This Data Processing Addendum (“DPA”) forms part of the Terms of Service between Brancodelogic LLC (“Processor”) and the Customer (“Controller”), and applies whenever we process personal data on the Customer's behalf. It is in force automatically — no signature is required — and it prevails over the Terms on any data protection matter. A counter-signed copy is available on request from legal@branfillable.com.
1. Definitions
Data Protection Law means every law applicable to the processing under this DPA, including the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended (CCPA) and comparable United States state privacy laws, and the Florida Information Protection Act. Personal Data, Processing, Controller, Processor, Data Subject and Personal Data Breach carry their meanings in that law. Customer Personal Data means Personal Data we process on the Customer's behalf through the Service.
2. Roles
For Customer Personal Data the Customer is the Controller and Brancodelogic LLC is the Processor — a service provider under the CCPA. Each party complies with the Data Protection Law that applies to it in its own role.
We are the controller of our own account, billing, security and usage data, described in the Privacy Policy; that data is outside this DPA.
The Customer warrants that it has a lawful basis for the processing it instructs, that it has given Data Subjects the notices they are entitled to, and that its instructions do not require us to breach Data Protection Law.
3. Our instructions, and the limits on what we do
We process Customer Personal Data only on the Customer's documented instructions. The Terms, this DPA and the Customer's ordinary use of the Service are those instructions. We will tell the Customer if, in our opinion, an instruction infringes Data Protection Law, and we may pause that processing until it is resolved.
We will not, and we contractually commit that we will not:
- Sell or share Customer Personal Data, as those terms are defined in the CCPA;
- Retain, use or disclose it for any purpose other than performing the Service, or outside the direct business relationship with the Customer;
- Combine it with Personal Data from another source, except as permitted by the CCPA for a service provider;
- Use it to train, fine-tune or evaluate machine learning models, ours or anyone else's.
4. Subject matter, duration, nature and purpose
Subject matter and purpose. Providing the Service: turning a Customer's PDF into a web form, delivering it to a Recipient by a single-use link, collecting the response and an electronic signature, generating the completed document, and where enabled, coordinating file requests into storage the Customer controls.
Duration. For as long as the Customer has an account, plus the deletion window in section 11.
Categories of Data Subject. The Customer's own users (administrators and staff) and the Recipients the Customer sends links to — typically applicants, contractors or employees.
Categories of Personal Data. Determined by the Customer's own document. Typically: identity and contact details; employment and qualification details; government identifiers such as a Social Security or licence number; bank details where a direct-deposit form is used; health information where a medical form is used; signature image and signing evidence (timestamp, IP address, user agent); file-request metadata.
Special categories. Health data may be processed where the Customer's document asks for it. It is held in a separate store with its own access control. The Customer is responsible for the Article 9 GDPR condition, and for ADA confidentiality where US employment law applies.
Not for HIPAA-regulated data
We are not a HIPAA business associate and we do not offer a Business Associate Agreement. The Customer must not use the Service to process protected health information subject to HIPAA. Ordinary employment health forms — a TB result, a fitness-for-duty questionnaire — held by an employer in its employer capacity are generally outside HIPAA, but that determination is the Customer's to make.
5. Confidentiality and personnel
Access to Customer Personal Data is limited to personnel who need it to provide or support the Service. They are bound by written confidentiality obligations that survive the end of their engagement, and their access is logged. Support access to a Customer workspace is read-only, time-limited, requires re-authentication, and is recorded in the audit log of both the Customer and our own administration.
6. Security measures
We implement appropriate technical and organizational measures under Article 32 GDPR. They are set out in Annex II and described in full on the security page. We may change a measure, provided the overall level of security is not reduced.
7. Sub-processors
The Customer gives general written authorization for us to engage sub-processors. The current list, with what each one touches and where it runs, is published at https://branfillable.com/subprocessors and is incorporated here as Annex III.
- We give at least 30 days' notice before adding or replacing a sub-processor, by email to the account administrator and by updating that page.
- The Customer may object on reasonable data-protection grounds within that period. We will work to offer an alternative; where we cannot, the Customer may terminate the affected part of the Service and receive a refund of prepaid, unused fees for it.
- Each sub-processor is bound by written terms that are no less protective than this DPA, and we remain fully liable to the Customer for its performance.
A storage provider the Customer connects itself — its Google Drive, its OneDrive, its own S3 bucket — is not our sub-processor. We act on the Customer's authorization to write into it; the relationship with that provider, and the file content once it arrives, are the Customer's.
8. Assisting with Data Subject requests
The Service gives the Customer the means to access, correct, export and delete the Personal Data it holds. If a Data Subject contacts us directly, we will not respond on the Customer's behalf: we tell them to contact the Customer and, where we can identify the Customer, forward the request without undue delay. Where the Customer cannot fulfil a request with the Service's own tools, we assist by appropriate technical and organizational measures at no charge for a reasonable volume of requests.
