This Data Processing Agreement (“DPA”) applies to all professional services provided by Orbital Access, LLC, d/b/a Meet Caddy (“Caddy”) and is incorporated into the Agreement through the Client Services Agreement (“CSA”). The parties’ identities and the Effective Date are as stated in the CSA.
This DPA is a Policy Document under CSA Section 1.3 and a constituent document of the Agreement, together with the CSA, the General Terms of Service (“General Terms”), and each applicable Statement of Work (“SOW”). This DPA governs all Processing of Customer Personal Data in connection with the Agreement.
1. Definitions
1.1 “Applicable Data Protection Laws” means all laws applicable to the Processing of Personal Data under the Agreement, including the CCPA/CPRA to the extent applicable, and any other applicable federal, state, or local data protection law.
1.2 “Customer Personal Data” means any Personal Data that Customer provides, transmits, or makes accessible to Caddy in connection with the Agreement.
1.3 “Personal Data” means any information relating to an identified or identifiable natural person.
1.4 “Processing” has the meaning given in Applicable Data Protection Laws.
1.5 “Sub-processor” means any third party engaged by Caddy to Process Customer Personal Data.
1.6 “Personal Data Breach” means a confirmed breach leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data.
2. Roles and Scope
2.1 Roles. Customer is the Controller (or Business under CCPA/CPRA). Caddy is the Processor (or Service Provider). Caddy Processes solely on Customer’s documented instructions per Section 4.
2.2 Scope. This DPA applies to all Processing in connection with engagements and post-termination data handling under Section 8.
2.3 Execution before Processing. Caddy will not Process Customer Personal Data until this DPA, the CSA, and the applicable SOW are in force. Pre-contract intake (where Caddy collects prospect information as a controller) is outside this DPA’s scope.
3. Processing Description
3.1 Subject matter and duration. Processing necessary to perform the services, for the engagement plus retention under Section 8.
3.2 Purpose. Processing for: (i) AI workflow design, build, and deployment; (ii) engagement deliverables; (iii) communications including recordings and transcripts; (iv) delivery and measurement; (v) billing, record-keeping, and dispute resolution; and (vi) legal compliance.
3.3 Data Subjects. Customer’s officers, directors, leadership, Champions, operators, and engagement participants.
3.4 Categories of Personal Data. Name, business email, phone, title; voice and video from meetings; written communications; operational data; documents containing personal information; and any other data Customer provides.
3.5 Sensitive data. Not required; Customer should not provide without written authorization.
4. Customer Instructions
4.1 Caddy Processes only on documented instructions. The Agreement constitutes those instructions.
4.2 Caddy will notify Customer if an instruction appears to infringe Applicable Data Protection Laws.
4.3 Processing outside documented instructions requires written authorization via Customer Champion.
5. Sub-Processors
5.1 Category-based authorization. Customer authorizes Sub-processors within the categories in Annex C. Within-category replacements: Caddy updates the list and notifies Customer within fifteen (15) days.
5.2 Obligations. Written agreements no less protective than this DPA; Caddy remains liable; list maintained and updated.
5.3 New categories. Thirty (30) days’ advance notice. Customer may object within fifteen (15) days; if unresolved, Customer may terminate the affected scope per CSA Section 5.4.
5.4 No model training. Customer Personal Data will not be used to train, fine-tune, or improve any AI model. Caddy maintains commercial terms and settings excluding Customer data from training. Applies to every AI Sub-processor regardless of access path.
5.5 Cloud-hosted AI. Cloud hosts are Sub-processors within an authorized category. The no-training commitment applies regardless of access path.
6. Data Security
Caddy implements appropriate technical and organizational measures, including: encryption in transit and at rest; role-based access controls with multi-factor authentication; device-level protections; secure development practices; application monitoring; regular backups; written confidentiality obligations for all personnel (international personnel managed through a contractor management platform with identity verification and localized compliance); vendor security assessments; and append-only, tamper-evident integrity logging retained for the engagement term plus twenty-four (24) months. Caddy does not warrant logs are tamper-proof. Customer-identifying data is excluded from application logs where feasible. Security measures are reviewed annually and after any breach. Each customer’s data is logically separated and never pooled.
7. Data Subject Requests
Customer is responsible for Data Subject requests. Caddy will cooperate with Customer’s response, including notifying Customer of direct requests, providing data access, and deleting or correcting data on instruction.
