Responsibilities when business data is processed.

1. Scope and roles

These terms apply only to personal information processed on the customer's documented instructions through the service. They do not change the parties' roles for account administration, security, fraud prevention, billing, or legal compliance where the operator determines the processing purpose described in the Privacy Policy.

2. Customer instructions and responsibilities

The customer instructs the service to receive, store, organize, encrypt where specified, publish when selected, transmit, and delete covered data as needed to provide the service. The customer must have a lawful basis, provide required notices, obtain required permissions, honor individual rights, and avoid submitting data prohibited by the Acceptable Use Policy. Additional instructions require written agreement.

3. Confidentiality and security

People authorized to handle covered data are subject to confidentiality obligations and role-based access. Safeguards include TLS in transit, hashed credentials, secure session cookies, application-layer encryption for designated contact fields, encrypted authentication-provider tokens, access checks, rate limits, audit events, and managed backup controls. No security measure eliminates every risk.

4. Subprocessors

The customer authorizes subprocessors needed for hosting, storage, authentication, notifications, payments, communications, monitoring, and support. They may process only the information necessary for their role and must be bound by appropriate data-protection obligations. The deployment operator maintains the approved subprocessor record and will provide information or notice of material changes where required.

5. Individual requests and compliance help

The service provides reasonable self-service tools for access, correction, export, unpublishing, and deletion. Taking into account the nature of processing and information available, the operator will reasonably assist the customer with verified rights requests, security obligations, impact assessments, and regulator inquiries. The customer remains responsible for responding as controller.

6. Security incidents

After confirming a personal-data breach affecting covered data, the operator will notify the customer without undue delay, provide reasonably available information, take appropriate containment and remediation steps, and cooperate with the customer's lawful response. Notice is not an admission of fault.

7. Return, deletion, and legal holds

During the account term, the customer can export eligible data. When service ends or a verified deletion is completed, covered data is deleted from active application systems according to the Data Retention & Deletion Schedule. Restricted copies may remain temporarily in backups, safety, billing, audit, dispute, or legal-hold records.

8. International transfers

Where a legally required transfer mechanism applies, the parties will use an appropriate mechanism in a separately executed agreement. These public terms do not by themselves execute Standard Contractual Clauses or certify participation in a transfer framework.

9. Audit information and order of terms

On reasonable request, and subject to confidentiality and security, the operator will provide information needed to demonstrate compliance. Requests must avoid exposing other customers' data or weakening service security. If these terms conflict with the general Terms on covered processing, these Data Processing Terms control for that conflict.

10. Processing details

• Subject matter: hosting and operating profiles, connections, communications, analytics, and customer-selected features.
• Duration: the account term plus the deletion and retention periods described in the published schedule.
• People: customers, their staff and contacts, profile visitors, connections, and people represented in customer-submitted content.
• Data: account identifiers, profile and contact content, images, links, messages, call metadata, usage events, consent, support, safety, and security data selected or generated through the service.

11. Contact

DPA and privacy requests may be sent to support@publishyourprofile.com. A customer that requires negotiated terms or a signed transfer mechanism must complete that process before submitting covered data that requires it.