Version 1.0. Effective October 12, 2026.
This Data Processing Addendum (the "DPA") forms part of the agreement between FatLab, LLC ("Contractor") and each client that receives services from Contractor ("Client"), whether that agreement is Contractor's Terms of Service or a signed services agreement (in either case, the "Agreement"). In the event of any conflict between this DPA and the Agreement with respect to the Processing of Personal Information, this DPA shall control. Capitalized terms not defined in this DPA have the meanings given in the Agreement.
Recitals
A. Client engages Contractor to provide WordPress hosting, support, maintenance, security, and development services for websites under Client's care, which may include websites Client manages for its own end clients.
B. In performing those services, Contractor may Process Personal Information on behalf of Client and, where applicable, Client's end clients.
C. The parties enter into this DPA to set forth their respective rights and obligations under U.S. State Privacy Laws with respect to such Processing.
1. Definitions
For purposes of this DPA, the following terms have the meanings set forth below. Other capitalized terms used but not defined here have the meanings given to them in the applicable U.S. State Privacy Law or, if not defined there, in the Agreement.
1.1 "Business" means a "business" as defined under the CCPA and any analogous term (e.g., "controller") under other U.S. State Privacy Laws.
1.2 "CCPA" means the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations.
1.3 "Consumer" means a "consumer" as defined under the CCPA and any analogous term (e.g., "data subject") under other U.S. State Privacy Laws.
1.4 "Consumer Request" means a verifiable request from a Consumer (or an authorized agent acting on the Consumer's behalf) to exercise rights granted under U.S. State Privacy Laws, including rights of access, deletion, correction, portability, opt-out of sale or sharing, and limitation on the use of Sensitive Personal Information.
1.5 "Personal Information" means information that is collected, received, or otherwise made available to Contractor by, on behalf of, or at the direction of Client in connection with the Agreement, and that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household, as further defined under applicable U.S. State Privacy Laws. Personal Information includes "Sensitive Personal Information" where applicable.
1.6 "Process" or "Processing" means any operation or set of operations performed on Personal Information, whether or not by automated means, including collection, recording, organization, storage, adaptation, retrieval, use, disclosure, transmission, dissemination, alignment, restriction, erasure, or destruction.
1.7 "Sell," "Sale," "Share," and "Sharing" have the meanings given under the CCPA.
1.8 "Sensitive Personal Information" has the meaning given under the CCPA and includes any analogous category (e.g., "sensitive data") under other U.S. State Privacy Laws.
1.9 "Service Provider" means a "service provider" as defined under the CCPA and any analogous term (e.g., "processor") under other U.S. State Privacy Laws.
1.10 "Security Incident" means any unauthorized access to, or acquisition, disclosure, alteration, loss, or destruction of, Personal Information in the possession or control of Contractor or its Subprocessors, and includes any "Breach of the Security of the System" or analogous term under applicable U.S. State Privacy Laws and state data-breach notification statutes.
1.11 "Subprocessor" means any third party engaged by Contractor to Process Personal Information on Contractor's behalf in connection with the Agreement.
1.12 "U.S. State Privacy Laws" means, collectively, all U.S. federal and state laws and regulations relating to data protection, privacy, and security that are applicable to the Processing of Personal Information under the Agreement, including the CCPA; the Virginia Consumer Data Protection Act; the Colorado Privacy Act; the Connecticut Data Privacy Act; the Utah Consumer Privacy Act; the Texas Data Privacy and Security Act; the Oregon Consumer Privacy Act; the Montana Consumer Data Privacy Act; the Tennessee Information Protection Act; the Iowa Consumer Data Protection Act; the Indiana Consumer Data Protection Act; the Delaware Personal Data Privacy Act; the New Jersey Data Privacy Act; and any other comparable U.S. state or federal law that becomes applicable during the term of the Agreement.
2. Roles of the Parties
2.1 Service Provider Status. With respect to Personal Information Processed under the Agreement, Client (or, as applicable, Client's end client) is the Business and Contractor is the Service Provider. The parties acknowledge and agree that Client does not Sell or Share Personal Information to Contractor, and Contractor's Processing is solely on Client's behalf and for the Permitted Purposes set forth in Section 3.
2.2 End-Client Personal Information. Where Personal Information Processed under the Agreement belongs to or originates from Client's end clients, Client represents and warrants that it has the authority to enter into this DPA on behalf of those end clients with respect to such Personal Information, and that the terms of this DPA are consistent with, and not more restrictive than, Client's obligations to those end clients.
