Data Processing Addendum
Last updated October 14, 2026. DRAFT — not yet in force.
This Addendum forms part of the Terms of Service between Certify Wage LLC ("Processor") and the Customer ("Controller") and applies to personal data the Processor handles on the Controller's behalf through CertifyWage.
1. Roles and instructions
The Controller determines what personal data is entered and for what purpose. The Processor acts only on the Controller's documented instructions, which are: to provide the Service as described in the Terms, including building and checking certified payrolls, collecting subcontractor submissions, sending notifications the Controller enables, and keeping records for the retention period.
2. Categories
Data subjects: the Controller's employees and contractors' employees, the Controller's users, subcontractor contacts. Data: names, partial identifiers (last four digits), job classifications, hours, pay and deductions, work locations, photos of work sites, contact details, audit logs.
3. Confidentiality and security
The Processor limits access to personnel who need it, binds them to confidentiality, and maintains the technical and organizational measures described in the Privacy Policy: encryption in transit and at rest, hashed credentials, two-factor authentication, per-customer isolation with automated testing, logging, backups with tested restores, and least-privilege access to production.
4. Sub-processors
The Processor uses sub-processors for hosting and database, object storage, email delivery, payment processing, error monitoring and, when the Controller enables it, AI document reading. A current list is available on request and will be provided at signing. The Processor will give 30 days' notice before adding a sub-processor that handles Controller data; the Controller may object on reasonable grounds.
5. Assistance
The Processor will assist the Controller, at reasonable cost, with requests from data subjects, with security incident response, and with audits by the Controller's agencies to the extent they concern the Processor's handling of the data.
6. Incidents
The Processor will notify the Controller without undue delay, and in any case within 72 hours, after becoming aware of a breach of security affecting Controller data, with the information reasonably needed for the Controller to meet its own obligations.
7. Return and deletion
During the term and for the retention period the Controller may export its data. At the end of the retention period, or earlier on the Controller's written instruction acknowledging its own record-keeping duties, the Processor deletes the data from live systems and, within the backup cycle, from backups.
8. Location
Data is stored in the United States.