Data Processing Addendum

Last updated: October 16, 2026

This Data Processing Addendum ("DPA") is part of the Terms and Conditions between your organization ("Customer") and HelpOne Software, LLC, 108 Village Square, Suite 189, Somers, NY 10589 ("Processor"). It applies whenever HelpOne processes personal information in Customer Data. If you need a countersigned copy, email hello@helponesoftware.com.

1. Roles

Customer is the controller (or "business") of Customer Data, including its donor, volunteer, staff, board, and guest records. Processor is the processor (or "service provider") and processes Customer Data only on Customer's documented instructions. Using and configuring HelpOne counts as those instructions.

2. What is processed

• People: donors, prospects, members, volunteers, event guests, staff and applicants, board members, and Customer's users.
• Data: contact details, giving and payment history (payment tokens only, not card numbers), event and shift records, notes, HR and payroll-related records, background-check status, and anything Customer adds in custom fields.
• Purpose and length: to provide, secure, and support HelpOne for the length of the agreement plus the deletion period below.

3. Processor commitments

• Process Customer Data only to provide HelpOne; never sell it, share it for cross-context advertising, or combine it with other customers' data.
• Make sure anyone with access is bound by confidentiality.
• Keep appropriate technical and organizational security measures: encryption in transit and at rest, per-organization data separation, least-privilege access, encrypted integration credentials, hashed passwords, rate limiting, access logging, and backups.
• Help Customer respond to requests from individuals (access, correction, deletion) and with privacy assessments, as far as reasonable.
• Tell Customer without undue delay, and within 72 hours of confirmation, about a security breach affecting Customer Data, with the information Customer needs to meet its obligations.

4. Subprocessors

Customer authorizes Processor to use subprocessors in these categories: application hosting; database hosting and backups; transactional email delivery; text-message delivery; payment processing; and background checks (only when Customer orders one). All are located in the United States and are bound by written terms that protect Customer Data at least as well as this DPA. Customer may ask hello@helponesoftware.com for the current list of subprocessors. Processor will give at least 30 days' notice of a new subprocessor by email to account owners. Customer may object on reasonable data-protection grounds; if we cannot resolve it, Customer may cancel and receive a pro-rated refund of prepaid fees. Processor stays responsible for its subprocessors.

5. Background checks

For background-check reports, Customer is the user of consumer reports and is responsible for permissible purpose, disclosure and authorization, adverse-action notices, and fair-chance laws. Processor stores only what the integration needs (such as status and links), keeps it in Customer's separated data, and does not use it for any other purpose.

6. Payments

Card data is entered into the payment processor's secure hosted fields and does not touch HelpOne's servers. Processor stores only a payment token, not card numbers. Donations, tickets, and other payments to Customer are processed under Customer's own merchant account and agreement; HelpOne is not the merchant for those payments.

7. Location and transfers

Customer Data is stored and processed in the United States. If Customer is subject to laws that require transfer safeguards (for example, the GDPR), the parties will agree on appropriate terms on request.

8. Audits

Once a year, or after a breach, Processor will answer Customer's reasonable written security questions and share summaries of its subprocessors' security reports where available.

9. Return and deletion

Customer can export its data at any time while the account is open and for 30 days after it closes. After that, Processor deletes Customer Data from the live system within 90 days; backups expire on their normal schedule. Processor may keep data the law requires it to keep, protected under this DPA.

10. Order of precedence

If this DPA conflicts with the Terms and Conditions about personal information, this DPA controls. Liability under this DPA is subject to the limits in the Terms and Conditions.