Data Processing Agreement
Outline — placeholder, not final.
Draft — not final. This page is a working outline, not reviewed or approved by an attorney. It is not a binding legal agreement yet and should not be relied on as one.
For a business customer (a builder) whose own homeowner clients' personal data flows through Hearthline. Not yet applicable to Hurley House Co.'s own current use — this becomes relevant once Hearthline is sold to another builder.
Roles
The Customer (builder) acts as the Controller of its homeowner clients' personal data; Hearthline acts as the Processor.
Scope
- Subject matter, duration, nature & purpose of processing
- Categories of data subjects: the Customer's staff and its homeowner clients
Subprocessors
Same list as the Privacy Policy (Supabase, Vercel, Resend, Anthropic), plus a process for approving any new one.
Security & incident response
- Security measures (reference the Privacy Policy's Security section)
- Data subject request assistance
- Breach notification timeline
On termination
Data return or deletion, and limited audit rights.