Data Processing Agreement (DPA)

Last updated: July 11, 2025

This page provides the standard form of Balsam’s Data Processing Agreement (DPA) for Customers who purchase services from Balsam and require Balsam to process personal data on their behalf as a Data Processor. The DPA supplements and forms part of your Master Services Agreement or other written contract with Balsam.

Status

Public DPA coming soon

We are preparing our public DPA for self‑service execution. In the meantime, Customers may request the current DPA by emailing support@balsamapp.com. Our team will provide the appropriate version and instructions for execution.

Scope

The DPA governs Balsam’s processing of personal data on behalf of the Customer under applicable data protection laws (e.g., GDPR, UK GDPR, CCPA/CPRA where applicable). It describes the subject matter and duration of processing, the nature and purpose of processing, the types of personal data and categories of data subjects, and the obligations and rights of the Customer.

Security

Balsam implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including measures relating to confidentiality, integrity, availability, and resilience of processing systems. Details are provided in the DPA and accompanying security documentation upon request.

Sub-processors

Our use of sub-processors is governed by the DPA. A public list of current sub-processors will be available at /subprocessors.html. We will notify Customers of material changes in accordance with the DPA.

Data Subject Rights and Assistance

Balsam will assist Customers in fulfilling data subject requests where applicable and as described in the DPA.

Contact

To request a copy of the DPA or for questions about data processing, contact us at support@balsamapp.com.