9. Personal Data Breach
We notify the Customer without undue delay and in any event within 72 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. Where Florida law applies to us as a third-party agent, notice is given within 10 days under Fla. Stat. §501.171(6) — whichever deadline is stricter governs.
The notice will describe what we know: the nature of the breach, the categories and approximate number of Data Subjects and records, the likely consequences, and the measures taken or proposed. We will supplement it as we learn more, and cooperate with the Customer's own notification duties. Notifying Data Subjects or a supervisory authority is the Customer's decision as Controller; we do not make it for them, and a notification from us is not an admission of fault.
10. Impact assessments
We provide reasonable assistance with a data protection impact assessment or a prior consultation with a supervisory authority under Articles 35 and 36 GDPR, taking into account the information available to us.
11. Return and deletion
On termination, Customer Personal Data stays retrievable for 30 days so the Customer can export it. After that we delete it or irreversibly anonymize it, and instruct our sub-processors to do the same, except where retention is required by law. Backups age out on their ordinary cycle and remain protected by this DPA until they do. A written confirmation of deletion is available on request.
12. Audit
We make available the information needed to demonstrate compliance with Article 28 GDPR. On reasonable written notice, and no more than once in twelve months (or after a Personal Data Breach affecting the Customer), the Customer may request our current security documentation and a completed security questionnaire. An on-site or third-party audit is available where a supervisory authority requires it or Data Protection Law otherwise mandates it, during business hours, without disrupting the Service, subject to confidentiality and to the Customer's reasonable costs.
13. International transfers
Where this DPA covers a transfer of Personal Data out of the EEA, the United Kingdom or Switzerland to a country without an adequacy decision, the parties adopt:
- the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), Module Two (controller to processor) — or Module Three where the Customer is itself a processor — incorporated by reference, with Annex I populated by Annex I below, Annex II by Annex II, docking clause applicable, option 2 for sub-processors with the notice period in section 7, the supervisory authority being that of the Customer's main establishment, and the governing law and forum those of Ireland where the Clauses require a Member State;
- the UK International Data Transfer Addendum (version B1.0), with the tables completed by reference to this DPA;
- for Switzerland, the Clauses as amended by the Swiss Federal Data Protection and Information Commissioner, reading references to the GDPR as references to the Swiss FADP.
Where the Clauses and this DPA conflict, the Clauses prevail.
14. Liability
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service, except where Data Protection Law does not permit that limitation.
Annex I — Parties, processing and competent authority
| Data exporter | The Customer, as identified in its account. Role: Controller (or Processor where it acts for another controller). Contact: the account administrator's email address. Activities: using BranFillable to collect completed and signed documents. |
| Data importer | Brancodelogic LLC, [STREET ADDRESS], [CITY], Florida [ZIP], United States. Role: Processor. Contact: dpo@branfillable.com. |
| Data subjects | The Customer's users; Recipients of the Customer's document links. |
| Categories of data | As set out in section 4. |
| Sensitive data | Health information and government identifiers, where the Customer's document collects them. Restrictions: field-level encryption at rest; health data in a separate store with its own access control; access logged. |
| Frequency | Continuous, for the duration of the Customer's subscription. |
| Nature and purpose | Hosting, storage, transmission, form generation, document generation, electronic signature capture and support. |
| Retention | As set out in section 11 and in the Privacy Policy. |
| Sub-processors | As published at the sub-processor list, for the duration and purpose stated there. |
| Competent supervisory authority | The authority of the data exporter's place of establishment, or of its EU representative where it has one. |
Annex II — Technical and organizational measures
- Encryption in transit — TLS for every connection to the Service and to every sub-processor API.
- Encryption at rest — full-disk encryption at the hosting layer, plus application-level encryption of government identifiers, bank details and all health information, with keys held outside the database.
- Tenant isolation — every tenant-aware model is filtered by a global query scope and by middleware on every request; a request that names another tenant's record is refused on the server, not hidden in the interface.
- Access control — one administrator per organization enforced by a database constraint; staff see only the records they created; privileged administration is a separate role with its own route group; support access to a workspace is read-only and cannot write.
- Authentication — passwords hashed with bcrypt, minimum length enforced, sessions invalidated on removal of a user, rate limiting on authentication and on sensitive endpoints.
- Link security — recipient links are cryptographically signed, single-use and expire in 24 hours, enforced on the server; expired, used, revoked and unknown links are indistinguishable to a caller.
- Logging and accountability — an append-only audit log of privileged actions with actor, time and IP; logs carry identifiers, never file contents or signed URLs.
- Segregation — production data is never copied into development or test environments; the test suite runs against its own schema.
- Secure development — a security review of every change before release, dependency pinning through lockfiles, immutable production images, and no code edited on a production server.
- Resilience — automated database backups, storage on a persistent volume separate from the application image, and documented restore steps.
- Deletion — deletion on instruction, and on retention schedules the Customer configures, with a receipt written for each deletion carried out.
Annex III — Authorized sub-processors
The current list is published at https://branfillable.com/subprocessors and forms part of this DPA. It names each sub-processor, the processing it performs, the data it can reach and the country it operates from.