3. Scope and Permitted Purposes
3.1 Permitted Purposes. Contractor shall Process Personal Information solely for the following purposes (the "Permitted Purposes"): (a) to perform the services described in the Agreement and applicable Statements of Work; (b) to provide hosting, maintenance, security, support, monitoring, backups, and development services for websites under Client's care; (c) to comply with applicable law, regulation, court order, or governmental request; and (d) as otherwise expressly authorized in writing by Client.
3.2 Prohibited Uses. Contractor shall not (and shall not permit any Subprocessor to): (a) Sell or Share Personal Information; (b) retain, use, or disclose Personal Information outside the direct business relationship between Contractor and Client; (c) retain, use, or disclose Personal Information for any commercial purpose other than the Permitted Purposes, including for cross-context behavioral advertising; (d) combine Personal Information received from Client with Personal Information that Contractor receives from, or on behalf of, any other person, or that Contractor collects from its own interaction with a Consumer, except as expressly permitted under U.S. State Privacy Laws to perform a business purpose; or (e) Process Personal Information in a manner that would, if performed by Client, violate the Agreement or any U.S. State Privacy Law.
3.3 Compliance Certification. Contractor certifies that it understands the restrictions set forth in this Section 3 and will comply with them. This Section 3 satisfies the requirement under Cal. Civ. Code § 1798.140(ag) and analogous provisions of other U.S. State Privacy Laws that the Service Provider so certify.
4. Contractor Obligations
4.1 Compliance with Law. Contractor shall comply with all U.S. State Privacy Laws applicable to its Processing of Personal Information under the Agreement, and shall provide the same level of privacy protection as is required of Businesses under those laws.
4.2 Personnel. Contractor shall ensure that personnel authorized to Process Personal Information have committed themselves to confidentiality obligations and are given access to Personal Information only as needed to perform the services.
4.3 Notification of Inability to Comply. Contractor shall notify Client promptly in writing if Contractor determines that it can no longer meet its obligations under U.S. State Privacy Laws. Upon such notice, Client may take reasonable and appropriate steps to stop and remediate unauthorized Processing, including suspending Contractor's access to Personal Information.
4.4 Cooperation with Audits and Inquiries. Upon reasonable written request and not more than once per twelve (12) month period (except following a Security Incident, a Consumer Request requiring Contractor's involvement, or an inquiry from a regulator), Contractor shall make available to Client, in a commercially reasonable manner, such information as is reasonably necessary to demonstrate Contractor's compliance with this DPA, including by completing a reasonable security and privacy questionnaire or by providing Contractor's most recent SOC 2 Type II report or comparable third-party assessment.
5. Information Security
5.1 Security Program. Contractor shall implement and maintain a written information security program containing administrative, technical, and physical safeguards designed to (a) ensure the security and confidentiality of Personal Information; (b) protect against anticipated threats or hazards to the security or integrity of Personal Information; and (c) protect against unauthorized access to or use of Personal Information that could result in substantial harm or inconvenience to a Consumer. The program shall be appropriate to the nature, scope, and context of the Processing and the risks posed to Consumers.
5.2 Minimum Controls. At a minimum, Contractor's security program shall include: encryption of Personal Information in transit and at rest using industry-standard cryptographic methods; role-based access controls and the principle of least privilege; multi-factor authentication for administrative access to systems containing Personal Information; secure software development practices and timely patching of known vulnerabilities; logging and monitoring of access to Personal Information; regular vulnerability and malware scanning of Contractor-managed systems; secure backup, retention, and disposal procedures; and a documented incident response procedure covering detection, containment, notification, and remediation.
6. Security Incident Notification
6.1 Notification. Contractor shall notify Client of any Security Incident without undue delay, and in no event later than seventy-two (72) hours, after Contractor becomes aware of the Security Incident. Such notification shall be made by email to a designated contact at Client and shall include, to the extent then known: (a) a description of the nature of the Security Incident and the categories and approximate number of Consumers and records affected; (b) the name and contact details of a person from whom additional information may be obtained; (c) a description of the likely consequences of the Security Incident; and (d) a description of the measures taken or proposed to address the Security Incident and mitigate its possible adverse effects.
