Data Processing Addendum

You (the client) decide why and how your customers' personal data is used, so you are the controller (or “business”). We process it only to provide our services to you, so we are the processor (or “service provider”).

• Process personal data only on your documented instructions and to provide the services
• Not sell your data or use it for our own purposes
• Make sure our staff and contractors are bound by confidentiality
• Use reasonable security measures, including access controls, strong passwords and two-factor sign-in where available, and least-privilege access
• Help you respond to people who ask to see, correct or delete their data
• Tell you without undue delay, and where possible within 72 hours, after we become aware of a breach affecting your data
• Delete or return your data when our services end, unless the law requires us to keep it
• Give you information reasonably needed to show we meet these commitments

You authorize us to use these providers, which are bound by their own data protection terms: HighLevel (CRM, messaging, websites and its own sub-processors), Google, Meta, ClickUp, and payment processors. We'll tell you about significant changes, and you can object for a reasonable reason.

You are responsible for having a lawful basis for the data you give us, including valid consent for email, text and calls (CAN-SPAM, TCPA, carrier rules, GDPR and similar laws), and for your own privacy policy.

We and most of our providers are in the United States. Where the law requires it, transfers of personal data from the EU, UK or Switzerland rely on the Standard Contractual Clauses or another approved mechanism.

To request a signed copy or ask a question: Email patrick@stopdoingnothing.com, text or call 405-217-4752, or write to StopDoingNothing LLC, 16606 N Western Avenue #1023, Edmond, OK 73013.

Contact page