The short version. When you keep information about your clients in Perchway, it's your data, and Perchway handles it for you. We only use it to provide Perchway, keep it secure and confidential, use only the providers listed on our Subprocessors page, tell you about breaches, help you answer your clients' requests, and delete it when you're done. This addendum makes those promises binding, including the clauses European and UK law ask for.
This Data Processing Addendum ("DPA") is part of the Terms of Service between Perchway and each Freelancer, and applies automatically whenever Perchway processes Client Personal Data for a Freelancer. You don't need to sign anything. If you need a signed copy for your records, email [email protected].
1. Definitions
- Data Protection Laws means the privacy and data protection laws that apply to the processing, which may include the EU General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and US state privacy laws such as the California Consumer Privacy Act as amended ("CCPA").
- Client Personal Data means personal data that a Freelancer, or the Freelancer's Clients, put into the Service as part of the Freelancer's account, such as client records, messages, files, proposals, contracts and invoices, and that Perchway processes on the Freelancer's behalf.
- Controller, processor, data subject, personal data, processing and personal data breach have the meanings the GDPR gives them. "Business", "service provider", "sell" and "share" have the meanings the CCPA gives them.
- Subprocessor means a third party Perchway engages to process Client Personal Data.
- Other capitalized words mean what the Terms say they mean. "You" means the Freelancer.
2. Roles
You're the controller (or "business") of Client Personal Data, and Perchway is your processor (or "service provider"). If you're yourself a processor for someone else, Perchway is your subprocessor, and you confirm that your controller has authorized your instructions. This DPA doesn't cover personal data Perchway processes as a controller for its own purposes, such as your own account details, or the records Perchway keeps of purchases made through Perchway to run checkout and delivery, collect its fee, prevent fraud and meet legal obligations. The Privacy Policy covers those.
3. Your responsibilities
You're responsible for having a lawful basis for collecting Client Personal Data and putting it into Perchway, for giving your Clients any notices the law requires, and for the accuracy of the data and the lawfulness of your instructions.
4. How Perchway processes Client Personal Data
- Only on your instructions. We process Client Personal Data only to provide the Service under the Terms, as you direct through your use of the Service, and on any other reasonable written instructions you give us that are consistent with the Terms. If we believe an instruction breaks Data Protection Laws, we'll tell you. If the law requires us to process Client Personal Data in another way, we'll tell you first, unless the law forbids it.
- No selling, no other uses. We won't sell or share Client Personal Data, as the CCPA uses those words. We won't keep, use or disclose it for any purpose other than providing the Service, including any commercial purpose of our own, or outside our direct business relationship with you. We won't combine it with personal data we get from others, except as the CCPA allows for providing the Service. We won't use it to train AI models. We'll tell you if we can no longer meet our obligations under the CCPA, and you may take reasonable steps to stop and fix unauthorized use.
- Security checks. Keeping the Service secure, and free of fraud, spam and abuse, is part of providing it. We may use automated checks for that on Client Personal Data, as on the rest of the Service, and some of them use AI. Any AI provider we use for them is a subprocessor, and we don't let it train its models on Client Personal Data.
- Confidentiality. Everyone at Perchway who can access Client Personal Data is bound by confidentiality obligations.
- Details. The Annex at the end of this DPA describes the processing.
5. Security
We maintain technical and organizational measures designed to protect Client Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. They're described in the Annex. We may update them, as long as the update doesn't lower the overall level of protection.
6. Subprocessors
- You authorize Perchway to use the subprocessors listed on our Subprocessors page.
- Before adding or replacing a subprocessor that processes Client Personal Data, we'll update that page and give you at least 30 days' notice by email or in the Service, unless an emergency makes that impossible.
- If you have a reasonable data protection objection to a new subprocessor, tell us at [email protected] within that notice period. We'll try to find a solution. If we can't, you may close your account and get a refund of any subscription fees prepaid for the period after the change.
- We bind each subprocessor to data protection obligations at least as protective as this DPA, and we're responsible for their compliance.
7. Helping you
- Clients' requests. If a data subject asks Perchway about Client Personal Data, we'll pass the request to you and won't answer it ourselves, unless you tell us to or the law requires us to. The Service lets you find, export, correct and delete Client Personal Data. If you need more help responding, we'll provide reasonable help.
- Assessments. We'll give you reasonable help with data protection impact assessments and consultations with authorities, as far as they concern our processing.
