Data Processing Agreement

Framework for how KWALL processes personal data on behalf of clients

Last updated: April 2, 2026

Purpose

This Data Processing Agreement (“DPA”) outlines how KWALL LLC (“KWALL,” “Processor,” “we,” “us,” or “our”) processes personal data on behalf of our clients (“Controller,” “you,” or “your”) in connection with the web development, hosting coordination, AI-powered, and digital marketing services we provide. This DPA is a framework document that supplements the services agreement between KWALL and the Controller.

Definitions

  • Controller: The client entity that determines the purposes and means of processing personal data.
  • Processor: KWALL LLC, which processes personal data on behalf of the Controller.
  • Data Subject: An identified or identifiable natural person whose personal data is processed.
  • Personal Data: Any information relating to a Data Subject that can be used to directly or indirectly identify that person.
  • Processing: Any operation performed on personal data, including collection, storage, use, disclosure, or deletion.
  • Sub-processor: A third party engaged by KWALL to process personal data on behalf of the Controller.

Scope of Processing

KWALL processes personal data only as instructed by the Controller and only to the extent necessary to provide the agreed-upon services. Processing activities may include website development and maintenance, analytics implementation, form processing, email marketing integration, and AI-powered content or search features.

Categories of Data Processed

  • Website visitor data: IP addresses, browser information, device data, pages visited, and other analytics data.
  • Form submissions: Names, email addresses, phone numbers, and other information voluntarily submitted through website forms.
  • Analytics data: Aggregated and individual user behavior data collected through analytics platforms.
  • CMS user accounts: Usernames, email addresses, roles, and activity logs for content management system users.

KWALL’s Obligations as Processor

KWALL commits to the following obligations when processing personal data on behalf of the Controller:

  • Documented instructions: Process personal data only on documented instructions from the Controller, unless required by applicable law.
  • Confidentiality: Ensure that all personnel authorized to process personal data have committed to confidentiality obligations.
  • Security measures: Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption, access controls, and regular security assessments.
  • Data subject requests: Assist the Controller in responding to requests from Data Subjects exercising their rights (access, rectification, erasure, portability, etc.).
  • Data deletion or return: Upon termination of services, delete or return all personal data to the Controller, unless retention is required by applicable law. Data deletion will be completed within 90 days of termination.

Sub-processors

KWALL engages the following categories of sub-processors in the delivery of services. The Controller will be notified of any changes to sub-processors with reasonable advance notice, providing an opportunity to object.

  • Pantheon Systems: Website hosting and infrastructure.
  • Google (Google Analytics, Google Tag Manager): Website analytics and tag management.
  • HubSpot: CRM, marketing automation, and form processing.
  • Mailgun / SendGrid: Transactional email delivery.
  • Cloudflare: CDN, DNS, and security services.
  • AI service providers: Natural language processing, content generation, and search enhancement (specific providers disclosed upon request).

A complete and current list of sub-processors is available upon request by contacting dpa@kwallcompany.com.

International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, KWALL ensures appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) as adopted by the European Commission.
  • EU-U.S. Data Privacy Framework certification where applicable.
  • Transfer impact assessments as required by applicable law.

Data Breach Notification

In the event of a personal data breach, KWALL will:

  • Notify the Controller without undue delay and in any event within 72 hours of becoming aware of the breach.
  • Provide sufficient information to enable the Controller to meet its own breach notification obligations, including the nature of the breach, categories and approximate number of Data Subjects affected, likely consequences, and measures taken or proposed to address the breach.
  • Cooperate with the Controller and take reasonable steps to assist in the investigation, mitigation, and remediation of the breach.

Audit Rights

The Controller may request evidence of KWALL’s compliance with this DPA. KWALL will:

  • Make available to the Controller all information necessary to demonstrate compliance with data processing obligations.
  • Allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, subject to reasonable notice and scope limitations.
  • Provide summaries of relevant third-party audit reports or certifications upon request.

Duration and Termination

This DPA is effective for the duration of the services agreement between KWALL and the Controller. Upon termination of services:

  • KWALL will cease all processing of personal data on behalf of the Controller.
  • At the Controller’s election, KWALL will either return all personal data or securely delete it within 90 days, providing written confirmation of deletion upon request.
  • Obligations regarding confidentiality and data protection survive termination of this DPA.

Contact

For questions regarding this Data Processing Agreement, to request a formal DPA for execution, or to report a data protection concern, please contact:

KWALL LLC — Data Protection
Email: dpa@kwallcompany.com
General Legal: legal@kwallcompany.com
Address: 2211 Michelson Drive 9th Floor, Irvine, CA 92612

This DPA framework is subject to updates. Material changes will be communicated to active clients in advance of taking effect.