Data Processing Agreement

Roles

For data your organization ("Customer", acting as data controller) submits to BuildingCX, [PLACEHOLDER — needs counsel: legal entity name, registration, and registered address for BuildingCX] acts as data processor. This DPA supplements our Terms of Service and Privacy Policy for customers who need a processor agreement in place — [PLACEHOLDER — needs counsel: whether this is incorporated by reference automatically or requires a countersigned copy per customer].

Subject matter and duration

We process Customer data for as long as your organization has an active BuildingCX account, solely to provide the service described in the Terms of Service.

Processor obligations

• Process Customer data only on Customer's documented instructions (as configured through the product) and as required by law.
• Ensure personnel with access to Customer data are bound by confidentiality.
• Implement the security measures described below.
• Assist Customer in responding to data subject rights requests and, where legally required, notifying a personal data breach.
• Delete or return Customer data at the end of the relationship, at Customer's choice, subject to any legally required retention.

Sub-processors

Customer authorizes the sub-processors listed on our Sub-processors page. We'll update that page and, [PLACEHOLDER — needs counsel: notice mechanism and objection period], before adding a new one.

Security measures

• Passwords are hashed with bcrypt — we never store or can recover a plaintext password.
• Sessions use secure, HTTP-only cookies over HTTPS.
• Project data is scoped to the owning organization at the database layer (org_id-keyed), not just hidden in the UI — a user's access is checked against actual organization membership on every request.
• A CxA's status-changing authority (approving submissions, closing issues) is enforced server-side, not just hidden from other roles in the interface.

Breach notification

[PLACEHOLDER — needs counsel: specific notification timeline — commonly 72 hours under GDPR where applicable, but the exact commitment here needs to be set deliberately, not assumed]

Audit rights

[PLACEHOLDER — needs counsel: what audit mechanism, if any, is offered — e.g. a security questionnaire response vs. an on-site/third-party audit right]

Contact

Questions about this page can go through the Contact page, or to hello@buildingcx.com.