will notify you without undue delay, and in any case within 72 hours. We’ll tell you what we know about the incident, the data and people likely affected, and the steps we’re taking, and we’ll update you as we learn more. We’ll take reasonable steps to contain and fix the incident and help you meet any notification duties you have. Notifying you is not an admission of fault.

11. International transfers

We are based in the United States, and our team and Subprocessors may process data in other countries. Where Customer Personal Data subject to the GDPR, UK GDPR, or Swiss law is transferred to a country that doesn’t provide an adequate level of protection, the parties agree to the EU Standard Contractual Clauses (Commission Decision 2021/914), Module Two (controller to processor), which are incorporated into this DPA by reference, together with the UK International Data Transfer Addendum and the Swiss amendments where they apply. For those clauses, you are the data exporter and we are the data importer, the optional docking clause and Clause 11 option do not apply, Clause 9 option 2 (general authorization) applies with the notice period in Section 8, and Clauses 17 and 18 are governed by and resolved under the laws and courts of Ireland. Annexes 1 to 3 of this DPA complete the annexes to those clauses.

12. Audits

On request, we’ll provide the information reasonably needed to show that we comply with this DPA. If that isn’t enough, or if a regulator requires it, you may audit our compliance once a year, with at least 30 days’ written notice, during normal business hours, and in a way that doesn’t disrupt our operations or compromise other customers’ data or our confidentiality. You’ll cover the cost of the audit, and any auditor must agree to appropriate confidentiality terms.

13. Return and deletion

When your services end, we’ll provide an export of your site files, database, and content on request, as described in the Terms of Service, if you ask within 30 days. After that, we’ll delete Customer Personal Data within a reasonable time, unless the law requires us to keep it. Data in backups is overwritten on a rolling schedule and stays protected under this DPA until it is deleted.

14. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Agreement, except where Data Protection Laws don’t allow those limitations.

15. Term and order of precedence

This DPA lasts as long as we process Customer Personal Data on your behalf. If this DPA conflicts with the Agreement on data protection, this DPA controls. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses control. We may update this DPA to reflect changes in law or our services, with at least 30 days’ notice, as long as the changes don’t reduce the protection given to Customer Personal Data.

Annex 1: Details of processing

Annex 2: Security measures

• Encrypted connections (HTTPS/TLS) for all managed websites and our dashboards.
• Access limited to team members who need it, with individual accounts and strong passwords, and two-factor authentication on key systems.
• Managed hosting with a web application firewall, malware scanning, and uptime monitoring.
• Regular updates to WordPress core, themes, and plugins.
• Regular, automated backups, kept separately from the live site.
• Blocking of known AI crawlers and abusive bots through AI Shield.
• Payment card data handled by your payment processor, so full card numbers never touch your site or our systems.
• Confidentiality obligations for all team members and contractors, and removal of access when someone leaves.
• A documented process for investigating and responding to security incidents.

Annex 3: Subprocessors

We’ll keep this list current and notify you of changes as described in Section 8.

Signatures

This DPA applies automatically when you accept our Terms of Service. If you need a signed copy, complete the details below and send it to [email protected], and we’ll countersign it.