Data Processing Addendum

Last updated: April 9, 2026 · Private beta · Template only

1. Purpose

This Data Processing Addendum ("DPA") supplements the Terms of Service between you (Customer) and ManageMyGov (Processor) where ManageMyGov processes Personal Data on Customer's behalf. The DPA forms part of the Terms.

2. Roles

Customer is the Data Controller. ManageMyGov is the Data Processor. ManageMyGov processes Personal Data only on documented instructions from Customer, which are reflected by Customer's use of the platform.

3. Subprocessors

ManageMyGov uses the subprocessors listed in our Privacy Policy. We will provide 30 days' notice of any new subprocessor. Customer may object in writing for a reasonable cause.

4. Security measures

ManageMyGov implements appropriate technical and organizational measures to protect Personal Data, including encryption at rest (256-bit AES) and in transit (TLS 1.3), access controls based on principle of least privilege, audit logging of all data access, regular automated backups with point-in-time recovery, and isolation of customer data via row-level multi-tenancy. SOC 2 Type II audit is in progress with target completion Q4 2026.

5. Data location

All Personal Data is stored and processed in the United States (AWS US East 2 region). No transfer outside the US occurs without prior written consent.

6. Data subject rights

ManageMyGov will assist Customer in fulfilling Data Subject requests for access, correction, deletion, restriction, or portability within reasonable timelines.

7. Incident response

ManageMyGov will notify Customer without undue delay (and within 72 hours) of becoming aware of any breach of Personal Data, providing all information reasonably necessary for Customer to meet its notification obligations.

8. Termination

Upon termination of the Agreement, ManageMyGov will delete or return all Personal Data within 30 days, unless retention is required by law.

9. Contact

DPA inquiries: legal@managemygov.org