Data Processing Addendum

This addendum is part of our Terms of Service between Centis, which operates PageIntake ("we"), and the Agency using PageIntake ("you"). It applies to personal data in Client Content, and takes effect when you accept the terms. It follows Korea's Personal Information Protection Act (PIPA, Art. 26), which sets the rules for entrusting processing to another business. Where it conflicts with the terms, this addendum wins for personal data.

1. Roles

You decide what personal data you collect through PageIntake and why. We process it only on your behalf, to provide PageIntake to you.

2. What we process

• People: your Clients and anyone else whose information you or your Clients put into a project.
• Data: names and email addresses you enter for Clients, and whatever your Clients' answers, files, and comments contain.
• Processing: storing it, showing it to you and your Clients, emailing Clients for you, sending it to the tools you connect, and deleting it.
• Duration: for as long as you use PageIntake, then until it is deleted under section 9.

3. Your instructions

We process personal data only on your instructions: these terms, and what you set up and do in PageIntake. We never use it for our own purposes, sell it, use it for advertising, or use it to train AI models. If a law requires us to do otherwise, we'll tell you first unless the law forbids it.

4. Confidentiality

Only people who need access to run PageIntake can reach personal data, and they are bound to keep it confidential.

5. Security

• Data is encrypted in transit.
• Each Agency's data is kept separate, and every request is checked against the Agency it belongs to.
• Client links are stored hashed, and can be paused or reissued at any time.
• Credentials for the tools you connect are encrypted.
• Access to production systems is limited and monitored.

6. Subprocessors

By accepting the terms, you consent to our re-entrusting processing to the subprocessors on ourSubprocessors page (PIPA Art. 26(6)), and we don't entrust personal data to anyone else. We choose subprocessors that protect data to the standard this addendum sets. Before we add or replace one, we'll email the Owner at least 14 days in advance. If you object and we can't resolve it, you can delete your Agency before the change. We remain responsible for our subprocessors.

The tools you connect, such as Slack or Google Drive, aren't our subprocessors. Data you send to them is governed by your agreement with them.

7. International transfers

Our subprocessors store data in the United States. The details of each transfer are in ourPrivacy Policy.

8. Helping you

• Requests from people: you can view, correct, export, and delete Client Content in the app. If a person asks us directly, we'll pass the request to you. For anything the app can't do, we'll help.
• Breaches: if we become aware of a breach of personal data we process for you, we'll tell the Owner without undue delay and within 24 hours, with what we know and what we're doing about it, so you can meet your own duty to notify.
• Supervision: you may check how we meet this addendum, as PIPA Art. 26(4) provides. We'll answer reasonable questions and share the information you need. On-site audits are by agreement, or where the law requires them.

9. Deletion

You can download project files at any time. When you delete a project or your Agency, we delete its personal data at once, and database backups expire within 30 days. We keep nothing longer unless a law requires it.

10. Liability

Between you and us, liability under this addendum follows the limits in theTerms of Service, except where the law doesn't allow them. Those limits don't affect the rights of the people whose data we process.

11. Contact

Questions about this addendum? Email support@pageintake.com.