Data Processing Addendum

1. When This Applies

This Data Processing Addendum applies where a customer uses Simple Checklist to process personal data on behalf of a business, organization, client, employee, contractor, or other third party, and applicable data protection law treats PracticalPM as a processor or service provider.

2. Roles

For account, security, support, billing if any, and service administration data, PracticalPM may act as an independent controller or data fiduciary. For checklist content that a customer controls and enters into the app, PracticalPM processes that content to provide the service according to the customer's instructions.

3. Processing Details

Processing includes storing, displaying, updating, importing, exporting, backing up, securing, and transmitting checklist data. Data subjects may include users, employees, contractors, customers, vendors, or other people whose details are entered by a customer. Data categories depend on what the customer enters into checklists.

4. Subprocessors

Subprocessors are used only as needed to operate, secure, and support the service. Current key subprocessors include:

• Hetzner, for server hosting and infrastructure. Relevant terms include Hetzner's data protection and DPA information and terms.
• Resend, for transactional email delivery. Relevant terms include Resend's legal documents, DPA, privacy policy, and terms.

Google Fonts may be used to load interface fonts in the web app, but it is not used to store checklist content or account records.

5. Security and Assistance

PracticalPM uses reasonable safeguards appropriate for a small SaaS application, including HTTPS, access controls, environment-based secrets, server-side authentication, and restricted operational access. PracticalPM will reasonably assist with data rights, deletion, export, and security requests sent to privacy@practicalpm.pro.

6. Deletion and Return

On request, PracticalPM will reasonably assist with export, deletion, or anonymization of customer-controlled personal data, subject to legal, security, backup, and operational retention needs.