6.2 Cooperation and Costs. Contractor shall reasonably cooperate with Client in Client's investigation, response, and remediation of any Security Incident, and shall bear all reasonable costs of forensic investigation, Consumer notification, credit monitoring, and remediation to the extent the Security Incident is caused by Contractor's negligent or willful act, omission, or breach of this DPA, the Agreement, or applicable U.S. State Privacy Law. Contractor's aggregate liability for the costs described in this Section 6.2 is subject to the limitation of liability in the Agreement, notwithstanding any exclusion in that section for breach of data security, privacy, or breach-notification obligations. This limitation does not apply where the Security Incident results from Contractor's gross negligence, willful misconduct, or fraud.
6.3 No Public Statements. Contractor shall not make any public statement concerning a Security Incident affecting Client or its end clients (including notification to affected Consumers) without Client's prior written consent, except as required by applicable law.
7. Subprocessors
7.1 General Authorization. Client provides general written authorization for Contractor to engage Subprocessors to Process Personal Information in connection with the services, including the third-party infrastructure and software providers listed on Contractor's Subprocessors page at https://fatlabwebsupport.com/subprocessors/ (which Contractor may update from time to time in accordance with this Section).
7.2 Subprocessor Obligations. Contractor shall enter into a written agreement with each Subprocessor that imposes data protection obligations no less protective than those set forth in this DPA, including the use, retention, disclosure, and security restrictions in Sections 3, 4, and 5. Contractor shall remain fully responsible to Client for the acts and omissions of its Subprocessors.
7.3 Changes to Subprocessors. Contractor shall keep the Subprocessors page current, showing the date it was last updated, and Client may review it at any time. If Client reasonably objects to a Subprocessor on data protection grounds, the parties shall work in good faith to resolve the objection; if they cannot, Client may, as its sole remedy, terminate the affected services without penalty, and Contractor shall refund any prepaid fees attributable to the unused portion.
8. Assistance with Consumer Requests
8.1 Forwarding Requests. If Contractor receives a Consumer Request directly from a Consumer relating to Personal Information Processed on Client's behalf, Contractor shall promptly forward the request to Client and shall not respond to the request other than to direct the Consumer to Client, except as required by applicable law.
8.2 Reasonable Assistance. Taking into account the nature of the Processing, Contractor shall provide reasonable assistance to Client through appropriate technical and organizational measures, insofar as possible, to enable Client to fulfill its obligation to respond to Consumer Requests. Where such assistance materially exceeds the scope of routine support included in the Agreement, Contractor may invoice Client for the additional work at Contractor's hourly development rate under the Agreement.
9. Return or Destruction of Personal Information
9.1 On Termination or Request. Upon termination or expiration of the Agreement, or earlier upon Client's written request, Contractor shall, at Client's option and direction, return to Client or securely destroy all Personal Information in Contractor's possession or control, including all copies in Subprocessors' possession, and shall certify such return or destruction in writing within thirty (30) days. Return shall follow the procedure set forth in the Agreement for providing Client's data following termination, and shall not be conditioned on payment of disputed amounts.
9.2 Retention Required by Law. To the extent Contractor is required by applicable law to retain copies of Personal Information following termination, Contractor shall (a) notify Client in writing of the legal requirement, (b) Process the retained Personal Information solely for the purpose and duration required by the applicable law, and (c) continue to maintain the confidentiality and security obligations of this DPA with respect to such Personal Information for so long as it is retained.
10. General
10.1 Term. This DPA takes effect when the Agreement does (or, for clients whose Agreement was already in effect, on the effective date of this DPA) and shall remain in effect for so long as Contractor Processes Personal Information on behalf of Client. The obligations of confidentiality, security, return or destruction, and indemnification shall survive termination of this DPA.
10.2 Order of Precedence. In the event of any conflict between this DPA and the Agreement with respect to the Processing of Personal Information, this DPA controls. In all other respects, the Agreement remains in full force and effect.
10.3 Changes in Law. If a change in U.S. State Privacy Laws renders any provision of this DPA insufficient to comply with applicable law, the parties shall negotiate in good faith to amend this DPA to bring it into compliance.
10.4 Severability. If any provision of this DPA is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.
10.5 Acceptance. For clients under Contractor's Terms of Service, this DPA is incorporated into those terms and applies without a signature. For clients under a signed services agreement, this DPA applies where that agreement incorporates or references it.
10.6 Signed Addenda. Where Client and Contractor have signed a separate data processing addendum, that signed addendum governs in place of this DPA for as long as it remains in effect.
10.7 Updates. Contractor may update this DPA from time to time by posting a new version on this page. The version number and effective date at the top of this page identify the current DPA. Changes to the list of Subprocessors are governed by Section 7.