Legal Policies

This Data Processing Agreement (DPA) governs the processing of personal data by HomeBase CRM, Inc. on behalf of its customers. It forms part of the Terms of Service and applies when Customer processes personal data subject to GDPR, CCPA, or similar data protection laws.

ARTICLE 1 — DEFINITIONS

1.1 Data Protection Laws. "Data Protection Laws" means all laws and regulations applicable to the processing of personal data under this DPA, including GDPR, UK GDPR, CCPA, CPRA, and other applicable privacy laws.

1.2 GDPR Terms. Terms used but not defined herein have the meanings in the GDPR: "Controller," "Processor," "Data Subject," "Personal Data," "Processing," "Supervisory Authority," "Standard Contractual Clauses."

1.3 Roles. For purposes of this DPA: (a) Customer is the Controller; (b) HomeBase is the Processor. If HomeBase processes personal data as a Controller, this DPA does not apply to such Processing.

ARTICLE 2 — SCOPE AND PURPOSE

2.1 Scope. This DPA applies to all Processing of Personal Data by HomeBase on behalf of Customer under the Terms of Service.

2.2 Purpose. HomeBase shall Process Personal Data only on documented instructions from Customer, including for: (a) providing the CRM Platform; (b) storing and managing contact, lead, and transaction data; (c) facilitating communications; (d) providing support; (e) security and fraud prevention; (f) as required by law.

2.3 Instruction Changes. Customer may provide additional or alternative instructions via written request. HomeBase may comply only if technically feasible and commercially reasonable. Additional costs will be communicated in advance.

ARTICLE 3 — PROCESSOR OBLIGATIONS

3.1 Compliance. HomeBase shall: (a) process Personal Data only in accordance with this DPA; (b) ensure personnel are committed to confidentiality; (c) implement appropriate security measures; (d) assist Customer with Data Subject requests; (e) support Customer with compliance obligations.

3.2 Subprocessors. HomeBase may engage subprocessors with Customer prior written consent (general authorization granted herein). HomeBase maintains a list of subprocessors at homebase.app/subprocessors with 30 days notice of changes. Customer may object within 14 days.

3.3 Subprocessor Obligations. HomeBase shall ensure subprocessors are bound by written agreements with data protection obligations no less protective than this DPA.

3.4 Liability. HomeBase remains fully liable for subprocessor compliance and any breaches caused by subprocessors.

ARTICLE 4 — INTERNATIONAL TRANSFERS

4.1 Transfer Mechanisms. For transfers of Personal Data from the EEA, UK, or Switzerland to third countries without adequacy decisions, HomeBase shall ensure appropriate safeguards:

• EU-U.S. Data Privacy Framework: HomeBase certification under the DPF
• Standard Contractual Clauses: EU Commission-approved SCCs (2021/914)
• UK Addendum: ICO-approved addendum for UK transfers

4.2 Transfer Impact Assessments. HomeBase shall provide reasonable assistance with transfer impact assessments and supplementary measures.

4.3 Government Access. HomeBase shall notify Customer of any government requests for Personal Data and challenge such requests where legally permissible.

ARTICLE 5 — DATA SUBJECT RIGHTS

5.1 Assistance. HomeBase shall provide reasonable assistance to Customer in fulfilling Data Subject requests (access, rectification, erasure, restriction, portability, objection).

5.2 Response Time. HomeBase shall respond to Customer requests within 14 days, with technical and organizational measures to enable Customer compliance.

5.3 Fees. Customer is responsible for costs associated with Data Subject requests, except for HomeBase standard self-service tools.

ARTICLE 6 — SECURITY MEASURES

6.1 Technical Measures. HomeBase implements:

• Encryption: AES-256 at rest, TLS 1.3 in transit
• Access controls: RBAC, MFA, least privilege
• Network security: firewalls, IDS/IPS, DDoS protection
• Monitoring: 24/7 SIEM, log retention, anomaly detection
• Testing: quarterly vulnerability scans, annual penetration tests

6.2 Organizational Measures. HomeBase maintains:

• Security policies and procedures
• Employee training and confidentiality agreements
• Incident response plan and business continuity
• Regular security assessments and audits
• SOC 2 Type II compliance

6.3 Updates. HomeBase may update security measures as needed, maintaining equivalent or improved protection levels.

ARTICLE 7 — DATA BREACH NOTIFICATION

7.1 Notification. HomeBase shall notify Customer without undue delay (within 72 hours) after becoming aware of a Personal Data breach.

7.2 Content. Notification shall include: (a) nature of the breach; (b) categories and approximate number of Data Subjects affected; (c) likely consequences; (d) measures taken or proposed.

7.3 Cooperation. HomeBase shall cooperate with Customer investigation and remediation, providing additional information as reasonably requested.

7.4 Customer Obligations. Customer is responsible for notifying Supervisory Authorities and Data Subjects, with HomeBase reasonable assistance.

ARTICLE 8 — AUDIT AND COMPLIANCE

8.1 Documentation. HomeBase shall maintain documentation of Processing activities and make available to Customer upon request.

8.2 Audits. Customer may audit HomeBase compliance once annually with 30 days notice, during normal business hours, without unreasonable disruption.

8.3 Third-Party Reports. HomeBase may provide third-party audit reports (SOC 2, ISO 27001) in lieu of direct audits, under NDA.

8.4 Remediation. HomeBase shall remediate identified compliance gaps within 90 days and provide written confirmation.

ARTICLE 9 — DATA RETENTION AND DELETION

9.1 Retention. HomeBase shall retain Personal Data only as long as necessary for the purposes or as required by law.

9.2 Deletion. Upon termination or Customer request, HomeBase shall delete or return all Personal Data within 90 days, except as required by law.

9.3 Backup Data. Backup copies are retained for 90 days then permanently deleted. HomeBase shall ensure backups are inaccessible for routine Processing.

9.4 Certification. HomeBase shall provide written certification of deletion upon request.

ARTICLE 10 — CCPA/CPRA COMPLIANCE

10.1 Service Provider. For CCPA/CPRA purposes, HomeBase is a "Service Provider" and shall not: (a) sell or share Personal Data; (b) retain, use, or disclose Personal Data outside the business relationship; (c) combine with data from other sources (with limited exceptions).

10.2 Certification. HomeBase certifies it understands CCPA/CPRA restrictions and will comply.

10.3 Consumer Requests. HomeBase shall assist Customer with consumer requests (know, delete, correct, opt-out).

ARTICLE 11 — TERMINATION

11.1 Termination for Cause. Either party may terminate this DPA if the other materially breaches data protection obligations and fails to cure within 30 days.

11.2 Effect. Termination of the Terms of Service terminates this DPA. Article 9 (deletion) survives termination.

ARTICLE 12 — GENERAL PROVISIONS

12.1 Supersession. This DPA supersedes prior data processing agreements. In conflict with Terms of Service, this DPA controls for data protection matters.

12.2 Amendments. Amendments must be in writing, except HomeBase may update subprocessor list per Article 3.2.

12.3 Governing Law. This DPA is governed by the laws applicable to the Terms of Service.

© 2026 HomeBase CRM, Inc. All rights reserved.