Data Processing Agreement

How personal data inside a client’s systems is handled during YeevuFix work, and which company is responsible for it.

1. Parties and roles

This Data Processing Agreement (“DPA”) forms part of the Terms of Service. The client is the controller of the personal data inside its own systems, such as mailboxes, contact lists, marketing platforms, websites and DNS zones. Yeevu LLC (Wyoming Secretary of State filing ID 2025-001686358), 30 N Gould St Ste R, Sheridan, WY 82801, USA, trading as YeevuFix, is the processor, including for engagements placed through a marketplace.

2. Subject matter, nature and duration

Yeevu LLC processes personal data only to deliver the engagement described in the written scope: email, website, DNS, hosting, SEO and automation work. The personal data concerned is typically names, email addresses, message content and metadata, and contact records relating to the client’s staff, customers and contacts. Processing lasts for the engagement and ends when working data is deleted under section 8.

3. Processing on documented instructions

Personal data is processed only on the client’s documented instructions, which are the written scope and any later instruction confirmed in writing, and for no other purpose. If an instruction appears to breach data protection law, the client is told before it is acted on.

4. Confidentiality of people

Everyone who works on the engagement is bound by confidentiality obligations at least as strict as the confidentiality section of the Terms.

5. Security measures

The measures on the Trust & security page apply: named, temporary, least-privilege access; multi-factor authentication on every account granted and every internal account; credentials held only in an encrypted password manager; disk-encrypted work devices; client work kept separate per engagement.

6. Sub-processors

A limited set of service providers is used, in these categories: hosting and cloud infrastructure, domain registrars and DNS providers, email infrastructure and deliverability tooling, and business tools such as password management and ticketing. The current named list is provided on request before an engagement starts. Each sub-processor is bound by data protection terms no less protective than this DPA, and Yeevu LLC remains responsible for it. The client is told before a new sub-processor handles its personal data and may object on reasonable grounds.

7. Personal data breaches

The client is notified within 24 hours of Yeevu LLC becoming aware of a personal data breach affecting its data, with what is known, what has been done and what is recommended, and is given cooperation with any notification it must make.

8. Deletion and return

Working data from an engagement, such as exports, screenshots, reports and diagnostic output, is deleted no more than 90 days after close, or returned first if the client asks, unless the law requires it to be kept. Credentials are not kept once the engagement ends.

9. Assistance, records and audits

Yeevu LLC helps the client respond to requests from individuals exercising their data protection rights, and with security, breach and impact assessment obligations, as far as the engagement’s processing is concerned, and answers reasonable audit questions in writing.

10. International transfers

Where personal data from the United Kingdom or the European Economic Area is processed outside it, the transfer is made under a recognised safeguard: the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, as applicable.

11. Signed copies

Organisations that need this DPA in signed form can request it through the contact page.