Data Processing Agreement
Spec In A Sec, LLC
Effective Date: April 15, 2026
Website: https://specinasec.com
1. Parties and Scope
1.1 Parties
This Data Processing Agreement ("DPA") is entered into between Spec In A Sec, LLC ("Processor," "Company," "we," "us," or "our") and the Licensee or Vendor that has entered into a Licensee Services Agreement or Vendor Services Agreement with the Company ("Controller," "you," or "your"), collectively referred to as the "Parties."
1.2 Background
The Parties have entered into a service agreement (the "Principal Agreement") under which the Company provides a software-as-a-service platform for textile specification, pattern visualization, sample management, and vendor-designer collaboration. In the course of providing the Service, the Company processes Personal Data on behalf of the Controller.
1.3 Purpose
This DPA sets out the terms under which the Company processes Personal Data on behalf of the Controller, in compliance with Applicable Data Protection Laws, including but not limited to the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").
1.4 Incorporation
This DPA is incorporated into and forms a part of the Principal Agreement. In the event of any conflict between this DPA and the Principal Agreement regarding the processing of Personal Data, this DPA shall prevail.
2. Definitions
2.1 "Applicable Data Protection Laws"
All laws and regulations relating to the processing of Personal Data applicable to the Parties, including GDPR, UK GDPR, CCPA/CPRA, the Swiss Federal Act on Data Protection ("FADP"), and the Personal Information Protection and Electronic Documents Act ("PIPEDA").
2.2 "Controller"
The Licensee or Vendor that determines the purposes and means of the processing of Personal Data processed through the Platform under or in connection with the Principal Agreement.
2.3 "Data Subject"
An identified or identifiable natural person whose Personal Data is processed under this DPA. In the context of the Platform, Data Subjects include Users who register through Controller's branded domain or who interact with Controller's products and services on the Platform.
2.4 "Personal Data"
Any information relating to a Data Subject that is processed by the Company on behalf of the Controller in connection with the Platform. This includes but is not limited to names, email addresses, phone numbers, physical addresses, project specifications, sample requests, and design preferences.
2.5 "Processing"
Any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction.
2.6 "Processor"
Spec In A Sec, LLC, which processes Personal Data on behalf of the Controller in the course of providing the Platform.
2.7 "Sub-processor"
Any third party engaged by the Processor to process Personal Data on behalf of the Controller.
2.8 "Supervisory Authority"
An independent public authority responsible for monitoring the application of data protection laws, as established by a member state of the EEA, the UK Information Commissioner's Office (ICO), or any other relevant regulatory body.
3. Processing of Personal Data
3.1 Roles
For the purposes of this DPA, Controller acts as the data controller and the Company acts as the data processor with respect to Personal Data processed through the Platform on Controller's behalf. The Company processes Personal Data only on documented instructions from the Controller, except where required by Applicable Data Protection Laws.
3.2 Purpose of Processing
The Company processes Personal Data solely for the purposes of providing the Platform and associated services as described in the Principal Agreement, including:
(a) User account creation and management;
(b) Processing and fulfilling project specifications, sample requests, and design selections;
(c) Facilitating communication between Users and Controller;
(d) Generating spec sheets, project records, and related documentation;
(e) Sending transactional and, where consented, marketing communications;
(f) Platform analytics and improvement, using aggregated or anonymized data;
(g) Any other processing necessary to perform the Company's obligations under the Principal Agreement.
3.3 Types of Personal Data
The categories of Personal Data processed under this DPA include:
(a) Identity data: names, company names;
(b) Contact data: email addresses, phone numbers, physical addresses;
(c) Account data: login credentials, account preferences, notification settings;
(d) Project data: specifications, design selections, fabric and pattern preferences, sample requests;
(e) Transaction data: order history, shipping information;
(f) Technical data: IP addresses, browser type, device information, access logs.
3.4 Categories of Data Subjects
Data Subjects include Users who register through Controller's branded domain or organization, and any individuals whose personal information is entered into the Platform in connection with Controller's use of the Service.
3.5 Duration of Processing
The Company will process Personal Data for the duration of the Principal Agreement, plus any period necessary to comply with legal obligations, resolve disputes, or enforce agreements, as described in the Privacy Policy and the Principal Agreement.
4. Obligations of the Processor
4.1 Documented Instructions
The Company shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of Personal Data to a third country, unless required to do so by Applicable Data Protection Laws. In such a case, the Company shall inform the Controller of that legal requirement before processing, unless prohibited from doing so by law.
4.2 Confidentiality
The Company shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
4.3 Security Measures
The Company shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including as appropriate:
(a) Encryption of Personal Data in transit (HTTPS/TLS) and at rest;
(b) Measures to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services;
(c) Access controls limiting data access to authorized personnel;
(d) Regular testing, assessment, and evaluation of the effectiveness of technical and organizational measures;
(e) Procedures for regularly testing, assessing, and evaluating the effectiveness of security measures;
(f) Secure session management across branded domains within the Ecosystem.
