1. Parties and scope
The customer is the controller or processor that determines the instructions for Customer Data. AppWrapp, LLC, with its registered office at 651 N Broad St, Suite 201, Middletown, DE 19709, United States, is the processor or subprocessor. This DPA applies for as long as AppWrapp processes Customer Data to provide Fielduro.
2. Processing details
The processing supports account authentication, customer and service libraries, document creation and sharing, payment records, optional proof storage, email delivery, support, security, and deletion. Data subjects may include the customer’s staff, clients, prospects, and document recipients. Data may include identity, contact, address, transaction, service, document, and support data selected by the customer. Customers must not submit prohibited or unnecessary sensitive data.
3. Instructions and responsibilities
AppWrapp will process Customer Data only on documented instructions in the Terms, product configuration, and lawful support requests, unless law requires otherwise. The customer is responsible for lawful instructions, notices, permissions, data accuracy, and responding to its data subjects.
4. Confidentiality and security
AppWrapp requires people authorized to process Customer Data to protect its confidentiality. AppWrapp maintains proportionate technical and organizational measures, including access controls, encrypted transport, vendor-managed encryption at rest, row-level database ownership policies, private file storage, signed webhook verification, expiring customer links, secret management, monitoring, and tested deletion workflows.
5. Subprocessors
The customer gives general authorization for the subprocessors listed at fielduro.com/legal/subprocessors. AppWrapp will provide reasonable notice of a material new subprocessor. A customer may object on reasonable data-protection grounds, and the parties will work in good faith on an alternative. If no reasonable alternative exists, the customer may stop the affected processing.
6. Assistance
Considering the nature of the processing and information available, AppWrapp will reasonably assist with data-subject requests, security obligations, breach notifications, data-protection impact assessments, and regulator consultations. Additional work outside normal product capabilities may be charged at a reasonable rate after agreement.
7. Security incidents
AppWrapp will notify the customer without undue delay after confirming a personal-data breach affecting Customer Data and will provide available information needed for the customer’s legal obligations. Notification is not an admission of fault or liability.
8. International transfers
When restricted transfers require safeguards, the 2021 European Commission Standard Contractual Clauses apply using the module appropriate to the parties’ roles, together with the UK Addendum where relevant. This DPA and the service documentation supply the annex information. Vendor transfer safeguards apply for onward processing.
9. Return and deletion
During the account term, the customer may export supported data. On verified account deletion, AppWrapp removes Customer Data from active systems, except data retained temporarily in protected backups or as required for security, billing, tax, dispute, or legal obligations. Retained data remains protected and is not used for another purpose.
10. Audit information
AppWrapp will provide information reasonably necessary to demonstrate compliance. Audits must be proportionate, confidential, scheduled with reasonable notice, avoid disrupting the service, and first use available documentation. On-site audits are limited to cases where documentation cannot reasonably address a material concern or law requires them.
11. Priority and liability
If this DPA conflicts with the Terms on personal-data processing, this DPA controls. Liability under this DPA follows the liability provisions in the Terms unless applicable data-protection law requires otherwise.
Questions
Contact legal@fielduro.com.