8. Personal data breaches
If we become aware of a personal data breach affecting Client Personal Data, we'll tell you without undue delay, and give you the information you reasonably need to meet your own obligations, as it becomes available. We'll take reasonable steps to contain and investigate the breach and limit its effects. Telling you about a breach isn't an admission of fault.
9. Deleting or returning data
You can export and delete Client Personal Data in the Service at any time. When your account closes, we delete Client Personal Data as the Privacy Policy describes (within 30 days, and from backups within 90 days after that), unless the law requires us to keep it.
10. Audits
We'll make available the information you reasonably need to show that we comply with this DPA, such as written answers to reasonable security questionnaires, up to once a year, or after a personal data breach. If Data Protection Laws require more, including an audit, it will happen at your expense, with reasonable notice, during business hours, without disrupting our operations, under confidentiality obligations, and at most once a year.
11. International transfers
Perchway processes Client Personal Data in the United States. When the transfer of Client Personal Data to Perchway is restricted by Data Protection Laws:
- From the EEA: the Standard Contractual Clauses approved by the European Commission in Decision 2021/914 ("SCCs") apply and are incorporated into this DPA by reference. Module Two (controller to processor) applies where you're a controller, and Module Three (processor to processor) where you're a processor. The optional docking clause (Clause 7) doesn't apply. Under Clause 9, option 2 (general written authorization) applies, with the notice period in section 6 of this DPA. The optional wording in Clause 11 doesn't apply. Under Clauses 17 and 18, the SCCs are governed by Irish law, and disputes go to the courts of Ireland. Annex I of the SCCs is completed by the Annex to this DPA, Annex II by its security section, and Annex III by our Subprocessors page.
- From the UK: the International Data Transfer Addendum to the SCCs, issued by the UK Information Commissioner, applies and is incorporated by reference. Its tables are completed with the information in this DPA, and either party may end it as its section 19 allows.
- From Switzerland: the SCCs apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR include the Swiss Federal Act on Data Protection, the competent supervisory authority is that Commissioner, and "member state" includes Switzerland, so Swiss data subjects can bring claims where they live.
If the SCCs conflict with this DPA, the SCCs win.
12. Liability and order of documents
Each party's liability under this DPA is subject to the limits in the Terms, except where Data Protection Laws or the SCCs don't allow those limits. If this DPA conflicts with the Terms, this DPA wins on data protection.
Annex: details of the processing
Parties. Data exporter: the Freelancer (controller, or processor for its own controller). Data importer: Perchway LLC (processor), 2800 E. Enterprise Ave, STE 333, Appleton, WI 54913, USA, [email protected].
Subject matter and duration. Providing the Service to the Freelancer, for as long as the Freelancer's account is open and until Client Personal Data is deleted as section 9 describes.
Nature and purpose. Hosting, storing, transmitting, displaying and otherwise processing Client Personal Data so the Freelancer can manage Clients, send proposals, contracts and invoices, take payments through Stripe or PayPal, exchange messages and deliver files.
Data subjects. The Freelancer's Clients and prospective Clients, their staff and contacts, and people who appear in Content.
Categories of personal data. Names, email addresses, phone numbers, business details, postal addresses, messages and their attachments, files and the information in them, proposals, contracts and electronic signature records (name, email address, time, IP address, browser), invoices and payment status, and portal activity.
Special categories. None are intended. Freelancers shouldn't put special category data into Perchway unless they need to and have a lawful basis.
Frequency. Continuous, while the Service is used.
Security measures.
- Encryption in transit for all connections (HTTPS, TLS 1.2 or newer).
- Files stored in private, access-controlled storage that's encrypted at rest, and downloaded through short-lived signed links.
- Payment card and bank details are handled by Stripe and PayPal, both certified to PCI DSS Level 1, and never stored by Perchway.
- Sign-in without passwords, using one-time codes that expire quickly and can only be used once, rate limits, bot protection and passkeys. Sensitive changes, such as payout or email changes, need a fresh sign-in.
- Automated checks for fraud, spam and abuse, some of which use AI or machine learning. A person on our team decides whether to suspend or close an account.
- Staff access limited to what each person needs, protected with two-step verification, and logged.
- Production systems separated from development and preview environments, which use their own databases.
- Regular backups, and deletion schedules as section 9 describes.
- Dependencies kept up to date, and changes reviewed and automatically tested before they're released.
- A process for investigating incidents and notifying affected Freelancers.
Subprocessors. See our Subprocessors page.