Data Processing Agreement

Version 1.0 · Effective April 1, 2026

Abec Enterprises USA, d/b/a ChamberBuilder - Redding, CA, USA.

Parties

This Data Processing Agreement (the "DPA") is entered into between:

Controller: the organization that has subscribed to the Service ("Customer").
Processor: ChamberBuilder ("Processor", "we", "us").

This DPA forms part of the Terms of Service at /terms between the parties. In the event of a conflict, this DPA controls for matters relating to the processing of personal data.

Scope and duration

This DPA covers personal data that Customer submits to, or that Processor processes on behalf of Customer through, the Service. It takes effect on the date Customer accepts the Terms of Service and continues for as long as Processor processes Customer personal data.

Categories of data subjects

Customer staff and administrators.
Customer members (primary business contacts and their staff).
Event attendees and registrants.
Newsletter, campaign, and SMS subscribers.
Applicants who submit a join or inquiry form through the Customer's public website.

Categories of personal data

Identity and contact data: name, email, phone, postal address.
Business data: company name, role, industry, category tags.
Financial data: billing contact, invoice history; card numbers are handled directly by Stripe and never stored by Processor.
Communications data: email and SMS content, delivery status, open and click events.
Custom fields configured by the Customer.
Usage data: pages visited, timestamps, IP addresses for security and audit.

Processor obligations

Processor will:

Process Customer personal data only on documented instructions from Customer. Use of the Service itself constitutes an instruction; additional written instructions can be submitted through support channels.
Ensure that personnel authorized to process Customer personal data are subject to confidentiality obligations.
Implement and maintain the security measures described below.
Engage sub-processors only under the terms of the Sub-processors section of this DPA.
Assist Customer, taking into account the nature of processing, in responding to data subject requests and fulfilling Customer's own compliance obligations.
Notify Customer without undue delay — and in any case within 72 hours — of any confirmed personal data breach that affects Customer personal data.
At Customer's choice, delete or return all Customer personal data at the end of the Service, subject to the retention window described below.

Sub-processors

Processor's current sub-processors are listed at /subprocessors. Processor will give Customer at least 30 days' notice before engaging any new sub-processor. Customer may object in writing within that window; if the objection cannot be resolved through a commercially reasonable alternative, either party may terminate the affected Service without penalty.

Security measures

Processor maintains, at a minimum:

Encryption in transit: TLS 1.2+ on every public endpoint, including admin, portal, API, and tenant sites.
Encryption at rest: full-disk encryption on application and database volumes; sensitive platform credentials (Stripe, OpenAI, Postmark, Twilio, QBO, etc.) are encrypted at the column level via Rails encrypts attribute.
Access controls: role-based permissions inside the Service (Pundit policies + tenant scoping). Administrative access to production infrastructure is limited to named engineers and requires MFA.
Audit logging: privileged actions inside a Customer workspace and across the platform are recorded in an append-only audit log (see Admin → Audit log and the super-admin cross-organization log).
Backups: daily encrypted backups of the primary database, retained for 30 days. Restore drills are exercised at least quarterly.
Incident response: a documented runbook covering triage, containment, customer notification, and post-mortem. Error monitoring (Sentry, Honeybadger) and uptime checks feed into the on-call rotation.
Vulnerability management: dependency scanning on every deploy, periodic static analysis (Brakeman, bundler-audit), and security review of every pull request.

Data breach notification

If Processor becomes aware of a confirmed personal data breach affecting Customer personal data, Processor will notify Customer without undue delay and no later than 72 hours after becoming aware. The notification will include the nature of the breach, categories and approximate number of data subjects affected, likely consequences, and the measures taken or proposed.

Data subject requests

Processor will assist Customer in responding to data subject requests (access, correction, deletion, portability) within the timeframes required by applicable law. Customers can export individual member data at /portal/data_export and process deletion requests at /admin/data_deletion_requests.

Return or deletion at termination

On termination of the Service, Customer may export its data through the admin console. Processor will retain Customer personal data for 90 days after termination to support recovery, then purge it from active systems. Encrypted backups age out according to the retention schedule above. Financial records will be retained as required by tax and accounting law.

Audit rights

On reasonable written notice and no more than once per calendar year, Customer may audit Processor's compliance with this DPA. Processor may satisfy its audit obligations by providing recent third-party audit reports (SOC 2 Type II or equivalent) and written responses to a reasonable questionnaire.

Governing law

This DPA is governed by the laws of the State of California. Where applicable, the parties will also comply with the General Data Protection Regulation (EU 2016/679) and, for EU or UK personal data, the Standard Contractual Clauses are incorporated by reference as an attachment to this DPA.

Template; countersigning

This DPA is provided as a template. Customers that require a countersigned copy can request one from [email protected]. Countersigned DPAs are recorded as an AuditEvent row on the Customer's audit log so the signed version is easy to retrieve.

Signatures

Controller (Customer): _____________________________ Date: ___________

Processor (ChamberBuilder): _________________________ Date: ___________