Data Processing Addendum
This Data Processing Addendum ("DPA") is part of the Terms of Service between Design Master Solutions LLC ("we", "us", the processor) and the dealer or installer company that holds a Cabinet Project account ("you", the controller). It applies automatically when Cabinet Project processes personal data that is protected by the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, Brazil's LGPD, or similar laws. You do not need to sign anything; if your company needs a countersigned copy, write to info@designmastersolutions.com.
1. Roles
For the personal data of your clients, team and suppliers that you put into the Service ("Customer Personal Data"), you are the controller and we are your processor. For your own account, billing and website analytics, we are the controller, as described in the Privacy Policy.
2. What we process
- People: your clients (homeowners, contractors, builders), your team members, and contacts at your manufacturers and suppliers.
- Data: names, e-mail addresses, phone numbers, job site addresses, signatures and approvals given in the client portal, photos, files, messages, and the quotes, orders, deliveries, installs and invoices that mention them.
- Purpose and duration: only to provide the Service to you, for as long as your account is active and then until deletion under section 9. We do not process special categories of data on purpose; do not upload them.
3. Your instructions
We process Customer Personal Data only on your documented instructions: the Terms, this DPA and what you do in the Service. We do not sell it, use it for advertising, or use it to train AI models. If we believe an instruction breaks data protection law, we will tell you.
4. Confidentiality and security
Everyone at Design Master Solutions with access to Customer Personal Data is bound by confidentiality. We keep it secure with, among other measures: encryption in transit (HTTPS/TLS); hashed passwords; private file storage that is reached only through short-lived signed links; separation of every company's data; access by role inside each company; error monitoring; and daily encrypted database backups, kept for 35 days.
5. Subprocessors
You authorize the subprocessors listed in section 5 of the Privacy Policy: Railway, Amazon Web Services, Cloudflare, Resend, Sentry, Google, Apple, Stripe, Anthropic, Photon (komoot), the U.S. Census Bureau geocoder, and Intuit QuickBooks Online when you connect it. Each receives only what its job needs and is bound by data protection terms at least as protective as this DPA. We tell account holders by e-mail at least 30 days before adding or replacing a subprocessor; if you object on reasonable data protection grounds and we cannot address it, you may cancel and receive a refund of the prepaid fees for the remaining term. AI assistants you connect yourself (such as ChatGPT or Claude) act on your behalf under their own terms and are not our subprocessors.
6. International transfers
The Service is run from the United States. Transfers of Customer Personal Data from the European Economic Area or Switzerland are made under the Standard Contractual Clauses approved by the European Commission (Decision 2021/914, Module 2, controller to processor), and from the United Kingdom under the UK International Data Transfer Addendum to those clauses, which are incorporated into this DPA by reference. For those clauses: Ireland's law and courts apply where a choice is needed, the optional docking clause applies, subprocessors follow section 5 above, and the details in sections 2 and 4 of this DPA complete the annexes. Transfers from Brazil rely on the standard contractual clauses of the ANPD where the LGPD requires them.
7. Helping you
We help you answer requests from people who want to see, correct, export or delete their data; most of it you can do yourself in the app, and we do the rest on request. We also give you the information you reasonably need for a data protection impact assessment or a regulator's question. If a person or a regulator contacts us directly about Customer Personal Data, we send them to you.
8. Personal data breaches
If we confirm a breach affecting Customer Personal Data, we notify you without undue delay and within 72 hours, with what happened, the data and people affected, and what we are doing about it, so you can meet your own duties.
9. Deletion and return
You can export your data at any time on request. After you cancel, we keep it for 90 days so you can come back or ask for an export, then delete it; backups are overwritten within 35 days after deletion. Ask us and we delete sooner.
10. Audits
We answer your reasonable written questions about our compliance with this DPA, once a year or after a breach, at no cost. Where the law requires an audit beyond that, we agree its scope, timing and confidentiality with you in advance.
11. Order of precedence
If this DPA and the Terms disagree about personal data, this DPA wins; if the Standard Contractual Clauses apply and disagree with this DPA, the clauses win. Liability under this DPA follows the limits in the Terms, except where the law does not allow them.
12. Contact
Design Master Solutions LLC, Yarmouth, MA 02664, United States. E-mail: info@designmastersolutions.com.