This Data Processing Addendum (“DPA”) is between the organization that holds a Certifiable account (“Customer”) and Certifiable, LLC, South Charleston, West Virginia (“Provider”). It forms part of the Terms of Service (the “Agreement”). It applies to personal data Customer uploads or collects through the product that Provider processes on Customer’s behalf — mainly roster names, emails, event details, and certificate records.
This DPA is written for U.S. state privacy laws (including CCPA/CPRA and similar statutes). It does not cover GDPR. If you need EU terms, write hello@becertifiable.io.
Roles
Customer is the business / controller of Customer Data. Provider is the service provider / processor. Provider processes Customer Data only to provide Certifiable (issue and deliver certificates, lookup, sharing, email delivery status, and related support) and as the Agreement otherwise allows.
Account-holder name, login, and billing information are not Customer Data under this DPA. Those are described in the Privacy Policy.
Customer instructions
By using the product, Customer instructs Provider to process Customer Data as needed to run the features Customer turns on: storing the roster, generating PDFs, emailing retrieval links, lookup codes, share links, and showing the organization its own records. Customer is responsible for the lawfulness of that roster, including having a basis to email attendees.
Restricted data
Customer will not upload protected health information, Social Security numbers, payment card numbers, or other sensitive categories we do not need to print a certificate, unless both parties agree in writing. Certifiable is not a HIPAA business associate unless a separate BAA is signed.
Security
Provider will use technical and organizational measures appropriate to the nature of this data, including:
- hashed organization passwords and optional extra verification at sign-in
- lookup and share gated by short-lived codes, not a public name search
- HTTPS for the hosted product
- role-based access inside an organization account
- logged staff access when we help with a real support problem
- confidentiality obligations for people who can see Customer Data
Customer is responsible for its logins, who it invites, and what it uploads. More about lookup and sharing is on certificate security.
Incidents
If Provider becomes aware of a breach of its security that results in accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer Data in its possession, Provider will notify Customer without undue delay, with facts then known and steps taken. Unsuccessful attacks (failed logins, port scans) are not incidents. Customer is responsible for notices it must send to people or regulators. If a Customer notice names Provider, Customer will give us a chance to comment first where the law allows.
Help with individual requests
People on a roster should start with Customer. If someone writes Provider instead, we will point them to Customer and notify Customer unless the law forbids it. Provider will give reasonable technical help so Customer can access, correct, or delete Customer Data in the product. Extra work beyond ordinary support may be billed at then-current rates, with an estimate on request.
Subprocessors
Customer authorizes Provider to use the subprocessors below to process Customer Data. Provider will impose confidentiality and data-protection terms on them no less protective than this DPA for the work they do. If we add a subprocessor that processes Customer Data, we will update this page. Customer may object on reasonable privacy grounds by writing us; if we cannot accommodate the objection, Customer may stop using the product.
| Subprocessor | Where | What they do |
|---|---|---|
| Mailgun (Sinch) | United States | Sends certificate, lookup, share, and related email; delivery events |
| Stripe, Inc. | United States | Subscription billing for the organization account |
| Cloudflare, Inc. | United States | Bot checks on public login and signup forms |
| Hosting / infrastructure vendors we use to run becertifiable.io | United States | Store and serve the application and its database |
Google Analytics and Tawk.to run on public marketing pages. They are not used to process Customer’s roster. See the Cookie Notice.
U.S. state privacy terms
Provider is a service provider / processor / contractor under applicable U.S. state privacy laws. Provider will not sell or share Customer Data; will not retain, use, or disclose it except to provide the service or as those laws allow; and will not combine it with other personal information except as needed to provide the service and as those laws allow. Customer may take reasonable steps to confirm we meet these terms, including the audit process below. Provider will tell Customer if it determines it can no longer meet its obligations under those laws.
Return and deletion
Customer can delete certificates and attendee rows in the admin while the account is open. After the Agreement ends, Provider will delete or return Customer Data on request, except copies kept as required by law or in routine backups that are then deleted on the backup cycle.
Audits
Once per year, on reasonable notice, Customer may request information reasonably needed to confirm Provider’s compliance with this DPA. Provider may satisfy that request with available security descriptions and this DPA rather than on-site inspection, unless a regulator or applicable law requires more.
Duration
This DPA lasts as long as Provider processes Customer Data, including after the subscription ends until deletion is complete.
Contact
Certifiable, LLC
South Charleston, West Virginia
hello@becertifiable.io