This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between Heartland AI Solutions, LLC, doing business as Daymarked ("Daymarked," "we," "us"), and the customer that has accepted the Agreement ("Customer," "you"). It applies whenever Daymarked processes Customer Personal Data that is subject to Data Protection Laws. It takes effect when you accept the Agreement, without a separate signature. If you need a countersigned copy, email privacy@daymarked.co.
1. Definitions
- "Data Protection Laws" means, as applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); the GDPR as it forms part of UK law, together with the UK Data Protection Act 2018 ("UK GDPR"); and the Swiss Federal Act on Data Protection ("FADP").
- "Customer Personal Data" means personal data that Customer or its users enter into, or collect through, the Services about Customer's clients, their families and wedding parties, vendors, and other people involved in a wedding, which Daymarked processes on Customer's behalf.
- "Sub-processor" means a third party Daymarked engages to process Customer Personal Data.
- "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.
- "SCCs" means the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914.
- "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (version B1.0).
- "Controller," "processor," "data subject," "personal data," "processing," and "supervisory authority" have the meanings given in Data Protection Laws.
2. Roles and scope
2.1 Customer is the controller of Customer Personal Data, or a processor acting for its own controller. Daymarked is Customer's processor, or sub-processor.
2.2 The details of the processing are set out in Annex I.
2.3 This DPA doesn't cover personal data Daymarked processes as a controller, such as account, billing, and usage information about Customer and its users. Our Privacy Policy covers that information.
3. Customer's responsibilities
Customer is responsible for having a lawful basis for the Customer Personal Data it collects and enters into the Services, for giving its clients any notices Data Protection Laws require, and for the lawfulness of its instructions. Customer should not enter special categories of personal data (for example, information about health or religion) unless it has a legal basis to do so.
4. Daymarked's obligations
4.1 Instructions. Daymarked processes Customer Personal Data only on Customer's documented instructions, including with regard to international transfers, unless the law requires otherwise; in that case Daymarked will tell Customer before processing unless the law prohibits it. Customer's instructions are the Agreement, this DPA, Customer's use and configuration of the Services, and any other reasonable written instructions Customer gives. Daymarked will tell Customer if it believes an instruction infringes Data Protection Laws.
4.2 Confidentiality. Daymarked ensures that everyone it authorizes to process Customer Personal Data is bound by confidentiality.
4.3 Security. Daymarked implements the technical and organizational measures in Annex II. It may update them, provided the overall level of protection is not reduced.
4.4 Data subject requests. The Services let Customer view, correct, and delete Customer Personal Data, and export most of it (studio admins); a complete copy is available on request under section 7. Beyond that, Daymarked will assist Customer, taking into account the nature of the processing, in responding to requests from data subjects. If Daymarked receives a request directly from one of Customer's clients, it will pass it to Customer and won't respond itself, except to tell the person that it has done so.
4.5 Other assistance. Taking into account the nature of the processing and the information available to it, Daymarked will assist Customer with its obligations on security, Security Incident notification, data protection impact assessments, and prior consultation with supervisory authorities.
5. Sub-processors
5.1 Customer gives Daymarked general authorization to engage the Sub-processors listed on our Sub-processors page.
5.2 Daymarked binds each Sub-processor by written contract to data protection obligations no less protective than this DPA, to the extent they apply to the Sub-processor's service, and remains responsible to Customer for each Sub-processor's performance.
5.3 At least 30 days before a new Sub-processor starts processing Customer Personal Data, Daymarked will update the Sub-processors page and email every customer at its account owner's email address.
5.4 Within that notice period, Customer may object to a new Sub-processor on reasonable data protection grounds by emailing privacy@daymarked.co. The parties will discuss the objection in good faith. If they can't resolve it, Customer may terminate the affected Services by written notice, and Daymarked will refund any prepaid annual fees for the rest of the term, pro rata, and any unused wedding credits from a pack at the per-credit price Customer paid.
6. Security Incidents
Daymarked will notify Customer without undue delay, and aims to do so within 48 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will include the information reasonably available to Daymarked to help Customer meet its own obligations: the nature of the incident, the categories and approximate number of people and records concerned, its likely consequences, and the measures taken or proposed. Daymarked will add information as it becomes available. Notifying Customer is not an admission of fault.
7. Return and deletion
Customer can download a copy of its data from Settings → Account → Your data, and can ask for a complete copy in a machine-readable format by emailing privacy@daymarked.co. When Customer deletes its account, or the Agreement ends, Daymarked deletes Customer Personal Data from its database. Client-portal sign-ins for Customer's clients are deleted on request. Copies in database backups are overwritten within 30 days, and copies held by Sub-processors (such as error reports) expire on the schedules in our Privacy Policy. Daymarked may keep Customer Personal Data where the law requires it, and then keeps it confidential and processes it only for that purpose.
8. Audits
8.1 Daymarked will make available the information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including written answers to a reasonable security questionnaire, no more than once a year unless a Security Incident or a supervisory authority's request makes it necessary.
