Legal
Data Processing Agreement
How ResellerHQ processes the personal data resellers put into it, as their processor, and the protections it commits to.
This Data Processing Agreement ("DPA") is made up of this Cover Page and the Common Paper Data Processing Agreement Standard Terms, Version 1.1 ("Standard Terms"), published at commonpaper.com/standards/data-processing-agreement/1.1, which are incorporated by reference. If this Cover Page and the Standard Terms conflict, this Cover Page wins. Words with capitals that are not defined here have the meanings given in the Standard Terms.
How this DPA is accepted
This DPA forms part of the ResellerHQ Terms of Service. A reseller accepts it when it accepts the Terms of Service (by creating an account or using the service). A reseller that wants a countersigned copy can ask privacy@resellerhq.com.
Parties
| Provider (processor) | Customer (controller) | |
|---|---|---|
| Name | Enrich Labs LLC FZ, trading as ResellerHQ | The reseller that holds the ResellerHQ account |
| Address | 6th Floor, Meydan Grandstand, Meydan Hotel, Meydan, Dubai, United Arab Emirates | The billing address in the reseller's account |
| Contact for this DPA | privacy@resellerhq.com | The account owner's email address |
| Security contact | security@resellerhq.com | The account owner's email address |
Key terms
| Term | What we agree |
|---|---|
| Agreement | The ResellerHQ Terms of Service at resellerhq.com/terms |
| Applicable Data Protection Laws | Includes the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the GDPR, the UK GDPR and US state privacy laws such as the CCPA, wherever they apply to the Customer Personal Data |
| Approved Subprocessors | The subprocessors in the categories listed in Annex III. Their names are in a confidential schedule, which the Provider gives the Customer on request; the Customer keeps it confidential |
| New Subprocessors | At least 30 days' notice, by email to the account owner and by updating resellerhq.com/legal/subprocessors, before a new subprocessor receives Customer Personal Data. The Customer may object in writing within that period on reasonable data protection grounds |
| Security Policy | Annex II |
| Breach notification | Without undue delay, and no later than 48 hours after the Provider becomes aware of a Personal Data Breach affecting Customer Personal Data |
| Service Provider Relationship (CCPA) | The Provider is a service provider. It does not sell or share Customer Personal Data, and does not use it for any purpose other than providing the services |
| Restricted Transfers | The EU Standard Contractual Clauses, Module 2 (controller to processor) and Module 3 (processor to processor), and the UK Addendum, apply as set out in the Standard Terms |
| Governing Member State (EU SCCs only) | Ireland |
| Governing law and courts | The laws of the United Arab Emirates as applied in the Emirate of Dubai, and the courts of Dubai, as in the Agreement. The EU SCCs are governed as they themselves require |
| Audits | Once a year, on 30 days' written notice, answered first with written responses and Annex II. On-site audits only where the law requires one or after a Personal Data Breach, at the Customer's cost and under confidentiality |
| Return and deletion | The Customer can export its data from the dashboard and API at any time. The Provider deletes Customer Personal Data within 30 days of the Customer's written request or of the Customer deleting it in the dashboard, except where the law requires it to be kept. Copies in encrypted backups expire within 400 days and are never restored for any other purpose |
Annex I: description of the processing
A. Parties
- Data exporter (controller): the Customer, which resells domains, phone numbers and Google mailboxes to its own customers.
- Data importer (processor): the Provider, which runs the ResellerHQ platform described in the Agreement.
