DuesDesk

Data Processing Addendum

Effective November 10, 2026

This Data Processing Addendum ("DPA") forms part of the agreement between ProjectHax LLC ("Processor", "we") and the homeowners association, club or other organisation that uses DuesDesk ("Controller", "the Group").

1. Subject matter and duration

We process Personal Data on the Group's behalf to provide DuesDesk (dues tracking, reminders, statements, member portal, document storage, payment reconciliation) for as long as the Group uses the service plus the return/deletion period in section 9.

2. Nature and purpose

Storage, organisation, retrieval, transmission by email, generation of statements and reports, reconciliation with payment events received from the Group's own Stripe account, backup and deletion.

3. Categories of data subjects and data

  • Data subjects: the Group's members, homeowners, residents, tenants, board members, treasurers and other contacts.
  • Personal Data: names, email addresses, phone numbers, property and mailing addresses, unit/membership identifiers, dues and payment history, balances, notes, documents and messages the Group uploads or sends.
  • The Group must not upload special-category data (health, religion, etc.), government identifiers, or full payment-card or bank numbers.

4. Controller instructions

We process Personal Data only on the Group's documented instructions, which are the agreement, this DPA, and the Group's configuration and use of the service. We will inform the Group if we believe an instruction violates applicable data protection law.

5. Confidentiality

Persons authorised to process Personal Data are bound by confidentiality. Our support staff and automated operators access Group data only when a Group admin grants time-limited support access, or when required to maintain security or comply with law; all such access is logged and visible to the Group's admins.

6. Security

We implement the measures in Annex 1, which may be updated provided the overall level of protection is not reduced.

7. Sub-processors

The Group authorises the sub-processors listed at /subprocessors (DigitalOcean for hosting, Cloudflare for network security, file storage and encrypted backups, Resend for email delivery). We will give at least 30 days' notice of new sub-processors by email to Group admins; the Group may object on reasonable data-protection grounds and, if we cannot accommodate the objection, terminate and receive a pro-rata refund of prepaid fees. Stripe processes payments under the Group's own agreement with Stripe and is not our sub-processor for those payments.

8. Assistance

Taking into account the nature of processing, we assist the Group with data subject requests (export and deletion tools are built in), security, breach notification and data protection impact assessments, using the self-service tools where possible. We forward data subject requests we receive about Group data to the Group without undue delay and do not respond to them ourselves except as the Group instructs.

9. Return and deletion

The Group may export all its data (CSV and documents) at any time, including for 90 days after the subscription ends. On the Group's deletion request, or at the end of that period, we delete Group data from live systems after a 30-day undo window; encrypted backups expire within 12 months and are not restored except for disaster recovery, after which deletions are re-applied.

10. Personal Data Breach

We notify the Group's admins without undue delay, and in any case within 72 hours after becoming aware of a Personal Data Breach affecting the Group's data, with the information reasonably available (nature, categories and approximate number of records, likely consequences, measures taken). The Group remains responsible for any notifications to its members or authorities.

11. Audits

We make available information necessary to demonstrate compliance with this DPA, including this document, our security summary and the Group's own audit log. On-site audits are limited to once per year, on 30 days' notice, at the Group's cost, and subject to confidentiality.

12. International transfers

Data is hosted in the United States. Where the Group is subject to the GDPR or UK GDPR, the parties agree to the EU Standard Contractual Clauses (Module 2, controller to processor) and the UK Addendum, incorporated by reference.

13. US state privacy laws

To the extent the CCPA/CPRA or similar laws apply, we act as a "service provider"/"processor": we do not sell or share Personal Data, do not retain, use or disclose it outside the direct business relationship, and do not combine it with other data except as permitted.

14. Liability and precedence

Liability is governed by the agreement. The service is provided "as is", without warranty of any kind, and to the fullest extent the law allows we are not liable for any loss or damage arising from it, as set out in sections 11 and 12 of the Terms of Service; nothing in this DPA adds to our liability. This does not limit what data protection law gives a person directly and does not allow to be waived. If this DPA conflicts with the agreement on data protection, this DPA prevails.

Annex 1: Technical and organisational measures

  • Encryption in transit (TLS 1.2+, HSTS); encrypted backups (age, private key held off-server); provider disk encryption at rest; field-level encryption for authentication secrets.
  • Logical isolation per Group (database row-level security plus application checks, tested on every release).
  • Access control: least-privilege database roles; two-factor authentication required for Group treasurers/admins; key-only SSH; time-limited, logged support access.
  • Append-only audit log of security-relevant and financial actions, visible to Group admins.
  • Nightly encrypted backups stored off the server, regular restore tests, 30 daily and 12 monthly copies kept.
  • Patch management (automatic security updates, weekly dependency review), firewalling, brute-force protection.
  • Incident response procedure with 72-hour Group notification.
  • No payment card or bank account numbers stored; payments run on the Group's own Stripe account.

Also see: Terms · Privacy · Data Processing Addendum · Subprocessors · Acceptable use