4.4 Sub-processing
The Company shall not engage another processor (Sub-processor) without prior general written authorization from the Controller. The Controller provides general authorization to the Company to engage Sub-processors listed in Annex B. The Company shall inform the Controller of any intended changes concerning the addition or replacement of Sub-processors, giving the Controller an opportunity to object to such changes within thirty (30) days of notification.
4.5 Assistance with Data Subject Rights
Taking into account the nature of the processing, the Company shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller's obligation to respond to requests for exercising Data Subject rights, including:
(a) Right of access;
(b) Right to rectification;
(c) Right to erasure;
(d) Right to restriction of processing;
(e) Right to data portability;
(f) Right to object.
4.6 Data Breach Notification
The Company shall notify the Controller without undue delay, and in any event no later than forty-eight (48) hours after becoming aware of a Personal Data breach. The notification shall include:
(a) A description of the nature of the Personal Data breach, including the categories and approximate number of Data Subjects and records concerned;
(b) The name and contact details of the Company's data protection contact;
(c) A description of the likely consequences of the breach;
(d) A description of the measures taken or proposed to be taken to address the breach and mitigate its possible adverse effects.
4.7 Deletion and Return of Data
Upon termination of the Principal Agreement, and subject to the data retention provisions therein, the Company shall, at the Controller's choice, delete or return all Personal Data to the Controller and delete existing copies, unless Applicable Data Protection Laws require storage of the Personal Data. The Company may retain anonymized or aggregated data that does not constitute Personal Data.
4.8 Audit Rights
The Company shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller. Audits shall be subject to reasonable notice (no less than thirty (30) days), conducted during normal business hours, and shall not unreasonably interfere with the Company's operations. The Controller shall bear the costs of any audit.
5. Obligations of the Controller
5.1 Lawful Basis
The Controller shall ensure that it has a lawful basis for the processing of Personal Data under Applicable Data Protection Laws, including obtaining all necessary consents from Data Subjects where required.
5.2 Instructions
The Controller shall be responsible for ensuring that its processing instructions to the Company comply with Applicable Data Protection Laws.
5.3 Data Subject Communication
The Controller is responsible for providing Data Subjects with appropriate privacy notices and for handling Data Subject requests in a timely manner, with the assistance of the Company as described in Section 4.5.
6. International Data Transfers
6.1 Transfer Mechanism
The Company's servers are located in the United States. Where Personal Data originating from the European Economic Area ("EEA"), the United Kingdom, or Switzerland is transferred to the United States, the Parties agree that such transfers shall be governed by the EU Standard Contractual Clauses ("SCCs") as approved by the European Commission, which are incorporated into this DPA by reference.
6.2 Module Applicable
Module Two (Controller to Processor) of the SCCs shall apply to transfers under this DPA.
6.3 UK Transfers
For transfers of Personal Data from the United Kingdom, the UK International Data Transfer Addendum to the EU SCCs, as issued by the UK Information Commissioner's Office, shall apply.
6.4 Swiss Transfers
For transfers of Personal Data from Switzerland, the SCCs shall be interpreted to cover Swiss Personal Data, and references to GDPR shall be read as references to the Swiss FADP where applicable.
6.5 Supplementary Measures
The Company shall implement supplementary measures to protect Personal Data transferred internationally, including encryption in transit and at rest, access controls, and regular security assessments.
7. Term and Termination
7.1 Term
This DPA shall remain in effect for the duration of the Principal Agreement and for as long as the Company processes Personal Data on behalf of the Controller.
7.2 Survival
Sections 4.6 (Data Breach Notification), 4.7 (Deletion and Return of Data), 4.8 (Audit Rights), and 6 (International Data Transfers) shall survive termination of this DPA.
Annex A: Security Measures
The Company implements the following technical and organizational security measures:
(a) All data transmitted between users and the Platform is encrypted using TLS 1.2 or higher;
(b) Data at rest is encrypted using AES-256 encryption;
(c) Access to production systems is restricted to authorized personnel via role-based access controls;
(d) Login attempt monitoring and rate limiting are enforced to prevent brute-force attacks;
(e) Sessions are managed securely across branded domains within the Ecosystem;
(f) Regular backups are maintained with encrypted storage;
(g) Incident response procedures include breach detection, containment, notification, and remediation;
(h) The Company conducts periodic security assessments and updates its security practices accordingly.
Annex B: Authorized Sub-processors
The following Sub-processors are authorized to process Personal Data on behalf of the Controller:
Brevo (formerly Sendinblue) — Email delivery service. Processes email addresses and names for transactional and marketing communications. Location: EU/US.
Stripe — Payment processing. Processes payment information, billing addresses, and transaction records. Location: US.
DigitalOcean, LLC — Cloud hosting and data storage. Processes all data stored on the Platform. Location: US.
Namecheap, Inc. — Domain registration and DNS management. Processes domain registrant contact information (name, email, address, phone) for domains registered on behalf of Vendors and Licensees. Location: US.
The Company will maintain an up-to-date list of Sub-processors and will notify the Controller of any changes in accordance with Section 4.4.
8. Contact Information
For questions about this DPA or to exercise rights under this agreement, contact:
Spec In A Sec, LLC
Data Protection Contact: privacy@specinasec.com