Legal
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Media Yard LLC, PO Box 73, Pennsauken, NJ 08110, USA (“we”, the processor) and you, the business customer using Proofloft. It applies whenever your use of the Service involves personal data of other people — most notably the testimonials submitted through your collection forms. No separate signature is required: this DPA is automatically effective for all business customers. For a countersigned copy, email legal@proofloft.com from your account email.
It is meant to satisfy Article 28 of the EU GDPR and UK GDPR, the Swiss Federal Act on Data Protection, and, where California law applies, the CCPA/CPRA service-provider requirements.
If we become aware of a personal-data breach affecting data we process for you, we will notify you at your account email without undue delay, and in any event within 48 hours of becoming aware. The notice will describe what happened as far as we know, the categories and approximate number of people and records involved, the likely consequences, what we are doing about it, and how to reach us. We will send further details as we learn them.
You authorize the subprocessors we use to run the Service:
Stripe processes your own payment data as its own controller and never receives testimonial data, so it is not a subprocessor under this DPA.
We impose data-protection obligations on each subprocessor that are no less protective than this DPA, and we remain responsible to you for their performance. If we add or replace a subprocessor that will process this data, we will update this page and email account holders at least 30 days in advance. You may object on reasonable data-protection grounds within that window; if we can’t resolve the objection, you may stop using the Service and close your account, with a refund of any prepaid fees for the unused period.
All processing takes place in the United States. Where data you send us is subject to EU, UK, or Swiss transfer rules, the transfer is covered as follows.
EU: the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914 (“SCCs”) are incorporated into this DPA, with you as data exporter and Media Yard LLC as data importer:
UK: the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force 21 March 2022) applies, and its Part 1 tables are completed as follows. Table 1 (parties): as in Annex I.A above. Table 2 (selected SCCs, modules and clauses): the EU SCCs as selected above. Table 3 (appendix information): sections 3, 6 and 7 of this DPA. Table 4 (ending the Addendum when it changes): neither party. The competent authority is the Information Commissioner’s Office.
Switzerland: the SCCs apply with references to the GDPR read as references to the Swiss Federal Act on Data Protection, the Federal Data Protection and Information Commissioner as the competent authority, and “member state” read so that data subjects in Switzerland can bring claims where they habitually reside.
On request, we will give you the information we have about US law and our practices that you need for a transfer impact assessment. We are not certified under the EU–US Data Privacy Framework or the UK–US Data Bridge. If this DPA conflicts with the SCCs, the SCCs control.
Deleting a testimonial in your dashboard removes it from our live database immediately. Archiving a form takes the form and its wall offline, but keeps its testimonials in your account (and in your export) until you delete them or close your account. You can export your testimonials and permission records as CSV or JSON at any time from Account → Your data. When your account closes, we delete the personal data we process for you within 30 days, except records the law requires us to keep; deleted data then leaves our database provider’s point-in-time recovery within a further 30 days. If you can’t export it yourself, email legal@proofloft.com before closure or within 30 days after and we will send it. On request, we will confirm deletion in writing.
On written request to legal@proofloft.com, no more than once in any 12 months, we will make available the information reasonably necessary to demonstrate compliance with Article 28, and answer within 30 days. If that information isn’t enough, or a supervisory authority requires it, you may audit our compliance yourself or through an independent auditor who is not our competitor and is bound by confidentiality, on at least 30 days’ notice, during US business hours, in a way that doesn’t disrupt the Service or expose other customers’ data. Audits are at your cost, unless they reveal a material breach of this DPA. Our subprocessors are audited under their own programs; on request, we will pass on the reports they make available to us.
Where the CCPA/CPRA applies, Media Yard LLC is your service provider. We will not sell or share the personal data, retain, use, or disclose it outside our direct business relationship with you or for any purpose other than providing the Service, or combine it with personal data from other sources except as the law allows. We will comply with the CCPA as it applies to us, give the data the same level of protection the CCPA requires, and tell you if we can no longer meet these obligations, in which case you may take reasonable steps to stop and remediate unauthorized use.
Each party’s liability under this DPA follows the Terms of Service, except where the SCCs or data-protection law (such as GDPR Article 82) require otherwise. If this DPA conflicts with the Terms on a data-protection matter, this DPA controls; if it conflicts with the SCCs, the SCCs control. Questions: Media Yard LLC · PO Box 73, Pennsauken, NJ 08110 · legal@proofloft.com.