Data Processing Agreement | YESCO Management Solutions

This Data Processing Agreement (“DPA”) is entered into by and between YESCO Franchising LLC dba YESCO Management Solutions and its affiliates (“YESCO”) and the Client. This DPA forms part of, and is incorporated by reference into, the Terms and Conditions between the parties (the “Terms and Conditions,” and together with this DPA, the Data Processing Agreement, the registration form or order, the transaction forms, and any document expressly incorporated by reference, the “Agreement”). Capitalized terms used but not defined in this DPA have the meanings given to them in the Terms and Conditions.

This DPA governs YESCO's Processing of Personal Data contained within Customer Data on behalf of the Client in connection with the Services. As set out in the Terms and Conditions, this DPA is incorporated into and forms part of the Agreement. In the event of a conflict between this DPA and any other part of the Agreement with respect to the Processing of Personal Data within Customer Data, this DPA controls, consistent with the order of precedence stated in the Terms and Conditions.

1. Definitions

Capitalized terms have the meanings set out below or, if not defined here, in the Terms and Conditions.

“Applicable Privacy Laws”means all data protection and privacy laws applicable to the Processing of Personal Data under this DPA, including, as applicable, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), the Utah Consumer Privacy Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and other US state privacy laws, and the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable Canadian provincial privacy laws.
“Customer Data” means information the Client and its Authorized Users submit to, or generate within, the Platform, as defined in the Terms and Conditions.
“Personal Data”means information within Customer Data that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, and that is Processed by YESCO on behalf of the Client under this DPA. “Personal information” under Applicable Privacy Laws is treated as Personal Data for purposes of this DPA.
“Processing” (and “Process”) means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, storage, access, use, disclosure, transmission, and deletion.
“Controller”(or “Business” under CCPA/CPRA) means the party that determines the purposes and means of the Processing of Personal Data. “Processor”(or “Service Provider” under CCPA/CPRA) means a party that Processes Personal Data on behalf of, and under the instructions of, the Controller.
“Subprocessor”means a third party engaged by YESCO to Process Personal Data on YESCO's behalf in connection with providing the Services.
“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or unauthorized access to, Personal Data Processed by YESCO under this DPA.
“Sell,” “Share,” “Deidentified,” and other terms used in connection with US state privacy laws have the meanings given to them under the CCPA/CPRA and analogous Applicable Privacy Laws.

2. Roles of the Parties

With respect to the Processing of Personal Data within Customer Data, the Client is the Controller (Business) and YESCO is the Processor (Service Provider). This includes the roster of Authorized Users that the Client's administrator provisions (such as name, business email address, organization, and job title or role) and the content generated in the Programs (such as projections, plans, tasks, notes, and reference materials). YESCO Processes this Personal Data on the Client's behalf and under its documented instructions.

Separately, and outside the scope of this DPA, YESCO acts as a Controller (Business) in its own right for a limited set of information for which it determines the purposes and means, including account authentication and security (such as login credentials and security logs), billing and payment contact and payment information, service and transactional communications, fraud prevention and misuse detection, operation and security of the Website (including visitor analytics), and compliance with its legal obligations. YESCO's Processing of that information is governed by the YESCO Management Solutions Privacy Policy, not by this DPA.

3. Scope and Details of the Processing

The subject matter, duration, nature and purpose of the Processing, the types of Personal Data, and the categories of data subjects are described in Annex 1 (Details of the Processing). YESCO will Process Personal Data only for the duration of the Agreement and as necessary to provide and support the Services, except where retention is required by Applicable Privacy Laws or permitted under Section 12 (Return and Deletion).