B. Description of the processing
| Item | Description |
|---|---|
| Categories of data subjects | The Customer's own customers and their staff; people named as domain contacts; users of the mailboxes the Customer orders; people who send SMS to, or call, numbers the Customer rents |
| Categories of personal data | Names; email addresses; postal addresses; phone numbers; organisation names; tax IDs; domain registrant, admin, tech and billing contacts; mailbox names, email addresses and sign-in details (password, app password, two-step verification secret); SMS sender numbers and message text, and call transcripts; order and invoice details |
| Sensitive data | None intended. The Customer must not send special-category data through ResellerHQ. The Provider does not inspect SMS or mailbox content, so the Customer is responsible for what its end users send |
| Frequency | Continuous, for as long as the Agreement lasts |
| Nature of the processing | Storing, organising and transmitting the data to the providers needed to fulfil an order (domain registrars and registries, the phone number provider, Google), and showing it to the Customer through the dashboard, the API and the assistants the Customer connects |
| Purpose | Providing the ResellerHQ services the Customer orders under the Agreement |
| Duration and retention | For the term of the Agreement, until the Customer asks for deletion, then as in "Return and deletion" above |
| Transfers to subprocessors | Only the data each subprocessor needs for its function, as described in Annex III |
C. Competent supervisory authority
For transfers under the EU SCCs, the supervisory authority of Ireland, unless the SCCs require another. For transfers under the UK Addendum, the UK Information Commissioner's Office.
Annex II: technical and organisational measures
The Provider maintains the measures below, and will not reduce their overall level during the term. A fuller description is available on request from security@resellerhq.com.
| Area | Measures |
|---|---|
| Encryption | HTTPS (TLS) on every public endpoint. Mailbox sign-in details and other secrets encrypted at rest with a key kept outside the database. Backups encrypted before they leave the database servers |
| Credentials | Passwords stored only as one-way hashes and checked against known breached passwords. API keys and tokens shown once and stored only as hashes |
| Access control | Every record belongs to one reseller account and every request is checked against it. Staff use a separate sign-in with mandatory two-step verification. Database servers reachable only with SSH keys, through a hardened entry server; server access limited to a few named people |
| Network | Database servers communicate over a private encrypted network, behind firewalls that deny all traffic by default |
| Availability | A three-node database cluster. Nightly full backups, each checked by a test restore, kept off-site with a second provider (daily copies 35 days, monthly copies 400 days) |
| Monitoring and logging | Uptime checks and alerts. Request logs and traces kept 15 days, and never containing request or response content from the API or assistant tools. An activity trail of every change in each account |
| Patching | Automatic security updates on database and infrastructure servers |
| People | Staff and contractors are bound by confidentiality. Access is removed when someone leaves |
| Incidents | A written breach procedure: contain, assess, notify affected Customers within 48 hours, notify authorities where required, and review |
| Subprocessors | Each is checked before use (data protection agreement, transfer mechanism, security) and bound by data protection terms no less protective than this DPA |
Annex III: subprocessors
| Category | What it does | Personal data it receives | Location |
|---|---|---|---|
| Cloud hosting provider | Runs the servers for the platform and its database | All Customer Personal Data, stored on servers the Provider operates | United States |
| Backup storage provider | Holds off-site copies of database backups | Encrypted files only; the provider cannot read them | United States |
| Hosts and sets up Google Workspace mailboxes | Mailbox users' names and email addresses, and the mailboxes themselves | United States and Google's global data centres | |
| Cloudflare | DNS for domains connected for mailboxes; bot protection on forms | Domain names and DNS records; visitors' IP address and browser signals | United States and Cloudflare's global network |
| Domain registrar | Registers and manages domain names | Domain names and their registrant, admin, tech and billing contacts | European Union |
| Phone number provider | Provides rented numbers and receives their SMS and calls | Rented numbers; sender numbers, message text and call transcripts | Hong Kong |
| Email delivery provider | Sends service emails (sign-up, receipts, alerts) | Recipient email addresses and email content | United States |
| Stripe | Card payments for wallet top-ups | The reseller's billing contact and payment details (held by Stripe) | United States |
| PostHog | Product analytics, only with consent | Usage events and masked session replays | United States |
Signature
For Enrich Labs LLC FZ: name, title, date (countersigned copies only).
Uses the Common Paper Data Processing Agreement Standard Terms Version 1.1, free to use under CC BY 4.0. This Cover Page is modified for ResellerHQ and is not itself a Common Paper standard.