Data Processing Addendum and Subprocessors

1Roles and instructions

The customer is the controller or business and FocalShift is the processor or service provider for Customer Personal Data submitted to the Services. FocalShift will process that data only on documented instructions in the agreement, product configuration, support requests, and this DPA, unless law requires otherwise.

2Processing details

Processing supports hosting, storage, organization, retrieval, transmission, communication, automation, analytics, security, support, and deletion. Data subjects may include the customer’s users, employees, contractors, customers, leads, members, students, subscribers, vendors, and other contacts. Data may include identifiers, contact and profile data, communications, files, commercial records, usage information, and other data the customer chooses to submit.

3Confidentiality and security

FocalShift will ensure that personnel authorized to process Customer Personal Data are bound by confidentiality obligations. We maintain reasonable administrative, technical, and organizational measures designed to protect confidentiality, integrity, availability, and resilience, including access controls, authentication, logging, backups, vulnerability management, and incident-response procedures appropriate to risk.

4Customer responsibilities

The customer is responsible for lawful collection, instructions, notices, consents, account configuration, user permissions, and the accuracy and proportionality of Customer Personal Data. The customer will not instruct FocalShift to process data unlawfully and will use available security controls.

5Subprocessors

The customer generally authorizes FocalShift to engage subprocessors that provide infrastructure, security, communications, payments, support, analytics, and AI functionality. FocalShift will impose data-protection obligations appropriate to the services each subprocessor performs and remains responsible for its processing obligations under this DPA.

Live video. When a member turns on “Send my stream to FocalShift”, her broadcast is carried by Cloudflare Stream while it is running so that other people can watch it on her FocalShift page. FocalShift does not record the broadcast and does not keep it: recording is switched off on every channel we create, we check that it is off before we store anything about the channel at all, and there is no setting anywhere — in her account or in ours — that turns it on. When the broadcast ends there is nothing left to delete. A member who does not turn that switch on never has her video sent to Cloudflare at all.

FocalShift may update this list as the Services change. A customer with a legally supportable objection to a new subprocessor may contact FocalShift before the subprocessor begins materially processing that customer’s data. The parties will work in good faith on a reasonable alternative; if none is available, either party may terminate the affected feature.

6Your customers’ data

Customers use the Services to process personal data about their own customers, leads, contacts, subscribers, students, members, clients, patients where permitted, guests, and staff. As between the parties, the customer is the controller or business for that data and FocalShift is the processor or service provider acting on the customer’s documented instructions, which consist of this DPA, the agreement, and the customer’s configuration and use of the Services.

The customer is responsible for: providing its own privacy notice to those individuals; establishing and documenting a lawful basis for collection, use, enrichment, profiling, marketing, and disclosure; obtaining and recording any consent that applicable law requires, including for electronic marketing, cookies and tracking on the customer’s own sites, call or session recording, and automated decision-making; honoring opt-outs, suppression, and deletion requests; responding to data-subject requests it receives, with FocalShift’s assistance through available product functions; assessing whether a transfer or a processing activity requires an impact assessment; and configuring workspace roles, retention, sharing, and public visibility appropriately. FocalShift does not independently verify the lawfulness of a customer’s collection or the accuracy of data a customer imports.

7Restricted data categories

The Services are general-purpose business tools and are not configured, certified, or offered as a compliance environment for every regulated data type. Customers must not submit to the Services: primary account numbers, full magnetic-stripe or chip data, card-verification values, or other cardholder data subject to the Payment Card Industry Data Security Standard, except through a payment feature expressly provided for that purpose, where card data is handled by the payment provider and is not stored by FocalShift; protected health information subject to the Health Insurance Portability and Accountability Act, unless FocalShift has signed a written business associate agreement covering that use; information subject to the Gramm-Leach-Bliley Act, the Family Educational Rights and Privacy Act, substance-use-disorder confidentiality rules, biometric-identifier statutes, or government classified or export-controlled information, unless FocalShift has agreed in writing to support that use; and background-screening, consumer-report, or credit-report data subject to the Fair Credit Reporting Act.

Customers must not use the Services to make, or to provide the sole basis for, decisions about employment, housing, credit, insurance, education admission, or access to essential services. Where a customer intends to process special-category or sensitive personal data, it must first confirm suitability in writing with FocalShift and implement its own additional safeguards. A customer that submits restricted data in breach of this section is responsible for the consequences, and FocalShift may restrict, quarantine, or require deletion of that data.

8Data-subject requests

Taking into account the nature of processing, FocalShift will provide reasonable assistance through available product functions and support so the customer can respond to requests to access, correct, delete, restrict, object to, or port personal data. If FocalShift receives a request relating to Customer Personal Data, it may direct the requester to the customer unless law requires a direct response.

9Security incidents

FocalShift will notify the customer without undue delay after confirming a personal-data breach affecting Customer Personal Data and will provide available information reasonably needed for the customer’s legal obligations. Notification is not an admission of fault or liability.

10International transfers

Where a legally recognized transfer mechanism is required, the parties incorporate the applicable standard contractual clauses or equivalent mechanism. FocalShift will provide information reasonably necessary for transfer assessments and supplementary measures.

11Deletion and return

During the service term, customers may use available tools to access or export data. After termination, FocalShift will delete or return Customer Personal Data within a reasonable period, subject to backup cycles, security requirements, and legal retention duties.

12Audits and information

FocalShift will make available information reasonably necessary to demonstrate compliance with this DPA. Audits must be proportionate, protect other customers and security information, occur no more than annually unless required by a regulator or material incident, and be conducted under confidentiality obligations without unreasonable disruption.

13Priority and contact

If this DPA conflicts with the Terms concerning processing of Customer Personal Data, this DPA controls. Data-protection questions may be submitted through FocalShift Contact.