Data processing agreement

This DPA is between the CostPerJob customer (“you”) and Media Yard LLC (“we”, the processor), a United States limited liability company that operates CostPerJob. New Jersey is our place of establishment. Postal address: Media Yard LLC, PO Box 73, Pennsauken, NJ 08110. It is incorporated into the Terms when you use the shop OS. You do not need a wet signature for it to apply. For a countersigned copy, email hello@costperjob.com from the work email that owns the account. The legal hub lists every policy we publish.

It is meant to satisfy Article 28 UK GDPR, Article 28 EU GDPR, and, where California law applies to that processing, CCPA/CPRA service-provider terms.

Roles

If you determine the purposes and means of the processing of job records, you are the controller and Media Yard LLC is the processor.

If you process that data on behalf of another controller, you are the processor and we are the sub-processor. Module Three of the 2021 EU SCCs applies instead of Module Two.

For your work email, workspace membership, and Stripe billing identifiers (Pro only; Stripe is not used on Free), Media Yard LLC is the controller. That pile is described in Privacy, not here.

Subject matter

Running the CostPerJob shop OS. Duration: the life of the workspace. Nature: recording, storing, displaying, exporting CSV. Purpose: so you can see which jobs made money. Types of data: pricebook items, estimates, materials, hours, scorecard totals, and job names you choose. Data subjects: whoever those job names refer to, which should not be a customer’s unnecessary personal data.

Instructions

You instruct us to process processor data only to run the money loop, keep the workspace, and export CSV when you ask. We will not process it for another purpose unless UK or EU law requires it. If an instruction would make us break the law, we will say so in writing.

Confidentiality and security

Technical and organisational measures: TLS in transit; access to processor data limited to people who run CostPerJob, under confidentiality; backups age out. We review these measures at least annually. We do not claim SOC 2 or HIPAA.

We will notify you without undue delay, and in any event within 48 hours of becoming aware, of a personal-data breach affecting processor data.

Subprocessors of processor data

Annex 3 is the list. The public copy is in Privacy. Before a new subprocessor begins processing processor data we will update Annex 3 and Privacy and email the account owner at least 30 days in advance. You may object by writing hello@costperjob.com within that window. If we cannot accommodate the objection, you may close the workspace.

Stripe and Resend process account data for which we are the controller. They are not subprocessors of job records unless we say so here later.

International transfers

Processor data is hosted in the United States. The Standard Contractual Clauses in Commission Implementing Decision (EU) 2021/914 are incorporated:

• Module Two where you are the controller; Module Three where you are a processor
• Clause 7 docking: off
• Clause 9 Option 2, 30 days
• Clause 11 optional body: off
• Clauses 17 and 18: Ireland
• Annex I.A / I.B / I.C = Annex 1; Annex II = Annex 2; Annex III = Annex 3

United Kingdom: Part 2 Mandatory Clauses of the Approved Addendum B.1.0 issued by the ICO. Switzerland: references to the GDPR are read as references to the Swiss FADP. We are not certified under the UK–US Data Bridge or the EU–US Data Privacy Framework.

Assistance, deletion, audits

At the end of the service, at your choice we will delete processor data or return it (CSV export) and delete remaining copies. Close account stops processing. We answer rights emails from the work email that owns the account within one month where UK or EU GDPR requires it.

On written request no more than once in twelve months, we make available the information reasonably necessary to demonstrate Article 28. Where that is not enough, you may audit, or appoint an independent auditor who is not our competitor, on thirty days’ notice, during business hours, at your cost unless the audit finds material non-compliance.

CCPA

Where the CCPA/CPRA applies to processor data, Media Yard LLC is a service provider / contractor. We will not sell it, share it for cross-context advertising, or use it outside the direct business relationship.

Liability and law

Liability follows the Terms, except where UK GDPR Article 82, EU GDPR Article 82, the Clauses, or a similar rule requires a different split. New Jersey law and New Jersey venue for the contract, without limiting those mandatory rules or the Ireland forum in the Clauses.

Annex 1 — SCC Annex I

Annex 2 — TOMs

TLS in transit. Access limited to people who run CostPerJob, under confidentiality, with MFA. Backups age out. We review these measures at least annually.

Annex 3 — Subprocessors of processor data