Data processing addendum
Last updated 2026-09-23
This Data processing addendum ("DPA") is part of the Terms of service between CompSlate and the customer that uses a CompSlate workspace ("Customer"). It applies whenever CompSlate processes personal data on Customer's behalf. It is incorporated into the Terms automatically; no signature is needed. If you'd like a countersigned copy for your records, email legal@compslate.com. Words defined in the Terms mean the same here.
1. Roles
For personal data in Customer Data, Customer is the controller and the "business", and CompSlate is the processor and a "service provider" and "contractor", as those terms are used in the California Consumer Privacy Act as amended (the "CCPA") and other US state privacy laws ("Data Protection Laws").
2. Details of the processing
- Subject matter: providing the CompSlate service, which calculates variable pay and shows the results to the people Customer chooses.
- Duration: for the term of the Terms, plus the deletion period in section 10.
- Nature: collecting, storing, organizing, calculating, displaying, exporting, transmitting and deleting data, through the web app and the AI-assistant tools Customer connects.
- Purpose: providing, securing and supporting the Service for Customer, as described in the Terms (the "Business Purpose").
- Categories of data subjects: Customer's employees and contractors whose compensation is managed in the Service, and Customer's workspace admins and other Users.
- Categories of personal data: names, work email addresses, job titles, roles and reporting lines; compensation terms (plans, OTE, base, quota and pay components); deals and bookings; calculated payouts and payments; and the activity log of who changed what, when and how. Customer should not enter sensitive data such as government ID numbers, bank or card numbers, or health information.
3. Customer's instructions
CompSlate processes personal data only on Customer's documented instructions. The Terms, this DPA, and Customer's use and configuration of the Service (including instructions given through an AI assistant Customer connects) are Customer's complete instructions. CompSlate will tell Customer if it believes an instruction breaks Data Protection Laws, unless the law prohibits it. Customer is responsible for the lawfulness of the personal data it provides and of its instructions, including any notices and consents its people are owed.
4. CCPA service-provider terms
CompSlate will not:
- sell or share (for cross-context behavioral advertising) Customer's personal data;
- retain, use or disclose it for any purpose other than the Business Purpose, including any commercial purpose, or outside the direct business relationship with Customer;
- combine it with personal data CompSlate receives from or on behalf of anyone else, or collects from its own interactions with individuals, except as the CCPA permits for a service provider.
CompSlate will comply with the obligations of the CCPA that apply to it, provide the same level of privacy protection the CCPA requires, and notify Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and remediate unauthorized use of its personal data, including by contacting legal@compslate.com. CompSlate certifies that it understands and will comply with these restrictions.
5. Confidentiality of personnel
CompSlate allows only personnel who need access to operate or support the Service to access personal data, and only as needed. Everyone with access is bound by a duty of confidentiality.
6. Security
CompSlate maintains technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. The current measures are described on our Security page. CompSlate may update them, as long as the update doesn't materially reduce the overall protection of personal data.
7. Subprocessors
Customer authorizes CompSlate to use the subprocessors listed on our Subprocessors page. CompSlate has written agreements with its subprocessors that protect personal data at least as well as this DPA, and remains responsible for their performance. CompSlate will email Customer's workspace admins at least 30 days before adding or replacing a subprocessor. Customer may object on reasonable data protection grounds by emailing legal@compslate.com within that period; the parties will discuss the concern in good faith, and if it can't be resolved, Customer may terminate the affected Service and CompSlate will refund any fees prepaid for the period after termination.
The AI assistant provider Customer connects (for example Anthropic or OpenAI) is chosen and contracted by Customer and is not CompSlate's subprocessor.
8. Data subject requests
Admins can view, correct, export and delete most personal data themselves in the Service. If CompSlate receives a request from a data subject about Customer's personal data, it will pass it to Customer without undue delay and won't respond directly except to redirect the person, unless Customer asks it to or the law requires. Taking into account the nature of the processing, CompSlate will provide reasonable help for Customer to respond to requests to exercise rights under Data Protection Laws.
9. Security breaches
CompSlate will notify Customer without undue delay, and in any case within 72 hours, after confirming a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer's personal data. The notice will go to Customer's workspace admins and describe, as far as then known, what happened, the data and people affected, and what CompSlate is doing about it, with updates as more is learned. CompSlate will take reasonable steps to contain and remedy the breach and will reasonably help Customer meet its own notification obligations. Notifying Customer is not an admission of fault.
10. Deletion and return
Admins can export Customer Data at any time. When the Terms end, Customer has 30 days to export its data or ask CompSlate for an export; after that, CompSlate deletes Customer's personal data from the Service, and copies in database backups roll off within a further 35 days, unless the law requires CompSlate to keep it.
11. Information and audits
On reasonable written request, no more than once a year (or more often if required by a regulator or after a security breach), CompSlate will provide the information reasonably needed to show compliance with this DPA. Customer will first send a written questionnaire, which CompSlate will answer. If the answers don't reasonably address Customer's concern, the parties will agree on further steps, such as a call or a review of relevant documents, at a mutually agreed time and scope, subject to confidentiality and at Customer's expense. CompSlate holds no third-party certifications today.
12. Data location
CompSlate stores Customer Data in the United States, in Amazon Web Services' us-east-1 (N. Virginia) region. Subprocessors may process limited data elsewhere as described on the Subprocessors page.
13. Liability and order of precedence
Each party's liability under this DPA is subject to the limitations in the Terms. If this DPA conflicts with the Terms about the processing of personal data, this DPA controls. A separate signed agreement between Customer and CompSlate controls over both, to the extent it says so.