Data Processing Addendum

1. What this addendum is

1.1This Data Processing Addendum (“DPA”) is between Spark Jar LLC, a Washington limited liability company (UBI 606 268 108), of which Sundry is a division (“Sundry”), and the firm that subscribes to Sundry (“the Firm”). It is part of the Subscription Agreement at /terms/ and is incorporated into it. If the DPA and the Subscription Agreement disagree about personal information or Firm Data, the DPA controls.

1.2“Firm Data” means everything the Firm, its users and its clients put into Sundry or connect to it, including client and company details, products, customers, transactions, exemption certificates, returns and worksheets, and anything Sundry produces from them for the Firm. Information Sundry collects through its own website is covered by the Website Privacy Notice, not by this DPA.

2. Roles

2.1For Firm Data, the Firm decides why and how it is used, and Sundry acts as the Firm’s service provider and processor. The Firm remains responsible for its clients, for what it files and for its own compliance obligations.

2.2Sundry is a software provider. It does not hold or move client funds, and it is not a financial institution. If that ever changes, Sundry will tell the Firm and meet the obligations that follow.

3. The Firm’s instructions

3.1Sundry uses Firm Data only to provide the service to the Firm, as the Subscription Agreement, this DPA and the Firm’s use of the app instruct. Those are the Firm’s complete instructions. If Sundry believes an instruction breaks the law, it will say so, and it may pause carrying it out until the issue is resolved.

3.2Where the law requires Sundry to use Firm Data in another way, Sundry will tell the Firm first unless the law forbids it.

4. Confidentiality

4.1Sundry treats Firm Data as confidential. It gives access only to people who need it to provide or secure the service, and each of them is bound by a duty of confidentiality that continues after they stop working for Sundry.

5. Security and the Safeguards Rule

5.1Sundry’s safeguards are a short set that it can stand behind.

• Firm Data is encrypted in transit, and at rest through Sundry’s providers.
• Access in the Sundry app is limited by each user’s role in the firm.
• Firm Data is hosted in the United States.
• Sundry runs a census audit on every return. It checks for exposed or outdated credentials, access permissions and database access rules, and tracks each finding until it is fixed. A finding that affects Firm Data is handled as section 10 says.
• Breaches are notified as section 10 says.

5.2Tax preparation firms are covered by the FTC Safeguards Rule, and the Rule requires a firm to oversee its service providers (16 CFR 314.4(f)). As the Firm’s service provider, Sundry commits to the following.

• It will keep safeguards that fit the service and the sensitivity of Firm Data, as described above.
• It will answer the Firm’s reasonable written questions about those safeguards, as section 13 says.
• It will tell the Firm of a breach in the time section 10 sets.
• It will return or delete Firm Data at the end, as section 12 says.

5.3The written information security plan is the Firm’s own. Sundry’s safeguards are meant to fit inside it.

6. California service-provider terms

6.1To the extent the California Consumer Privacy Act applies to Firm Data, Sundry agrees that it:

• will not sell or share Firm Data that is personal information;
• will not retain, use or disclose it for any purpose other than the business purposes in this DPA and the Subscription Agreement, or outside its direct business relationship with the Firm;
• will not combine it with personal information from another source, except as the law allows a service provider to do;
• will give the same level of privacy protection the law requires of the Firm;
• will tell the Firm if it can no longer meet these obligations, and the Firm may then take reasonable steps to stop and fix any unauthorized use; and
• will let the Firm take reasonable steps to confirm that Sundry uses the information consistently with the Firm’s obligations.

7. United States only

7.1Sundry processes and stores Firm Data in the United States only, and so do its providers. It will not move Firm Data outside the United States without the notice in section 8.

8. Providers

8.1The Firm authorizes Sundry to use service providers to deliver the service. The categories of providers, the data each touches and where they operate are listed at /subprocessors/. Sundry binds each provider by contract to protect Firm Data to the standard of this DPA and is responsible for what its providers do with it.

8.2Sundry will give the Firm at least 30 days’ notice before it adds a new category of provider that touches Firm Data, and before it moves any provider’s handling of Firm Data outside the United States. Notice goes to the Firm’s account contact and is posted on that page. The Firm may object in writing within that time. If the objection is reasonable and the parties cannot resolve it, the Firm may cancel the affected service and the cancellation will take effect without further charge for it.

9. AI and training

9.1Sundry uses AI agents, including Sal, in the service. They work on Firm Data only to provide the service to the Firm.

9.2Sundry does not use Firm Data to train AI models, and its providers are contractually barred from doing so.

10. Breach notice

10.1If Sundry learns that Firm Data was accessed, disclosed, lost or altered without authorization, it will tell the Firm without undue delay and within 72 hours of learning of it. The notice will say what happened, what Firm Data was involved, what Sundry is doing about it, and who to contact, and Sundry will add detail as it learns it.

10.2Sundry will cooperate with the Firm so that the Firm can meet any notice duty it has to its clients and to regulators. Unless the law requires otherwise, the Firm decides whether and how to notify its own clients.

11. Help with requests

11.1If a person asks Sundry about Firm Data that concerns them, Sundry will send them to the Firm and will not answer on the Firm’s behalf unless the Firm asks it to. Sundry will give the Firm reasonable help to answer access, correction, deletion and similar requests, and the help is part of the service unless it takes unusual effort.

12. Return or deletion at the end

12.1When the Subscription Agreement ends, the Firm can export for 60 days; Sundry then deletes within a further 30 days; backups are overwritten in the providers’ ordinary cycle. The Firm may ask Sundry in writing to delete sooner.

12.2Sundry may keep what the law requires it to keep, such as its own billing records, and will go on protecting it under this DPA.

13. Audit by questionnaire

13.1Once a year, and after a breach, the Firm may send Sundry a reasonable written security questionnaire. Sundry will answer it accurately within 30 days. This is the Firm’s means of checking Sundry’s compliance with this DPA. It does not include on-site inspection or access to systems that hold other customers’ data.

14. Term, notices and contact

14.1This DPA lasts as long as Sundry holds Firm Data. Sections that by their nature should continue, such as confidentiality, continue until the Firm Data is deleted.

14.2Notices to Sundry, a division of Spark Jar LLC, go to contact@sundry.tax.