Legal
Data Processing Addendum
Last updated September 24, 2026
Contents
How this DPA works
This Data Processing Addendum ("DPA") has two parts: (1) this Cover Page, and (2) the Common Paper DPA Standard Terms Version 1.1 ("DPA Standard Terms"), which are incorporated by reference. If the two conflict, this Cover Page controls. Capitalized words not defined here have the meanings given in the DPA Standard Terms or the Agreement.
- Provider: suntwenty LLC, doing business as birddog, 1317 Edgewater Drive #2492, Orlando, FL 32804, USA ("birddog").
- Customer: the company that accepted the Agreement.
- When it applies: whenever birddog Processes Customer Personal Data on Customer's behalf under the Agreement.
- Acceptance: Customer accepts this DPA by accepting the Agreement, which incorporates it. No separate signature is needed.
Key Terms
| Term | Meaning for this DPA |
|---|---|
| Agreement | The birddog Pilot Partner Program Terms and Customer's Order Details, or any other birddog terms that incorporate this DPA |
| Governing Member State | Ireland |
| Security Policy | The security measures in Annex II |
| Provider Security Contact | The notices email address in the Agreement, shown on Customer's invoice |
| Approved Subprocessors | The list in Annex III |
| Report | None (see Change 2) |
Changes to the DPA Standard Terms
Change 1: Contributions
Under Section 4.8 of the Agreement, corrections to birddog's own records may flow from Customer's systems back to birddog. For those Contributions, birddog acts as an independent controller, not as Customer's processor, and this DPA doesn't apply to them. birddog handles Contributions under its Privacy Policy and Applicable Data Protection Laws. Contributions are limited to business contact and company details, and never include Customer's customer lists, deals, pipeline or notes.
Change 2: Security reports
birddog isn't currently audited by independent third parties, so Section 5.2 of the DPA Standard Terms doesn't apply. Customer may use Section 5.3 (security questionnaires) instead. birddog will tell Customer if it obtains a third-party audit report.
Change 3: Customer's own tools
Where birddog works inside third-party software that Customer owns and pays for (Section 3.3 of the Agreement), those software providers are Customer's own processors, not birddog's Subprocessors.
Annex I(A) and I(C): Parties and Supervisory Authority
| Data exporter | Data importer | |
|---|---|---|
| Party | Customer | birddog |
| Address and contact | As provided by Customer when accepting the Agreement | 1317 Edgewater Drive #2492, Orlando, FL 32804, USA; the notices email address in the Agreement |
| Role | Controller (or Processor, where Customer handles data for its own clients) | Processor (or Subprocessor) |
| Activities | Receiving the services under the Agreement | Providing the services under the Agreement |
Competent supervisory authority: the data protection authority of the EEA member state where Customer is established.
Annex I(B): Description of Processing
| Item | Details |
|---|---|
| Categories of Data Subjects | Customer's contacts, prospects, customers and business partners; Customer's employees and users of the Service |
| Categories of Personal Data | Business contact details (name, job title, employer, business email and phone); professional details (role, projects, company affiliations); CRM records Customer asks birddog to migrate or configure, such as activity history and notes; account details of Customer's users |
| Special Category Data | None. Customer won't provide Special Category Data to birddog |
| Frequency of Transfer | Continuous, for the term of the Agreement |
| Nature of Processing | Accessing, migrating, organizing, enriching, verifying and storing data; configuring CRMs and automations; AI-assisted research |
| Purpose of Processing | Providing the Consulting Services and Data License under the Agreement, including CRM setup, data migration, prospecting automation and contact verification |
| Duration of Processing | The term of the Agreement, followed by deletion or return under Section 7 of the DPA Standard Terms |
| Transfers to Subprocessors | Same subject matter, nature and duration as above, limited to each Subprocessor's task in Annex III |
Annex II: Security Measures
birddog maintains these technical and organizational measures.
- Access control: only birddog personnel and subcontractors who need Customer Personal Data can access it, each with their own account.
- Multi-factor authentication: enabled on every birddog account that can reach Customer Personal Data.
- Credentials: Customer passwords and API keys are kept in a password manager, never sent or stored in plain text.
- Encryption: data is encrypted in transit, and at rest where the tools in use support it.
- Data minimization: birddog works inside Customer's own accounts where possible and keeps as few copies of Customer Personal Data as it can.
- AI providers: birddog uses business or API tiers of AI providers that don't train their models on submitted data.
- Devices: laptops used for Customer work have full-disk encryption, screen lock and current security updates.
- Confidentiality: personnel and subcontractors are bound by written confidentiality obligations.
- Incidents and deletion: handled under Sections 4 and 7 of the DPA Standard Terms, including notice within 72 hours.
Annex III: Approved Subprocessors
| Subprocessor | Location | Purpose |
|---|---|---|
| Anthropic | USA | AI model provider for research and data processing |
| xAI | USA | AI model provider for research and data processing |
| Google Workspace | USA | Email and file storage |
| Supabase | USA | Database for the birddog platform |
| Cloudflare | USA | Hosting the birddog platform and APIs |
birddog personnel and subcontractors may access Customer Personal Data from the United States and Mexico.
License
The DPA Standard Terms are the Common Paper DPA Standard Terms Version 1.1, free to use under CC BY 4.0.