Data Processing Addendum

This addendum forms part of the agreement between an association (the “controller”) and [Hallkin legal entity name] (Hallkin, the “processor”). It covers the personal information Hallkin processes for the association.

1. Scope and instructions

Hallkin processes association personal information (members' and owners' names, contact details, homes, applications, requests, messages and related records) only to provide Hallkin to the association, as the association directs through its use of the service and in writing. Hallkin tells the association if it believes an instruction breaks the law.

2. Confidentiality and staff

Hallkin staff have no access to association records through the service; the database itself prevents it. Staff who operate the underlying systems are bound by confidentiality obligations. Any future support access will need the association's approval each time and will be logged.

3. Security

• Encryption in transit (HTTPS with HSTS) and at rest (by the database host).
• Each association's data separated by database row-level security, tested for every table.
• Two-step sign-in for privileged roles; recovery and resets are logged.
• An append-only audit log of significant actions and approvals.
• Uploads rebuilt to remove active content before use; rate limits and spending caps on paid and public features.
• Error reports and analytics scrubbed of personal details before they leave Hallkin.

4. Subprocessors

The association authorizes the subprocessors listed on Subprocessors. Hallkin binds each to data protection terms at least as protective as these, gives notice of new subprocessors before they receive association data, and remains responsible for them.

5. Location

Association data is stored in the United States.

6. Security incidents

Hallkin notifies the association without undue delay, and within 72 hours, after confirming a breach affecting its personal information, with what's known and what is being done, and helps the association meet any notice duties it has (including under Florida law).

7. Helping the association

Hallkin helps the association answer people's requests to see, correct or delete their information, and provides information the association reasonably needs to show it's meeting its obligations.

8. End of service

When the agreement ends, Hallkin provides an export on request and then deletes the association's personal information within [60] days, except where the law requires keeping it. Backups expire on their normal schedule. [Period to be confirmed by counsel.]

9. Audits

On request, once a year, Hallkin answers reasonable security questionnaires and shares summaries of its security measures and its subprocessors' security reports.