Data Processing Agreement
Last updated: 2026-05-20
A signed DPA is available on request for Growth and Atelier plan customers. Email dpa@bambergdigital.com with your workspace name and billing email.
1. Definitions
"Controller" means you (the Conduit customer). "Processor" means BamCor Digital LLC operating Conduit. "Personal Data" means any information relating to an identified or identifiable natural person that you upload to or process through Conduit.
2. Processing scope
Processor shall process Personal Data only on documented instructions from Controller — namely, to operate the Conduit service features you have enabled. Processor shall not process Personal Data for any other purpose.
3. Sub-processors
Processor uses the following sub-processors: Supabase Inc. (database), Vercel Inc. (hosting), Stripe Inc. (payments). Processor will notify Controller at least 30 days before adding new sub-processors.
4. Security measures
Processor implements row-level security at the database layer, TLS in transit, encrypted backups, and access logging. Processor conducts annual security reviews.
5. Data subject rights
Processor will assist Controller in fulfilling data subject rights requests (access, rectification, erasure, portability) within 30 days of request.
6. Breach notification
Processor will notify Controller of a personal data breach within 72 hours of becoming aware, providing available details about the nature of the breach, categories and approximate number of data subjects affected, and likely consequences.
7. Data deletion
Upon termination or Controller request, Processor will delete all Personal Data within 30 days and certify deletion in writing.
8. International transfers
Personal Data is stored in us-west-1 (Oregon, USA). Transfers from the EEA/UK are covered by Standard Contractual Clauses (SCCs) — available upon request.
9. Governing law
This DPA is governed by the laws of the State of California, consistent with the Terms of Service.