Data Processing Addendum
Sales Pass LLC, Texas, USA — support@salespass.com
1. Roles and scope
This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between Sales Pass LLC ("Sales Pass") and the Customer. It applies to personal information contained in Customer Data ("Personal Data") that Sales Pass processes on the Customer's behalf. For that Personal Data, the Customer is the controller (or a processor acting for another controller) and Sales Pass is the Customer's processor/service provider under applicable U.S. state privacy laws, including the Texas Data Privacy and Security Act.
2. Processing instructions
- Sales Pass processes Personal Data only on the Customer's documented instructions: the Terms, this DPA, the Customer's configuration and use of the Service (including integrations the Customer connects), and written instructions to support@salespass.com.
- Sales Pass does not sell Personal Data, share it for targeted advertising, use it to train artificial-intelligence models, or process it for any purpose other than providing, supporting, and securing the Service and complying with law.
- If Sales Pass believes an instruction violates applicable law, it will inform the Customer and may pause the affected processing.
3. Details of processing
| Item | Description |
|---|---|
| Nature and purpose | Hosting, storage, transmission, display, calculation, report and document generation, backup, support, and security of workspace data in the SalesPass Kanban platform. |
| Duration | The subscription term plus the wind-down period in Section 10. |
| Categories of data subjects | The Customer's end customers, staff, technicians, and other individuals whose information the Customer submits. |
| Types of Personal Data | Contact details (name, phone, email); vehicle and insurance details; repair-order, financial, and commission data; notes; uploaded files; account identifiers of workspace users. |
| Sensitive data | None intended. The Terms prohibit submitting cardholder data, government identifiers, and HIPAA-regulated records. |
4. Confidentiality
Sales Pass ensures that every person it authorizes to process Personal Data is bound by a duty of confidentiality, and limits internal access to personnel who need it to operate, support, or secure the Service. Internal cross-workspace support access is time-limited, read-only, step-up authenticated, and audited.
5. Security
Sales Pass implements reasonable administrative, technical, and physical safeguards appropriate to the volume and nature of the Personal Data, including: TLS in transit; encryption of stored integration credentials (AES-256-GCM); salted password hashing; tenant isolation enforced at the data layer; role-based access control; mandatory multi-factor authentication for platform administrators; audit logging of privileged access; and secret management through Google Secret Manager.
6. Subprocessors
- The Customer authorizes the subprocessors listed at /subprocessors. Sales Pass binds each subprocessor by written contract to obligations materially equivalent to this DPA and remains responsible for their performance.
- Sales Pass will update that page and notify customers by email at least 30 days before adding or replacing a subprocessor that processes Personal Data. If the Customer reasonably objects, the parties will work in good faith on an alternative; if none is practical, the Customer may cancel with a pro-rata refund of prepaid, unused fees for the affected period.
7. Assistance with requests
Taking into account the nature of the processing, Sales Pass provides the Customer reasonable assistance — through Service features and through support@salespass.com — to respond to consumer-rights requests (access, correction, deletion, portability, opt-out) directed at the Customer. If a consumer contacts Sales Pass directly about Personal Data in a Customer workspace, Sales Pass will forward the request to the Customer unless the law requires otherwise.
8. Security incidents
Sales Pass will notify the Customer without undue delay after confirming a breach of security leading to unauthorized access to Personal Data, provide information reasonably available about its nature and scope, and take reasonable steps to contain and remediate it. Notification is not an admission of fault.
9. Compliance information and assessments
On reasonable written request (no more than once per year absent a confirmed incident), Sales Pass will make available information in its possession reasonably necessary to demonstrate compliance with this DPA and will allow and cooperate with reasonable assessments by the Customer or the Customer's designated assessor. Sales Pass may instead provide a report of an assessment conducted by a qualified independent assessor using an accepted control framework, which the Customer must treat as confidential.
10. Return and deletion
During the subscription and for 90 days after paid access ends, the Customer may request a complete export of Customer Data as described in the Terms. After that window, Sales Pass deletes Personal Data from production systems, after which it ages out of encrypted backups on the backup schedule, unless retention is required by law (for example billing and audit records), in which case the retained data stays protected under this DPA and is deleted when the requirement ends.
11. Order of precedence
If this DPA conflicts with the Terms regarding Personal Data, this DPA controls. This DPA is governed by the same law and venue as the Terms.