Processor agreement · founder-review draft

A clear boundary for visitor data.

Draft dated September 14, 2026. DPA contact: team@employee0.com.

Not execution-ready. This implementation-aligned outline must be replaced or finalized through a reputable template service and reviewed by qualified counsel before paid use.

Roles and instructions

For personal data submitted by visitors to a customer’s published site, the customer is the controller and employee0 is the processor. employee0 processes that data only to provide, secure, maintain, and support the contracted service, on documented customer instructions and as required by law.

Processing details

Subjects: customer-site visitors and leads.
Data: name, email, optional message, consent context, bounded attribution, and pseudonymous measurement identifiers.
Purpose: receive and present inquiries, measure site activity, prevent abuse, provide support, and maintain service integrity.
Duration: the subscription plus the documented dormancy, deletion, backup, and legal-retention periods.

Security and confidentiality

employee0 limits access by role and tenant, uses row-level database policies, separates public ingestion from private lead access, keeps secrets server-side, redacts sensitive telemetry, encrypts transport, tests restore procedures, and requires personnel and subprocessors with access to maintain confidentiality.

Subprocessors and transfers

employee0 will maintain an approved subprocessor list, flow down appropriate privacy and security duties, notify customers of material changes as required, and use an approved transfer mechanism such as the applicable Standard Contractual Clauses where personal data crosses protected jurisdictions.

Requests, incidents, and deletion

Taking account of the nature of processing, employee0 will reasonably assist with data-subject requests, security incidents, audits, deletion, return, and regulatory obligations. Operational notices go to the customer’s account contact; processor inquiries go to team@employee0.com.

Terms to finalize

The legal entity, registered address, governing terms, audit mechanics, incident-notice deadline, subprocessor objection process, liability relationship, SCC modules and annexes, technical-measures schedule, and signature block remain mandatory counsel-review fields.