4. YESCO's Processing Obligations

Documented instructions.YESCO will Process Personal Data only on the Client's documented instructions, which consist of the Agreement, the Client's and its Authorized Users' configuration and use of the Services, and any additional written instructions agreed by the parties. If YESCO believes an instruction violates Applicable Privacy Laws, it will inform the Client, unless prohibited by law.
Purpose limitation. YESCO will not Process Personal Data for any purpose other than performing its obligations under the Agreement and as permitted by this DPA and Applicable Privacy Laws.
Confidentiality. YESCO will ensure that personnel authorized to Process Personal Data are bound by appropriate obligations of confidentiality and are granted access on a need-to-know, least-privilege basis.
Cooperation.Taking into account the nature of the Processing and the information available to it, YESCO will provide reasonable cooperation and assistance to the Client in meeting the Client's obligations under Applicable Privacy Laws.

5. Service Provider / Processor Commitments (US State Privacy Laws)

To the extent YESCO Processes Personal Data subject to the CCPA/CPRA or analogous US state privacy laws as a Service Provider or Processor, YESCO will:

Process Personal Data solely to perform the Services (the business purpose) under the Agreement, or as otherwise permitted by Applicable Privacy Laws;
not Sell or Share Personal Data;
not retain, use, or disclose Personal Data for any purpose other than for the business purposes specified in the Agreement, including outside the direct business relationship between the parties, except as permitted by Applicable Privacy Laws;
not combine Personal Data received under the Agreement with personal information it receives from, or on behalf of, any other person, or collects from its own interaction with any individual, except as permitted for a Service Provider under Applicable Privacy Laws;
provide the same level of privacy protection as is required of the Client (Business) by Applicable Privacy Laws, and comply with the applicable obligations under those laws;
notify the Client promptly if it determines it can no longer meet its obligations under Applicable Privacy Laws, in which case the Client may take reasonable and appropriate steps to stop and remediate unauthorized Processing; and
enable the Client to monitor YESCO's compliance through the audit mechanism in Section 14.

YESCO certifies that it understands the restrictions set out in this Section 5 and will comply with them.

6. Subprocessors

The Client provides a general authorization for YESCO to engage the Subprocessors listed in Annex 3 (Approved Subprocessors) to Process Personal Data in connection with the Services.

Flow-down. YESCO will impose on each Subprocessor, by written contract, data protection obligations that are substantially the same as, and no less protective than, those in this DPA, to the extent applicable to the services the Subprocessor provides.
Liability. YESCO remains responsible for the acts and omissions of its Subprocessors to the same extent YESCO would be liable if performing the services of each Subprocessor directly under this DPA.
Changes. YESCO may add or replace Subprocessors. YESCO will provide the Client with notice (which may be by email or by posting an updated list) before a new Subprocessor begins Processing Personal Data. The Client may object on reasonable data-protection grounds within a reasonable period after notice. If the parties cannot resolve the objection, the Client may, as its sole remedy, terminate the affected Services.

7. Data Subject and Consumer Rights Requests

Taking into account the nature of the Processing, YESCO will provide reasonable assistance to the Client, through appropriate technical and organizational measures, to help the Client respond to requests from individuals to exercise their rights under Applicable Privacy Laws (such as access, correction, deletion, and portability).

If YESCO receives a request directly from an Authorized User or other individual whose Personal Data was provided to the Platform by the Client, YESCO will not respond to the request other than to direct the individual to the Client, unless legally required to respond or otherwise instructed by the Client. YESCO will, where permitted, promptly inform the Client of the request.

8. Assistance with Security, Breach, and Assessments

Taking into account the nature of the Processing and the information available to it, YESCO will provide reasonable assistance to the Client with the Client's obligations relating to the security of Processing, notification of Personal Data Breaches, and any data protection assessments or risk assessments the Client is required to conduct under Applicable Privacy Laws.

9. Security Measures

YESCO will implement and maintain appropriate technical and organizational measures designed to protect Personal Data against a Personal Data Breach, as described in Annex 2 (Technical and Organizational Security Measures). These measures include encryption in transit (TLS) and at rest, logical tenant isolation (row-level security), access controls on a least-privilege basis, and monitoring. YESCO may update its security measures from time to time, provided the updates do not materially reduce the overall level of protection for Personal Data.

