Legal
Data Processing Addendum
In short: when your website handles personal information about your visitors, members or staff, you decide how it is used and we handle it only to host your site, following your instructions. We keep it confidential and secure, use only the providers we list, help you answer people's requests, tell you about breaches, and delete or return it when you leave.
What this addendum covers
This addendum is part of the Terms of Service between you (the client) and Slava Solutions (we). It applies when we handle personal information on your behalf while hosting your website, such as information your visitors submit or your site's content about people.
For this information, you are the controller (under PIPEDA, the organization in control of it) and we are the processor (a service provider acting for you).
Effective date: [effective date]. Last updated: [last updated date].
For this information, you are the controller (under PIPEDA, the organization in control of it) and we are the processor (a service provider acting for you).
Effective date: [effective date]. Last updated: [last updated date].
What we handle
Kinds of people: visitors of your site, and people named or pictured in your site content, such as members, staff, volunteers or clients.
Kinds of information: whatever you choose to put on your site or collect through it, plus technical information from visits (IP address, browser, pages requested).
Purpose: hosting, publishing, storing, backing up and securing your site, for as long as you use Clear CMS.
Kinds of information: whatever you choose to put on your site or collect through it, plus technical information from visits (IP address, browser, pages requested).
Purpose: hosting, publishing, storing, backing up and securing your site, for as long as you use Clear CMS.
Our commitments
We will:
• use the information only to provide the service and on your documented instructions, unless the law requires otherwise (and then tell you, if allowed);
• make sure everyone with access is bound to keep it confidential;
• protect it with appropriate technical and organizational security measures;
• help you respond to people who ask to see, correct or delete their information;
• tell you without undue delay, and within [hours, e.g. 72 hours], after we learn of a breach affecting it;
• help you with privacy assessments and regulator questions where reasonable;
• give you information needed to show we meet this addendum, and allow reasonable audits at your cost with [notice period] notice.
• use the information only to provide the service and on your documented instructions, unless the law requires otherwise (and then tell you, if allowed);
• make sure everyone with access is bound to keep it confidential;
• protect it with appropriate technical and organizational security measures;
• help you respond to people who ask to see, correct or delete their information;
• tell you without undue delay, and within [hours, e.g. 72 hours], after we learn of a breach affecting it;
• help you with privacy assessments and regulator questions where reasonable;
• give you information needed to show we meet this addendum, and allow reasonable audits at your cost with [notice period] notice.
Sub-processors
You agree we may use the providers listed in our Privacy Policy (currently Cloudflare, Clerk, Resend and, for Google sign-in, Google). We will tell you at least [notice period, e.g. 30 days] before adding or replacing one, and you may object. We hold each sub-processor to data protection terms at least as protective as these, and we remain responsible for their work.
Transfers outside Canada
Some sub-processors handle information in the United States or other countries. Where GDPR applies, transfers rely on Standard Contractual Clauses or another lawful mechanism.
Your responsibilities
You are responsible for having a lawful reason to collect and publish personal information on your site, for giving your visitors the notices they need (such as your own privacy policy), and for any consent your site requires.
When the service ends
When your account ends, you can export your site content for [export window, e.g. 30 days]. After that we delete the personal information we hold for you, unless the law requires us to keep it. Backups expire on their normal schedule.
Contact
Questions about this addendum: privacy@clearcms.app. If you need a signed copy for your records, email us.