Data Processing Addendum (DPA) — CTC Takeoffs
This Data Processing Addendum ("DPA") forms part of the Terms of Service between CTC Takeoffs ("Processor," "we") and the customer organization ("Controller," "you") and applies where CTC Takeoffs processes personal data on your behalf, including for customers in the EU, UK, and Switzerland.
1. Definitions and roles
Terms such as "personal data," "processing," "controller," and "processor" have the meanings given in the GDPR / UK GDPR / Swiss FADP as applicable. You are the controller of the personal data contained in your account and project data; we are the processor. For account and billing data we manage for our own purposes (e.g., our billing records), we act as a controller as described in the Privacy Policy.
2. Subject matter and duration
We process personal data only to provide the Service described in the Terms of Service, for the duration of your subscription and any retention period described in the Terms (Section 6).
3. Types of data and data subjects
- Data subjects: your organization's members and, where you include their details in projects, your customers and contacts.
- Types of data: names, email addresses, organization details, project content you upload or create (plans, measurements, customer fields you choose to add), support communications, and usage logs.
4. Processor obligations
We will: (a) process personal data only on your documented instructions (which include your use of the Service) or where required by law; (b) ensure persons authorized to process personal data are bound by confidentiality; (c) implement the technical and organizational measures in Section 6; (d) assist you, taking into account the nature of processing, with data-subject requests and with your obligations regarding security, breach notification, and impact assessments; (e) notify you without undue delay — and in any event within 72 hours of becoming aware — of a personal-data breach affecting your data; (f) at your choice, delete or return your data at the end of the Service, as described in the Terms (self-service export and deletion are available in Settings); and (g) make available information reasonably necessary to demonstrate compliance and allow for audits on reasonable notice, frequency, and scope.
5. Subprocessors
You authorize the following subprocessors, used only to provide their part of the Service:
| Subprocessor | Purpose | Location |
|---|---|---|
| Supabase | Hosting, database, authentication, file storage | United States |
| Stripe | Payment processing and tax calculation | United States / global |
| Resend | Transactional email delivery | United States |
| Cloudflare | Hosting/delivery, DNS | United States / global |
We will give at least 14 days' notice of changes to this list (by email to the super admin and/or in-app notice) and you may object on reasonable data-protection grounds.
6. Security measures (summary)
Encryption in transit (TLS); private, access-controlled storage for plan files; organization-scoped access enforced by row-level security and authenticated accounts; least-privilege access for our personnel; consent-based, time-limited, fully logged support access (Terms of Service, Section 7); regular backups. A detailed measures annex can be provided on request.
7. International transfers
Data is hosted in the United States. Where the GDPR/UK GDPR/Swiss FADP restricts transfers, the European Commission's Standard Contractual Clauses (2021), the UK International Data Transfer Addendum, and the Swiss adaptations apply respectively and are incorporated into this DPA, with CTC Takeoffs as data importer. [Annexes I–III to be completed with counsel before publication.]
8. Precedence
If this DPA conflicts with the Terms of Service regarding personal data, this DPA controls.
Contact: CTC Takeoffs, 931 Washington Blvd #106, Roseville, CA 95678, USA — support@ctctakeoffs.com.