10. Personal Data Breach Notification

YESCO will notify the Client without undue delay after becoming aware of a Personal Data Breach affecting Personal Data Processed under this DPA. The notification will include, to the extent then known and reasonably available, the nature of the breach, the categories and approximate number of individuals and records affected, the likely consequences, and the measures taken or proposed to address it. YESCO will take reasonable steps to mitigate and remediate the breach and will provide the Client with information reasonably necessary for the Client to meet its own notification obligations. YESCO's notification is not, and will not be construed as, an acknowledgment of fault or liability.

11. Cross-Border Processing

YESCO stores and Processes Personal Data in the United States. The Services are provided to Clients and Authorized Users in the United States and Canada. Where Personal Data originates in Canada, the Client remains accountable under PIPEDA and applicable provincial laws for the protection of that Personal Data when it is transferred to YESCO, and YESCO will maintain a comparable level of protection through the commitments in this DPA. This DPA is scoped to Processing subject to US and Canadian Applicable Privacy Laws; if the parties later require the Services for data subjects in other jurisdictions (such as the European Union or the United Kingdom), the parties will negotiate and execute additional terms and transfer mechanisms as required by the relevant laws.

12. Return and Deletion of Customer Data

On termination or expiration of the Client's subscription, the Client may request its Customer Data (including Personal Data) for up to thirty (30) days from the termination date, and YESCO will promptly provide it in a commercially reasonable format. After the thirty (30) day period, YESCO may delete the Customer Data, subject to this DPA and any retention required by Applicable Privacy Laws. Upon the Client's written request, and to the extent reasonably feasible, YESCO will certify in writing that it has deleted the Customer Data. This Section 12 is consistent with the return and deletion terms in the Customer Data and Privacy section of the Terms and Conditions.

13. Aggregated and Deidentified Data

YESCO may create and use aggregated or deidentified data derived from Customer Data that does not identify the Client or any individual, in order to operate, analyze, improve, secure, and promote the Services. YESCO will maintain and use such data in a deidentified form, will not attempt to reidentify it except as permitted to assess whether the deidentification is sufficient, and will handle it in accordance with Applicable Privacy Laws.

14. Records and Audits

YESCO will make available to the Client information reasonably necessary to demonstrate compliance with this DPA. Upon reasonable prior written notice, and no more than once per twelve (12) month period (unless required by a supervisory authority or Applicable Privacy Laws, or following a Personal Data Breach), YESCO will allow for and cooperate with reasonable audits or assessments of its Processing, conducted by the Client or an independent auditor bound by confidentiality. Audits will be conducted during normal business hours, will be subject to YESCO's reasonable security and confidentiality requirements, will not unreasonably interfere with YESCO's operations, and will be at the Client's expense. YESCO may satisfy its obligations under this Section by providing relevant third-party audit reports, certifications, or summaries of its subprocessors' controls where available.

15. Prohibited and Sensitive Data; Children

The Services are not designed to Process special categories of data or highly sensitive personal information. The Client will not, and will ensure its Authorized Users do not, submit to the Platform (i) data concerning health or protected health information under HIPAA, which YESCO does not accept under any circumstances and which may not be authorized under any Regulatory Addendum; or (ii) any other special or sensitive categories of Personal Data (such as government identification numbers, financial account or payment card numbers other than through YESCO's designated billing process, precise geolocation, or biometric data), except to the extent expressly authorized under an executed Regulatory Addendum (Section 16). The Platform is not directed to, and the Client will not knowingly submit Personal Data of, children under the age of thirteen (13), consistent with the YESCO Management Solutions Privacy Policy. The Client is responsible for the lawfulness of the Personal Data it submits and for having an appropriate legal basis for the Processing instructed under this DPA.

