{"id":256,"date":"2026-08-07T05:24:57","date_gmt":"2026-08-07T05:24:57","guid":{"rendered":"https:\/\/startandpower.com\/?page_id=256"},"modified":"2026-08-07T09:34:58","modified_gmt":"2026-08-07T09:34:58","slug":"dpa-encargo-de-tratamiento","status":"publish","type":"page","link":"https:\/\/startandpower.com\/nb\/dpa-encargo-de-tratamiento\/","title":{"rendered":"Data Processing Agreement (DPA)"},"content":{"rendered":"
\n
\n

Legal<\/p>\n

Data Processing Agreement<\/h1>\n

The terms under which startandpower processes personal data on behalf of its clients.<\/p>\n<\/p><\/div>\n<\/section>\n

\n
\n
\n

Last updated:<\/strong> 7 August 2026<\/p>\n

This Data Processing Agreement (“DPA”) forms part of the Terms of Service<\/a> between Start And Power LLC (“startandpower”, “we”, “us”, the “Processor”) and the client identified in the applicable quote or subscription (the “Client”, the “Controller”). It applies automatically, without needing a separate signature, whenever we process personal data on the Client’s behalf in the course of providing our services. If a Client requires a countersigned copy, we will provide one on request at hello@startandpower.com<\/a>.<\/p>\n

This DPA covers our managed services<\/strong> (platform and website creation and management, email, automations, payments, CRM, bookings, and customer management run for the Client). docil.ai is a separate service with its own data processing terms at docil.ai.<\/p>\n

1. Definitions<\/h3>\n

“Personal data”, “processing”, “controller”, “processor”, “data subject”, and “supervisory authority” have the meanings given in the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR. “Client Personal Data” means personal data that the Client, or its customers and users, provide to the services and that we process on the Client’s behalf \u2014 as distinct from data we process for our own purposes as controller (such as the Client’s own account and billing data), which is governed by our Privacy Policy<\/a>. Under the California Consumer Privacy Act (CCPA\/CPRA), we act as a “service provider” with respect to Client Personal Data, and this DPA constitutes the contract required by that law.<\/p>\n

2. Roles, subject matter, and instructions<\/h3>\n

The Client is the controller of Client Personal Data and startandpower is its processor. We will process Client Personal Data only on the Client’s documented instructions \u2014 which consist of this DPA, the Terms of Service, the accepted quote, and any reasonable written instructions the Client gives us within the scope of the services \u2014 unless processing is required by law, in which case we will inform the Client before processing unless the law prohibits it. We will tell the Client if, in our opinion, an instruction infringes applicable data protection law. Details of the processing \u2014 its nature, purpose, duration, the types of data, and the categories of data subjects \u2014 are set out in Annex 1.<\/p>\n

3. What we will never do with Client Personal Data<\/h3>\n

We will not sell Client Personal Data, share it for cross-context behavioral advertising, use it to train models, combine it with data from other clients, or process it for any purpose other than providing the services and complying with law. We will not retain, use, or disclose it outside the direct business relationship with the Client, and we certify that we understand and will comply with these restrictions.<\/p>\n

4. Confidentiality<\/h3>\n

We ensure that every person we authorize to process Client Personal Data \u2014 employees and contractors \u2014 is bound by confidentiality obligations, contractual or statutory, and processes the data only as needed to perform their role in delivering the services.<\/p>\n

5. Security<\/h3>\n

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, we implement appropriate technical and organizational measures to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include those described in Annex 2. We keep them under review and may update them, provided the overall level of protection does not decrease.<\/p>\n

6. Subprocessors<\/h3>\n

The Client gives general authorization for us to engage subprocessors to deliver the services. Our current subprocessors are listed in Annex 3. We will notify Clients of intended additions or replacements \u2014 by updating this page and, for active Clients, by email \u2014 at least 15 days before the change takes effect. If the Client has a reasonable, data-protection-related objection to a new subprocessor, we will work with the Client in good faith to find an alternative; if none is available, the Client may terminate the affected services under the Terms of Service. We impose data protection obligations on every subprocessor equivalent to those in this DPA, and we remain fully liable to the Client for their performance.<\/p>\n

7. Assistance with data subject rights<\/h3>\n

Taking into account the nature of the processing, we will assist the Client with appropriate technical and organizational measures in fulfilling its obligation to respond to data subject requests \u2014 access, rectification, erasure, restriction, portability, and objection. If a data subject contacts us directly about Client Personal Data, we will not respond on the merits except on the Client’s instruction; we will forward the request to the Client without undue delay.<\/p>\n

8. Assistance with compliance<\/h3>\n

We will assist the Client, taking into account the nature of processing and the information available to us, in meeting its obligations regarding security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities under Articles 32 to 36 GDPR.<\/p>\n

9. Personal data breaches<\/h3>\n

We will notify the Client without undue delay, and in any case within 72 hours, after becoming aware of a personal data breach affecting Client Personal Data. The notification will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed. We will cooperate with the Client and take reasonable steps to mitigate the breach’s effects. Notification is not an admission of fault.<\/p>\n

10. International transfers<\/h3>\n

We are established in the United States, and Client Personal Data is processed primarily in the United States (see Annex 3 for subprocessor locations). Where the transfer of Client Personal Data from the European Economic Area, the United Kingdom, or Switzerland to us is subject to GDPR or equivalent transfer rules, the parties incorporate by reference the European Commission’s Standard Contractual Clauses (Module 2: controller to processor), completed with the details in the Annexes to this DPA, with the Client as data exporter and startandpower as data importer; for UK transfers, the UK International Data Transfer Addendum applies. If those mechanisms are amended or replaced, the successor mechanism applies. We will not transfer Client Personal Data to a third country except under a valid transfer mechanism.<\/p>\n

11. Audits<\/h3>\n

We will make available to the Client the information reasonably necessary to demonstrate compliance with this DPA \u2014 including summaries of our security measures and subprocessor agreements \u2014 and will allow and contribute to audits conducted by the Client or an auditor it mandates. Audits require 30 days’ written notice, take place at most once per year during business hours (except after a breach or where a supervisory authority requires one), must not unreasonably disrupt our operations, and are at the Client’s expense. Where a recognized third-party report covering the relevant controls exists, the Client agrees to accept it first before requesting an on-site audit.<\/p>\n

12. Return and deletion<\/h3>\n

When the services end, we will, at the Client’s choice, return Client Personal Data in a standard format or delete it, and delete existing copies \u2014 in line with the export and 30-day migration window described in Section 6 of the Terms of Service \u2014 unless law requires us to keep it, in which case we will keep it isolated, protected, and only as long as the law requires. On request, we will confirm deletion in writing.<\/p>\n

13. Liability and term<\/h3>\n

The liability of each party under this DPA is subject to the limitations of liability in the Terms of Service, except where applicable data protection law does not allow such limitation. This DPA takes effect when the services begin and remains in force as long as we process Client Personal Data, surviving termination of the Terms until all Client Personal Data is returned or deleted.<\/p>\n

Annex 1 \u2014 Details of processing<\/h3>\n