Data Processing Addendum
This addendum will govern Procession OS’s processing of personal data as a processor on behalf of a funeral home (controller), for decedent, family, and other personal data entered into the platform. Incorporated into the Master Subscription Agreement by reference.
1. Scope & Roles
Confirm the controller/processor relationship, the categories of data subjects (decedents, family members, staff), and categories of personal data processed.
2. Definitions
Define terms consistent with applicable data protection law (e.g. GDPR Article 4 definitions, or CCPA’s service-provider terminology, as applicable).
3. Processing Instructions
State that Procession OS processes personal data only on the customer’s documented instructions, and the mechanism for the customer to issue those instructions.
4. Subprocessors
State the process for approving subprocessors (general vs. specific authorization), and link to the current list at /subprocessors.
5. Security Measures
Reference the technical and organizational measures described in the Privacy Policy, or attach a separate security exhibit.
6. Data Subject Requests
Describe how Procession OS assists the customer in responding to data subject requests (access, deletion, etc.), given the customer is the controller for decedent/family data.
7. Data Breach Notification
State the notification timeline and process following a confirmed personal data breach.
8. International Transfers
State the transfer mechanism used for any cross-border processing (e.g. Standard Contractual Clauses), if applicable.
9. Audit Rights
State what audit or documentation rights the customer has to verify compliance with this addendum.
10. Term & Deletion
State what happens to personal data on termination of the underlying agreement — deletion or return timeline, and any legal-hold exceptions.