16. Regulatory Addenda

Baseline.Section 15 (Prohibited and Sensitive Data; Children) provides that the Client will not submit to the Platform special or sensitive categories of Personal Data, or Personal Data subject to sector-specific privacy or data-protection regimes, except as expressly authorized in writing. A “Regulatory Addendum” is such a written agreement: a supplemental, regime-specific set of terms executed by both parties that authorizes and governs YESCO's Processing of a defined category of Personal Data subject to a specified law or regulatory regime (for example, an addendum addressing “education records” under the Family Educational Rights and Privacy Act (“FERPA”)).
Protected health information excluded.The Regulatory Addenda mechanism does not extend to, and YESCO will not enter into a Regulatory Addendum or any other arrangement authorizing, the Processing of protected health information (“PHI”) as defined under the Health Insurance Portability and Accountability Act (“HIPAA”). YESCO does not act, and will not agree to act, as a “business associate” under HIPAA. PHI and data concerning health remain prohibited under Section 15 and must not be submitted to the Platform under any circumstances.
Execution and scope.A Regulatory Addendum takes effect only when executed in writing by both parties. Notwithstanding the Amendments provision of Section 20 of this DPA and the corresponding provision of the Terms and Conditions, YESCO may not bring a Client within a Regulatory Addendum, or subject a Client's Personal Data to a sector-specific regime, by posting a revised version or by unilateral notice. Each Regulatory Addendum applies only to the Client that executes it, and only to the category of Personal Data and the regime expressly identified in it. Personal Data and Processing not within the scope of an executed Regulatory Addendum remain governed by this DPA and continue to be subject to the restrictions in Section 15.
Precedence. For the category of Personal Data and the regime that an executed Regulatory Addendum covers, that Regulatory Addendum controls over this DPA and the Terms and Conditions to the extent of any conflict. In all other respects this DPA and the Terms and Conditions remain in full force and effect, and this DPA continues to control (as provided in Section 20 and the Terms and Conditions) as to the Processing of all Personal Data not within the scope of a Regulatory Addendum.
Subprocessors. Where a Regulatory Addendum requires it, YESCO will engage, for the Processing of the Personal Data it covers, only Subprocessors that have entered into a corresponding written agreement with YESCO providing the protections required by the applicable regime, and YESCO will impose the applicable flow-down obligations on those Subprocessors in accordance with Section 6 and the Regulatory Addendum. If YESCO cannot provide a required Subprocessor arrangement for a covered regime, YESCO may decline to make the affected Services available for the regulated Personal Data.
Operational conditions.YESCO may condition the availability of a Regulatory Addendum on the Client's use of a specified plan, configuration, or additional Services, and on the Client's compliance with the technical and operational requirements set out in the Regulatory Addendum. Except as expressly stated in an executed Regulatory Addendum, nothing in this Section expands the categories of Personal Data the Client is otherwise permitted to submit under Section 15.

17. Liability

Each party's liability arising out of or related to this DPA is subject to, and counts toward, the Limitation of Liability and related provisions in the Terms and Conditions, except to the extent Applicable Privacy Laws require otherwise.

18. Term, Termination, and Survival

This DPA takes effect on the Effective Date and remains in effect for as long as YESCO Processes Personal Data on behalf of the Client under the Agreement. Termination of this DPA does not affect the Agreement, and termination of the Agreement terminates this DPA. Provisions that by their nature are intended to survive — including those relating to confidentiality, return and deletion of Customer Data, aggregated and deidentified data, liability, and governing law — survive termination or expiration.

19. Governing Law and Dispute Resolution

This DPA is governed by, and disputes under it are resolved in accordance with, the Governing Law and Arbitration provisions of the Terms and Conditions, which specify the laws of the State of Utah and arbitration in Salt Lake City, Utah.

