Data processing agreement

Last updated October 12, 2026. Written in plain language, and in force: it forms part of the terms of service. Your own legal adviser is welcome to review it.

1. Parties and roles

This agreement is between the firm (the firm, the controller of its clients', vendors' and staff's personal data) and HyperNerd Inc., 2910 W. Magnolia Blvd, Burbank, CA 91505, USA, operating portspace (the processor). The processor handles personal data only on the firm's instructions, as set out in the terms of service and in the way the firm uses the portal.

2. What is processed, and why

Subject matter: running the firm's client portal. Duration: for as long as the firm holds a portal, plus the backup retention period. Nature and purpose: storing and displaying project records, sending emails the firm asks to be sent, and producing documents. Categories of data: names, work email addresses, phone numbers, business addresses, roles, sign-in and activity records, and whatever the firm's people place in project records. Data subjects: the firm's staff, its clients and their contacts, vendors and contractors.

3. The processor's obligations

• Process personal data only to provide the service and on the firm's documented instructions, and tell the firm if an instruction appears to break the law.
• Keep everyone with access bound by confidentiality, and limit access to what their work needs.
• Apply the technical and organizational measures described on the security page: encrypted transport and encrypted storage of secrets (keys, tokens, two-factor seeds), per-portal isolation, role-based access, two-factor sign-in, audit logging, nightly backups and rehearsed restores.
• Help the firm respond to requests from data subjects (access, correction, deletion) using the portal's own tools — the activity export, the people list, and removal requests — and by hand where those are not enough.
• Tell the firm without undue delay, and within 72 hours of becoming aware, of any personal-data breach affecting its portal, with what is known and what is being done.
• On the firm's request, or when the portal is closed, return the firm's data (the complete export) and, thirty days after closure, delete it from the service, unless the law requires it to be kept; the nightly off-site backups that still hold it are used only to recover the service after a fault, and go as the backup history is trimmed.
• Make available the information needed to show these obligations are met, and allow audits at reasonable notice, at the firm's cost, no more than once a year unless a breach has occurred.

4. Sub-processors

The firm authorizes the sub-processors listed on our sub-processors page. The processor tells the firm of any change at least 7 days before it takes effect; the firm may object on reasonable grounds, in which case the parties will look for a way round and, failing that, the firm may end the service without penalty. Each sub-processor is bound by written terms no less protective than these.

5. Transfers

Data is stored in the European Union. Where a sub-processor handles data elsewhere (for example email delivery or payment processing), the transfer relies on that provider's standard contractual clauses or an adequacy decision.

6. Liability and law

Liability under this agreement is as limited in the terms of service, and this agreement is governed by the same law (the laws of the State of California, with any dispute heard in the state or federal courts sitting in Los Angeles County). If the two conflict on the handling of personal data, this agreement prevails.

To sign a copy or ask for changes, email [email protected]. · Sub-processors · Security · Status · Privacy