Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the agreement between the customer identified in the applicable Blogged account, checkout record, invoice, or order form (“Customer”) and BoostYard LLC, the Delaware limited liability company that owns and operates Blogged (“Blogged”). It applies when Blogged processes Customer Personal Data to provide the service. It becomes effective when Customer accepts the Terms of Service, purchases or uses the service, or signs an order form that incorporates it.

“Customer Personal Data” means personal data, personal information, or equivalent regulated information contained in Customer Content that Blogged processes on Customer's behalf. “Data Protection Law” means privacy and data-protection law applicable to that processing, including the GDPR, UK GDPR and Data Protection Act 2018, and applicable US state comprehensive privacy laws. Other defined terms have the meanings in the Terms of Service or applicable Data Protection Law.

Customer is the controller or business and Blogged is the processor or service provider for Customer Personal Data. If Customer is itself a processor, Blogged acts as Customer's subprocessor. Customer instructs Blogged to process Customer Personal Data to provide, secure, support, and improve the contracted service for Customer; follow settings, user actions, configurations, support requests, and order forms; use approved subprocessors; and comply with law.

Blogged will process Customer Personal Data only on documented instructions unless law requires otherwise. If legally permitted, Blogged will tell Customer before processing required by law. Blogged will promptly inform Customer if an instruction appears to violate applicable Data Protection Law and may pause the affected processing while the parties resolve it.

• Comply with Data Protection Law and give lawful, fair, and transparent instructions.
• Provide required notices and obtain any consent or other lawful basis for Customer Personal Data, including reader, lead, subscriber, tracking, webhook, and uploaded-source data.
• Use appropriate workspace roles, publication settings, consent controls, and security features.
• Respond to data-subject requests and regulatory inquiries as controller, with Blogged's assistance under this DPA.
• Do not submit special-category, sensitive, criminal-offense, children's, payment-card, health, biometric, or government-identifier data unless the service expressly supports it and the parties agree appropriate safeguards in writing.
• Assess whether autonomous publication, AI processing, international transfers, and customer-selected integrations are appropriate for Customer's use case.

Blogged will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations and receive access only as needed for their responsibilities. Blogged will provide appropriate privacy and security direction to personnel with such access.

Considering the state of the art, implementation cost, processing scope and risk, Blogged will maintain technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Blogged may update measures as technology and risk evolve, provided the overall protection of Customer Personal Data is not materially reduced during the service term.

Customer gives general written authorization for Blogged to use the subprocessors on the current Subprocessor List. Blogged will require each subprocessor that processes Customer Personal Data to protect it under written terms materially consistent with the relevant obligations in this DPA. Blogged remains responsible for its subprocessors to the extent required by applicable Data Protection Law.

Blogged will post a new or replacement subprocessor on the Subprocessor List before authorizing it to process Customer Personal Data when reasonably practicable. Customer may object within 15 days after the posted effective date on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative. If none is available, Customer may stop using the affected feature or terminate the affected service without penalty other than fees accrued before termination.

Customer-selected analytics, pixels, custom code, lead webhooks, and other integrations are Customer's recipients and not Blogged subprocessors merely because Blogged enables the connection. Customer is responsible for diligence and agreements with those recipients.

Taking into account the nature of processing and information available, Blogged will provide reasonable assistance for Customer to respond to data-subject requests and meet obligations concerning security, breach notification, data-protection impact assessments, and regulator consultations. If a data subject contacts Blogged about Customer Personal Data, Blogged will direct the request to Customer unless law requires Blogged to respond directly.

Customer may request assistance at hi@blogged.dev. If a request requires unusual engineering, extensive retrieval, or third-party costs beyond the standard service, Blogged may charge reasonable fees after giving an estimate, unless Data Protection Law prohibits the charge.

Blogged will notify Customer without undue delay after becoming aware of a confirmed breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data processed by Blogged (“Personal Data Incident”). Notification does not admit fault or liability.

As information becomes available, Blogged will describe the nature of the incident, affected data and people where reasonably identifiable, likely consequences, measures taken or proposed, and a contact for follow-up. Blogged will take reasonable steps to contain, investigate, mitigate, and remediate the incident and will reasonably assist Customer's legally required notices. Customer controls notices to its data subjects and regulators unless law requires Blogged to notify directly.

Unsuccessful attempts, routine blocked activity, service interruptions without compromise, and incidents caused solely by Customer or a customer-selected integration are not Personal Data Incidents under this DPA, although Blogged may still share useful security information.

During the service term, Customer can access, export, unpublish, unsubscribe, disconnect, archive, or delete supported records through product controls. On termination or written request, Blogged will delete or return Customer Personal Data within a reasonable period, at Customer's choice and subject to product capabilities, unless law requires retention.

Deletion does not require immediate removal from encrypted backups, immutable security records, billing and tax records, legal holds, or logs that cannot reasonably isolate one customer's data. Remaining copies will stay protected, will not be used for another purpose, and will be deleted or rendered inaccessible under normal retention cycles. Project archive is reversible and does not count as a deletion instruction.

Blogged will make information reasonably necessary to demonstrate compliance with this DPA available on request, including this DPA, security-measure summaries, subprocessor information, and relevant independent provider reports available to Blogged. Customer may conduct one audit per 12-month period, and additional audits after a material Personal Data Incident or when a regulator requires one.

Audits should first use documents and remote interviews. Any on-site inspection requires reasonable advance notice, must occur during business hours, cannot expose another customer's data or compromise security, and must be performed by an independent auditor bound by confidentiality. Customer pays its audit costs. Blogged may charge reasonable costs for unusually burdensome assistance unless a material Blogged breach is found or law prohibits the charge.

Blogged may process Customer Personal Data in the United States and other locations shown on the Subprocessor List. Where a transfer from the EEA, Switzerland, or United Kingdom requires safeguards and no adequacy decision applies, the parties incorporate the applicable European Commission Standard Contractual Clauses approved by Decision 2021/914, using Module Two when Customer is a controller and Module Three when Customer is a processor. The UK International Data Transfer Addendum applies to restricted UK transfers, and Swiss law adaptations apply to restricted Swiss transfers.

For the SCCs, docking is optional; Option 2 general authorization applies with the notice period in Section 6; optional independent dispute resolution language does not apply; and the law and supervisory authority are determined by the SCCs based on Customer's establishment or representative. Annex details are in Section 13. If a later lawful transfer mechanism replaces these clauses, the mechanism that provides valid protection applies.

For Customer Personal Data subject to the CCPA or another US state comprehensive privacy law, Blogged acts as a service provider or processor. Blogged will not sell or share Customer Personal Data, retain, use, or disclose it outside the direct business relationship or permitted business purposes, combine it with personal information from another source except as law permits, or use it for targeted advertising. Blogged will provide the same level of privacy protection required by applicable law and notify Customer if it can no longer do so.

Customer may take reasonable steps to stop and remediate unauthorized use and may monitor compliance through Section 10. Blogged certifies that it understands and will comply with the restrictions in this Section. The parties will apply equivalent controller-processor terms required by Colorado, Connecticut, Virginia, Utah, and other applicable state laws.

If terms conflict, the SCCs control for a restricted transfer, then this DPA, then the order form, then the Terms of Service. Liability under this DPA is subject to the agreement's liability terms except where Data Protection Law prohibits that limitation.

Blogged may update this DPA to reflect law, regulatory guidance, or service changes, but will not materially reduce protection of Customer Personal Data during an active term without notice. Questions, objections, audit requests, and data-protection notices should be sent to hi@blogged.dev or to BoostYard LLC, Attn: Privacy, 16192 Coastal Highway, Lewes, DE 19958, United States.