20. General

Order of precedence. This DPA is incorporated into and forms part of the Agreement. In case of conflict regarding the Processing of Personal Data, the order of precedence in the Terms and Conditions applies, under which this DPA controls as to the Processing of Personal Data — except that, for the category of Personal Data and the regime it covers, an executed Regulatory Addendum (Section 16) controls over this DPA and the Terms and Conditions to the extent of any conflict.
Amendments. YESCO may modify this DPA by posting a revised version and giving the Client notice at least thirty (30) days before the change takes effect at the start of the next renewal period, consistent with the Entire Agreement section of the Terms and Conditions. Otherwise, changes must be in writing and agreed by both parties.
Notices. Notices to YESCO under this DPA must be sent to managementsolutions@yesco.com, or to YESCO Management Solutions, 2401 S Foothill Dr., Salt Lake City, Utah 84109. Notices to the Client will be sent to the contact information in the Client's registration form or account.
Severability. If any provision of this DPA is held unenforceable, the remaining provisions remain in full force and effect.
No third-party beneficiaries. This DPA does not create any third-party beneficiary rights, except as expressly required by Applicable Privacy Laws.
Acceptance.The Client's acceptance of the Terms and Conditions, and continued use of the Services, constitutes acceptance of this DPA. This DPA may be accepted electronically.

Annex 1 — Details of the Processing

Controller (Business)	The Client (the registered organization).
Processor (Service Provider)	YESCO Franchising LLC dba YESCO Management Solutions and its affiliates.
Subject matter	Provision of the YESCO Management Solutions Platform, Programs, Coaching Sessions, and related support (the Services).
Duration	The term of the Agreement, plus the post-termination export and deletion periods described in Section 12.
Nature and purpose	Hosting, storing, transmitting, and otherwise Processing Personal Data as necessary to authenticate users; provide, operate, maintain, and support the Platform and Services; troubleshoot and develop features; provide Client support; secure the Services and detect and respond to fraud and misuse; and comply with legal obligations.
Categories of data subjects	The Client's Authorized Users (such as employees, managers, and other personnel the Client permits to access the Services), and individuals referenced within content the Client and its Authorized Users generate in the Programs.
Categories of Personal Data	Account and profile information (name, business email address, organization, job title or role, and login credentials); content entered or generated in the management Programs (projections, plans, tasks, notes, and reference materials); communications with YESCO (messages, support requests, and feedback); and usage and device data associated with an identifiable user.
Special categories of data	None intended. The Client is instructed not to submit special or sensitive categories of Personal Data (see Section 15).
Frequency of Processing	Continuous, for the duration of the Agreement.

Annex 2 — Technical and Organizational Security Measures

YESCO maintains technical and organizational measures designed to protect Personal Data, including the following. YESCO may update these measures provided the overall level of protection is not materially reduced.

Encryption

Encryption of Personal Data in transit using Transport Layer Security (TLS) / Secure Sockets Layer (SSL).
Encryption of Personal Data at rest.

Access control and tenant isolation

Logical isolation of each Client's tenant data using row-level security.
Access to Personal Data granted on a need-to-know, least-privilege basis, limited to personnel who require it to perform their role.
Authentication controls for access to accounts and administrative systems.

Operational and organizational measures

Monitoring of systems for security events and misuse.
Confidentiality obligations for personnel with access to Personal Data.
Use of reputable subprocessors under written data protection commitments (see Annex 3).
Storage of Personal Data in secure hosting environments with measures designed to prevent loss, misuse, and unauthorized access, disclosure, or modification.

No method of transmission or storage is completely secure, and YESCO cannot guarantee absolute security.

Annex 3 — Approved Subprocessors

YESCO engages the following Subprocessors to Process Personal Data within Customer Data in connection with the Services:

Subprocessor	Purpose	Location
Supabase	Database, authentication, and file storage hosting for the Platform.	East US
Vercel	Platform hosting and content delivery.	Washington, D.C., USA
Google Workspace (including Gmail and Google Meet)	Transactional and, where applicable, marketing email; and video conferencing for Coaching Sessions.	USA

Note: YESCO also uses Google Analytics (Website analytics) and Oracle NetSuite (payment processing and financial management, storing Client name, contact, and payment information). These providers support Processing for which YESCO acts as a Controller in its own right — as described in Section 2 and the Privacy Policy — rather than Processing of Customer Data on the Client's behalf, and are therefore listed here for transparency rather than as Subprocessors under this DPA.