white label dpa
White-Label Data Processing Addendum (DPA)
Effective date: 2026-10-16
Status: DRAFT for Lena's live legal check.
This DPA is between the firm that subscribes to the TaxProsRated white-label assistant (the "Firm") and Aurum Transfers Limited (trading as TaxProsRated) ("we", "us"). It forms part of the White-Label Assistant Terms (the "Terms"). If this DPA and the Terms conflict on personal data, this DPA applies.
1. Roles
- The Firm is the controller (a "business" under US state privacy laws) of personal information that users give the Assistant on the Firm's site ("Firm Data").
- We're the Firm's processor (a "service provider" or "processor" under US state privacy laws).
- The service is offered to US firms only.
2. What we process
| Item | Detail |
|---|---|
| Purpose | Running the Assistant on the Firm's site and sending intake summaries to the Firm (the "business purpose") |
| Data subjects | Visitors to the Firm's site who use the Assistant |
| Types of data | Messages users type; contact details and intake answers the Firm's configuration asks for; technical data (IP address, browser, time) |
| Sensitive data | None intended. The Firm won't configure the Assistant to collect SSN/TIN, account numbers, full returns, health data or other sensitive data |
| Duration | The term of the Terms, plus the deletion periods below |
| Retention | Intake summaries and conversations deleted on our side within 30 days of creation; server logs up to 90 days |
3. Instructions
We process Firm Data only on the Firm's documented instructions. The Terms, this DPA and the Firm's approved configuration are those instructions. We'll tell the Firm if we think an instruction breaks the law, and we may pause that processing until it's resolved.
4. Confidentiality
Everyone we allow to process Firm Data is bound by confidentiality and has access only where needed to provide the service.
5. Security
We use appropriate technical and organisational measures, including HTTPS encryption in transit, encryption of stored data and backups, access controls with the least access needed, short retention, and logging of administrative access. No system is perfectly secure.
6. Subprocessors
The Firm gives general authorisation for these subprocessors:
| Subprocessor | Service | Location |
|---|---|---|
| Vultr | Hosting and storage | Chicago, Illinois, USA; United States; United States |
| Cloudflare | Content delivery, security, DNS | Global |
| Cloudflare Workers AI (Cloudflare, Inc.) | AI processing for the Assistant, under terms that bar training on the data | Chicago, Illinois, USA; United States; United States |
| Cloudflare Email Service (Cloudflare, Inc.) | Sending intake summaries to the Firm | Chicago, Illinois, USA; United States; United States |
We'll give the Firm at least 30 days' notice by email before adding or replacing a subprocessor. The Firm may object on reasonable data protection grounds; if we can't address the objection, the Firm may end the affected service and get a refund of prepaid fees for the unused period. We bind each subprocessor to data protection terms at least as protective as this DPA and remain responsible for its performance.
7. Personal data breaches
We'll notify the Firm without undue delay and within 72 hours of becoming aware of a breach affecting Firm Data. We'll give the information we have (what happened, the data and people affected, likely effects and the steps taken) and update it as we learn more. We'll help the Firm meet its own notification duties.
8. Help with requests and duties
- If a user asks us directly to access, correct, delete or opt out, we'll pass the request to the Firm promptly and won't respond ourselves unless the Firm tells us to.
- We'll help the Firm respond to data subject requests, as far as the service allows, including deleting a user's data on request.
- We'll give reasonable help with the Firm's risk assessments and with questions from regulators, using information we have.
9. Deletion or return at the end
When the Terms end, we'll stop processing Firm Data and, at the Firm's choice, return or delete it within 30 days, unless the law requires us to keep it. As intake summaries are already deleted within 30 days of creation, there's usually nothing left to return. We'll confirm deletion in writing on request.
10. Audits
We'll make available the information reasonably needed to show we meet this DPA, by documentation: written answers to a reasonable security questionnaire, a description of our measures, and our subprocessor list. This is limited to once a year, unless a regulator requires more or after a breach. On-site audits aren't included.
11. US state privacy law terms (CCPA/CPRA and similar laws)
As the Firm's service provider, we:
- won't sell or share Firm Data (including for cross-context behavioural advertising);
- won't keep, use or disclose Firm Data for any purpose other than the business purpose in §2, or outside our direct business relationship with the Firm;
- won't combine Firm Data with personal information we get from others or collect ourselves, except as those laws allow;
- will comply with the CCPA/CPRA and other applicable US state privacy laws, and give the same level of protection they require;
- will tell the Firm if we can no longer meet these duties; and
- allow the Firm to take reasonable steps to stop and fix unauthorised use.
We certify that we understand and will comply with these restrictions.
12. Transfers
The Firm Data may be processed in the US and other countries where our subprocessors operate, with appropriate safeguards.
13. Liability
Liability under this DPA is subject to the cap and exclusions in the Terms.
Contact
privacy@taxprosrated.com Postal address: Aurum Transfers Limited, c/o Ocho Rios Post Office, Ocho Rios, Saint Ann, Jamaica
— TaxProsRated / Aurum Transfers Limited