Note: This page summarizes typical Data Processing Addendum (DPA) terms. The signed DPA between Code Four and the Customer governs in the event of any conflict.
Scope of Processing
Code Four processes Customer Data only under Customer instructions and as necessary to provide the contracted Services. Processing activities are limited to the purposes described in the customer agreement and Platform Privacy Addendum.
Confidentiality Obligations
Code Four personnel who access Customer Data are subject to confidentiality obligations. Access is limited to personnel who require it for their job functions.
Security Measures
Code Four implements appropriate technical and organizational security measures, including:
- •Encryption of data in transit and at rest
- •Access controls and authentication mechanisms
- •Audit logging and monitoring
- •Regular security assessments
For more details, see our Security Overview.
Subprocessors
A list of subprocessors that may process Customer Data is available on our Subprocessors page. Customers will be notified of material changes to the subprocessor list as specified in their agreement.
Breach Notification
In the event of a data breach affecting Customer Data, Code Four will notify the affected Customer without undue delay. Notification will include information about the nature of the incident, affected data, and remediation steps taken.
Data Subject Requests
The Customer is responsible for responding to data subject requests regarding Customer Data. Code Four will provide reasonable assistance to enable Customers to fulfill such requests.
Deletion and Return of Data
Upon termination of the agreement, Code Four will delete or return Customer Data as specified in the customer agreement. Deletion will be performed within a reasonable timeframe following the termination date, subject to any legal retention requirements.