Data Processing Agreement

This Data Processing Agreement ("DPA") is part of the Terms of Service between [Company legal name, e.g. PingHOA LLC] ("PingHOA") and the association that uses PingHOA (the "Association"). It applies to personal information about owners, residents, board members and others that the Association puts into PingHOA("Association Personal Information"). The Association accepts it when a board member or manager agrees to the Terms. If this DPA and the Terms conflict about personal information, this DPA wins.

1. Roles

The Association decides why and how Association Personal Information is used; it is the "business" or "controller". PingHOA processes it only on the Association's behalf, as its "service provider" or "processor", under the California Consumer Privacy Act as amended (CCPA) and the other US state privacy laws that use these roles (for example in Virginia, Colorado, Connecticut, Texas and Oregon). Terms like "sell", "share" and "business purpose" mean what those laws say.

2. What we process, and why

• Kinds of people: owners, residents and tenants, board members, managers, committee members, vendors' contacts.
• Kinds of data: names, contact details, addresses, account balances and payment status (never full card or bank numbers), violations, requests, votes, meeting records, documents the Association uploads, and sign-in records.
• Business purposes (the only ones): hosting, storing and showing the Association's records; sending its notices, letters and messages; connecting to the Association's own Stripe account for owner payments; AI answers and drafts the Association requests; security, fraud prevention and debugging; support; and backups.
• How long: for as long as the Association uses PingHOA, plus the deletion periods in section 9.

3. What we promise not to do

• We will not sell or share Association Personal Information (including for cross-context behavioral advertising).
• We will not keep, use or disclose it for any purpose other than the business purposes in section 2, or as the law requires.
• We will not use it outside our direct business relationship with the Association.
• We will not combine it with personal information we get from other sources or from other customers, except as the law allows a service provider to (for example, to detect security incidents or fraud).

4. Following the law and the Association's instructions

• We comply with the privacy laws that apply to us as a service provider/processor and give Association Personal Information the same level of privacy protection those laws require of the Association.
• We process it only on the Association's documented instructions — these Terms and the Association's use of the app are those instructions.
• We will tell the Association if we decide we can no longer meet our obligations under these laws, or if we believe an instruction breaks the law.
• If we tell the Association that, or the Association reasonably believes we are using its data without permission, it may take reasonable steps to stop and fix the unauthorized use, including suspending our processing and exporting and deleting its data.

5. Checking that we keep these promises

The Association may take reasonable and appropriate steps to make sure we use its data as this DPA requires. On request we will provide the information needed to show compliance (such as a description of our security measures and subprocessors), and cooperate with a reasonable assessment once a year, or after a security incident, on reasonable notice and at the Association's cost.

6. Confidentiality and security

• Everyone at PingHOA who can access Association Personal Information is bound by a duty of confidentiality.
• We keep reasonable security measures appropriate to the data, including encryption in transit, hashed passwords, encrypted two-step sign-in secrets, two-step sign-in for roles that handle money or exports, role-based access per association, and an audit log of meaningful changes.

7. Subprocessors

The Association authorizes us to use the subprocessors listed in the Privacy Policy (hosting and database, email, text-message and printed-mail delivery, and AI). Each one is bound by a written contract with protections at least as strong as this DPA for the data it receives, and we remain responsible for them. We will give at least 30 days' notice (by email to the board and in the app) before adding or replacing a subprocessor; if the Association has a reasonable objection and we can't address it, it may cancel and receive a refund of prepaid fees for the unused period.

Stripe is not our subprocessor for owner payments: owners pay into the Association's own Stripe account, under the Association's own agreement with Stripe.

8. Helping with people's privacy requests

Owners and residents send requests to know, correct or delete their information to the Association. The app lets the Association view, edit, export and delete records itself. If someone sends a request to us instead, we will pass it to the Association promptly and help it respond, and we will not answer it ourselves unless the Association asks us to or the law requires it.

9. Security incidents

If we learn of a breach of security that leads to unauthorized access to or disclosure of Association Personal Information, we will notify the Association without undue delay (and within 72 hours where we can), tell it what we know, take reasonable steps to contain it, and help it meet any notice duties it has.

10. Return and deletion

The Association can export its data at any time (Settings → Data). When its subscription ends, we keep Association Personal Information for 30 days so it can export or reactivate, then delete it; backups roll off within a further 30 days. The Association can also delete everything immediately from Settings → Data. We keep only what the law requires us to keep, and only for that purpose.

11. Location

Association Personal Information is stored and processed in the United States.

12. Contact

Privacy and data-protection questions: privacy@example.com.