8.2 If that information isn't enough to demonstrate compliance, or a supervisory authority requires it, Customer, or an independent auditor bound by confidentiality who isn't a Daymarked competitor, may carry out an audit, including an inspection. Customer must give at least 30 days' notice, the audit must take place during business hours, no more than once in any 12 months, and at Customer's cost, and it must not disrupt Daymarked's operations or give access to other customers' data. Audits of Sub-processors follow the Sub-processors' own audit terms.
8.3 Audits under Clause 8.9 of the SCCs are carried out in accordance with this section.
9. International transfers
9.1 Daymarked processes Customer Personal Data in the United States and in the locations listed on the Sub-processors page.
9.2 EEA. For transfers of Customer Personal Data from the European Economic Area to Daymarked, the SCCs are incorporated into this DPA by reference, as follows: Module Two applies where Customer is a controller, and Module Three where Customer is a processor; Clause 7 (docking clause) applies; under Clause 9, Option 2 (general written authorization) applies, with the notice period in section 5.3; the optional language in Clause 11 doesn't apply; under Clause 13, the competent supervisory authority is determined as set out in Clause 13(a); under Clauses 17 and 18, the SCCs are governed by Irish law and disputes go to the courts of Ireland; and Annexes I and II of the SCCs are completed with Annexes I and II of this DPA.
9.3 United Kingdom. For transfers from the United Kingdom, the UK Addendum is incorporated by reference. Tables 1 to 3 are completed with the information in this DPA and its annexes, and in Table 4, neither party may end the UK Addendum under its Section 19.
9.4 Switzerland. For transfers from Switzerland, the SCCs apply as set out in section 9.2, with these changes: references to the GDPR mean the FADP; the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority; and "Member State" doesn't prevent data subjects in Switzerland from bringing claims where they habitually reside.
9.5 If Daymarked adopts another lawful transfer mechanism, such as certification under the EU-US Data Privacy Framework, that mechanism may apply instead.
10. General
10.1 Each party's liability under this DPA is subject to the limitations in the Agreement, except where Data Protection Laws don't allow them. Nothing in this DPA limits the rights of data subjects under the SCCs.
10.2 This DPA lasts for as long as Daymarked processes Customer Personal Data.
10.3 If this DPA conflicts with the Agreement, this DPA controls for the processing of Customer Personal Data. If the SCCs conflict with this DPA or the Agreement, the SCCs control.
10.4 Daymarked may update this DPA to reflect changes in law or in the Services, with the same notice as for changes to the Agreement, provided the update doesn't reduce the protection of Customer Personal Data.
Annex I: Details of processing
A. Parties
- Data exporter: the Customer identified in its Daymarked account. Role: controller (or processor). Activities: using the Services to plan weddings with its clients. Contact: the account owner's email address.
- Data importer: Heartland AI Solutions, LLC (Daymarked), 19909 Blondo Pkwy, Elkhorn, NE 68022, United States. Role: processor (or sub-processor). Contact: privacy@daymarked.co.
B. Description of the processing
- Data subjects: Customer's clients (couples); their family members and wedding party; vendors and second shooters; other people named in wedding details.
- Personal data: names; email addresses; phone numbers; postal and venue addresses; wedding dates, schedules, and logistics; family and wedding-party details and relationships; notes, comments, and questionnaire answers; for client accounts, the sign-in email address.
- Special categories: none intended. Free-text fields may contain some if Customer or its clients enter it, for example a religious ceremony. Customer decides whether to record such information, and the measures in Annex II apply to it.
- Frequency: continuous, for as long as Customer uses the Services.
- Nature of the processing: hosting, storage, organization, retrieval, display, and sharing as Customer directs; sending emails; generating PDFs; and AI-assisted extraction of imported questionnaires.
- Purpose: providing the Services to Customer under the Agreement.
- Retention: for the term of the Agreement, then deletion as set out in section 7.
- Transfers to Sub-processors: as listed on the Sub-processors page, for the same nature, purpose, and duration.
C. Competent supervisory authority
As determined under Clause 13 of the SCCs.
Annex II: Technical and organizational measures
- Encryption: all traffic uses HTTPS (TLS), with HTTP Strict Transport Security. Our database host encrypts all stored data at rest with AES-256.
- Tenant isolation: every table in the database enforces row-level security, so each studio's data is available only to that studio's users and the clients they invite. Tables that only our servers use deny all other access.
- Least privilege: the database service key is used only on our servers, and an automated test stops it from reaching the browser. The production keys for email and payments are restricted to the actions the Services need.
- Application security: a Content Security Policy, rate limits on public and sign-in endpoints, and unguessable share links that stop working when a wedding is archived.
- Data minimization in monitoring: links and access tokens are removed from URLs before error reports and analytics are sent. Session recordings hide everything typed and all client and wedding details on screen, and Customer's clients are never recorded. Analytics events are designed not to contain names, email addresses, or wedding details.
- Access: access to production systems and data is limited to Daymarked personnel who need it to operate the Services.
- Vendors: every Sub-processor is bound by a data processing agreement.
- Incidents: handled and notified as set out in section 6.
Annex III: Sub-processors
The current list is on our Sub-processors page.