Data Processing Addendum
Last updated: May 9, 2026
This Data Processing Addendum (the "DPA") supplements The Color Tools Terms of Service and applies whenever The Color Tools processes Personal Data on behalf of a Customer subject to GDPR, UK GDPR, CCPA, or similar data-protection law.
Need a counter-signed copy? Email legal@thecolortools.com with your company name, billing address, and signatory details. We'll return a counter-signed PDF within two business days.
1. Roles
Customer is the Data Controller. The Color Tools is the Data Processor. The Color Tools processes Personal Data only on documented instructions from Customer (the Terms of Service and Customer's use of the service).
2. Categories of data
Account data (email, name), workspace contents (palettes, brand kits, comments), uploaded reference images, billing data (handled by Stripe). The Color Tools does not knowingly process special-category data; do not upload it.
3. Sub-processors
The Color Tools uses the sub-processors listed at /security/sub-processors. We notify customers 30 days before any addition.
4. International transfers
Where Personal Data is transferred outside the EEA/UK/Switzerland, The Color Tools relies on the EU Standard Contractual Clauses (Module 2 — Controller to Processor) plus the UK International Data Transfer Addendum where applicable.
5. Security
The Color Tools implements appropriate technical and organizational measures consistent with our Security overview, including encryption in transit and at rest, access controls, backups, audit logging, and vulnerability management.
6. Subject rights
The Color Tools assists Customer in responding to data-subject access, correction, deletion, and portability requests. Customer can self-serve most requests via the user-facing /account/data-export and /account/danger-zone tools.
7. Breach notification
The Color Tools notifies Customer without undue delay (and in any event within 72 hours) of becoming aware of a Personal Data breach affecting Customer Data.
8. Audits
Customer may request audit reports (SOC 2 Type II once available) annually. On-site audits subject to mutual agreement and reasonable notice.
9. Deletion / return
On termination, The Color Tools deletes or returns Customer's Personal Data within 30 days (90 days for backups). Customer can self-serve via /account/data-export and /account/danger-zone.
10. Liability
Liability under this DPA is subject to the limitations in the Terms of Service.