Data processing addendum
Draft for counsel review, version of September 24, 2026. The draft states the intended terms and is not yet in force.
On this page
1. Roles
1.1 For the personal information of Clients and of the businesses a Seller contacts, the Seller decides the purposes and Ironstone processes the information on the Seller’s behalf.
1.2 This addendum forms part of the Seller Agreement and applies while Ironstone holds that information.
2. Instructions
2.1 Ironstone shall process the information only to provide the Services, as the Seller directs through the Account, or as the law requires.
3. Confidentiality and security
3.1 Every person who processes the information for Ironstone is bound by confidentiality. The safeguards are described at ironstonedesign.com/security/.
4. Sub-processors
4.1 The Seller authorizes the sub-processors listed at ironstonedesign.com/legal/subprocessors/. Ironstone shall give thirty (30) days’ notice by email before adding one, and the Seller may object and close the Account before the change.
5. Assistance
5.1 Ironstone shall help the Seller answer a request from a person to see, correct or delete that person’s information, within ten (10) business days of the Seller’s request.
6. Breaches
6.1 Ironstone shall notify the Seller of a breach of security safeguards affecting the information without undue delay, and within seventy-two (72) hours of becoming aware of it.
7. Transfers
7.1 The information may be processed in the United States and other countries where the sub-processors operate.
8. Return and deletion
8.1 Within thirty (30) days after the Account closes, Ironstone shall delete the information, except billing records kept as the law requires.