8. Data Retention
8.1 Caddy retains Customer Personal Data only as long as necessary and as required by law.
8.2 Following closeout, Caddy retains data for two (2) years for dispute resolution, audit response, and measurement. After that, only legally required records are retained for up to two (2) additional years. At the end of retention, Caddy securely deletes or anonymizes all remaining data.
8.3 On Customer’s written request during the two-year retention period, Caddy will delete within thirty (30) business days, confirm in writing, and cause Sub-processors to delete.
8.4 Engagement workspace: export available in PDF/JSON on request; read-only access during the two-year retention period; archived or deleted afterward.
8.5 AI-provider retention: data processed through AI Sub-processors on Caddy’s account is excluded from training and retained only for a limited period (currently up to thirty days). Data in Customer’s own account is governed by Customer’s agreement with the provider.
9. Cross-Border Transfers
9.1 Processing locations. Customer Personal Data is stored primarily in the United States. Caddy’s engagement delivery personnel may access data remotely from Pakistan, the Philippines, and Latin American countries. All international personnel are subject to the security measures in Section 6, bound by written confidentiality obligations, and managed through a contractor management platform. Current locations are listed in Annex C.
9.2 Safeguards. Written contractor agreements no less protective than this DPA; contractor management platform compliance; least-privilege access; and the technical measures in Section 6.
10. Breach Notification
10.1 Notification within seventy-two (72) hours of confirming a Personal Data Breach.
10.2 Notice includes: nature, affected categories and numbers, likely consequences, measures taken, and incident-response contact.
10.3 Reasonable cooperation with investigation and notification obligations.
10.4 Notification is not an admission. Caddy maintains an incident-response playbook updated annually.
11. Personnel and Confidentiality
All personnel authorized to Process Customer Personal Data are bound by written confidentiality obligations surviving termination, including international personnel. Access limited to personnel who require it.
12. System Access and Telemetry
12.1 Caddy works from uploaded materials and meeting recordings.
12.2 System access. Scoped per the Access Map, authorized by Customer Champion, used solely for the engagement, limited to assigned personnel, and logged per Section 6. Customer may revoke access on written notice. Customer is responsible for its own system security.
12.3 Telemetry. Customer authorizes collection of operational telemetry (execution counts, durations, success/error rates) containing no Personal Data and no product content, used solely for operations, monitoring, and scorecards. Customer may withdraw consent on written notice.
13. Liability
Each party’s liability under this DPA is subject to CSA Section 4. Each party bears its own non-compliance costs. The parties will cooperate on regulatory liability allocation.
14. Term, Survival, and General Provisions
14.1 This DPA continues until all retention periods end or all deletion requests are completed.
14.2 Surviving: Sections 1, 6, 7, 8, 9, 10, 13, 14, and Annex C.
14.3 This DPA controls data-processing matters. The CSA, General Terms, or SOW controls all else.
14.4 This DPA may be updated per CSA Section 1.3. Amendments outside that process require written signatures.
14.5 Governing law: Texas, except as required by Applicable Data Protection Laws.
14.6 Severability, no third-party beneficiaries, and no-waiver apply.
14.7 Notices per the CSA.
Annex C: Sub-Processor Categories and List
Authorization under Section 5.1 is by category. Within-category replacements per Section 5.1; new categories per Section 5.3.
Category 1: AI Model Providers. Anthropic. United States.
Category 2: Cloud Infrastructure. Vercel, Supabase. United States.
Category 3: Workspace and Project Management. Notion. United States.
Category 4: Document Storage. Google Workspace (Drive). United States.
Category 5: Meeting Recording. Fathom. United States.
Category 6: Email Infrastructure. Google Workspace (Gmail), Resend. United States.
Category 7: Team Communications. Slack. United States.
Category 8: Engagement Delivery Personnel (International). Pakistan, the Philippines, Latin American countries. Managed through Remote.com (localized compliance, identity verification). Remote.com does not Process Customer Personal Data.
Category 9: Contract Execution. DocuSign. United States.
Category 10: Payment Processing. Hyfin. United States.
Integral Sub-Processors. Anthropic, Vercel, and Supabase cannot be replaced without fundamentally altering the service.
Internal-Use Tools. Tools for Caddy’s internal operations that do not Process Customer Personal Data are not Sub-processors.
Availability. Current copy on request at hi@meetcaddy.com.