DATA PROCESSING ADDENDUM
My Record Locker
Effective Date: October 11, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service ("Agreement") between Kryptomneme LLC, doing business as My Record Locker ("Processor"), and the organization identified in the Agreement ("Controller"), and governs the processing of Personal Data by Processor on behalf of Controller in connection with the My Record Locker platform (the "Service").
1. Definitions
"Applicable Data Protection Law" means all laws and regulations relating to the processing of Personal Data that apply to the processing described in this DPA, including, where applicable, the EU General Data Protection Regulation (Regulation 2016/679) ("GDPR"), the UK General Data Protection Regulation, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and any implementing or supplementary legislation.
"Controller" means the Customer organization that determines the purposes and means of the processing of Personal Data through the Service.
"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.
"Disposal" means the removal, on the retention schedule configured by Controller or on a valid request, of information identifying a Data Subject from a Completion Record and from the associated records held by Processor, such that the record no longer identifies the individual who completed the training. Disposal is irreversible once executed and does not remove the Completion Record itself, and does not remove the identity of Controller or of the person named as having approved the training.
"Personal Data" means any information relating to a Data Subject that is processed by Processor on behalf of Controller through the Service.
"Processing" means any operation performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, retrieval, use, disclosure, combination, restriction, erasure, or destruction.
"Processor" means Kryptomneme LLC, which processes Personal Data on behalf of Controller.
"Sub-processor" means any third party engaged by Processor to process Personal Data on behalf of Controller.
"Security Incident" means a confirmed unauthorized access to, or unauthorized acquisition, disclosure, or use of, Personal Data processed under this DPA.
2. Scope and Roles
2.1. Controller is the controller of Personal Data submitted to or generated within its Tenant Workspace. Processor processes Personal Data solely on behalf of Controller and in accordance with Controller's documented instructions as set forth in this DPA and the Agreement.
2.2. This DPA applies to all Personal Data processed by Processor in connection with the Service, including learner names, email addresses, employer references, training-session event data, Completion Records, time clock entries, expenses, inspector visits, uploaded files, and, where Controller turns on Resident logs, resident information.
2.3. Resident logs are off unless Controller turns them on. Before they open, the parties sign a Business Associate Agreement. That agreement also applies to the protected health information held in Resident logs, and governs that information if it conflicts with this DPA.
3. Details of Processing
| Element | Description |
|---|---|
| Subject matter | Provision of the My Record Locker platform, including training-module delivery, session-event recording, Completion Record issuance, record storage, record verification, record export, and the workplace tools Controller chooses to use. |
| Duration | For the term of the Agreement plus the applicable data-retention period described in Section 8. |
| Nature and purpose | Processing Personal Data to deliver training, verify learner identity, record training-session events, issue tamper-evident Completion Records, enable record verification, run the workplace tools Controller uses (time clock, expenses, inspector visits, and, where turned on, Resident logs), and provide data export to Controller. |
| Categories of Data Subjects | Learners (employees or other individuals invited by Controller to complete training); Controller's administrators; staff who use the time clock; inspectors and other visitors whose visits Controller records; and, where Controller turns on Resident logs, residents and the staff who care for them. |
| Categories of Personal Data | Full name, email address, employer reference or employee identifier, training-session events (quiz responses, navigation actions, timestamps, completion status), identity-verification method and result, session duration, IP address, browser user-agent. In addition, where Controller elects to record them, the following optional Learner profile details: date of birth; telephone number; postal address; job title; department; start date; licence or certification number; emergency contact; and national identification number (including, in the United States, a Social Security Number). These fields are disabled by default, are enabled at Controller's election, and are supplied by or on behalf of Controller. Processor does not require any of them in order to provide the Service, does not validate their contents, and processes them solely on Controller's documented instructions. They are held with the Learner's roster record and are not written to an issued Completion Record, to the training-session events described above, or to the public verification page. Where Controller uses the workplace tools: time clock entries (name, email address, and clock times); expenses and receipts; and inspector visit details (times, a photo of the inspector's card, and the inspector's name and agency if added). Where Controller turns on Resident logs: resident names, care logs, medications and medication orders, scanned and imported paper records, and a record of each time staff open, add, or export resident information. This includes health information. |
4. Controller's Instructions
4.1. Processor shall process Personal Data only in accordance with Controller's documented instructions, which are deemed to include the processing described in the Agreement, this DPA, and any configuration selections made by Controller within the Service.
4.2. If Processor believes that an instruction from Controller infringes Applicable Data Protection Law, Processor shall promptly notify Controller and may suspend the relevant processing until Controller issues a revised instruction.
4.3. Processor shall not process Personal Data for any purpose other than providing the Service as described in the Agreement and this DPA, and shall not sell, rent, or otherwise commercially exploit Personal Data. Processor does not send Personal Data to any AI service.
5. Confidentiality
5.1. Processor shall ensure that all persons authorized to process Personal Data are bound by appropriate obligations of confidentiality, whether contractual or statutory.
5.2. Processor shall not disclose Personal Data to any third party except as permitted under this DPA (including to authorized Sub-processors) or as required by applicable law. If Processor receives a legally binding request from a governmental or regulatory authority to disclose Personal Data, Processor shall promptly notify Controller before making such disclosure, unless prohibited by law from doing so.
6. Security Measures
6.1. Processor shall implement and maintain reasonable administrative, technical, and organizational measures to protect Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include:
(a) Tamper-evident Completion Records: a change to an issued record can be detected.
(b) Resident logs kept apart from the rest of the Service, encrypted at rest, with a record of every time resident information is opened, added, or exported.
(c) Encryption of data in transit using TLS, and encryption of data at rest, including infrastructure snapshots.
(d) Encrypted off-site backups stored on Backblaze B2, with decryption keys held solely by Processor.
(e) Files uploaded by Controller, including documents, logos, inspector card photos, and expense receipts, stored on Cloudflare R2, encrypted at rest by the storage provider, in a bucket restricted to the United States for the life of the store.
(f) Logical tenant isolation — each Controller's data is stored and accessed within a scoped Tenant Workspace, with technical controls designed to prevent cross-tenant data access.
(g) Identity verification of learners using one-time-password codes delivered by email; codes are not retained after verification.
6.2. No system can be guaranteed secure against every threat, and Processor does not represent that the Service is impervious to unauthorized access. Processor will notify Controller of material changes to the measures described in this Section.
6.3. Processor shall periodically review and update its security measures to reflect changes in technology, industry practice, and the nature and sensitivity of the Personal Data processed.
7. Sub-processors
7.1. Controller grants Processor general authorization to engage Sub-processors to assist in providing the Service, subject to the requirements of this Section 7.
7.2. As of the effective date of this DPA, Processor uses the following Sub-processors:
| Sub-processor | Processing Activity | Location |
|---|---|---|
| Stripe, Inc. | Payment processing (hosted checkout; Processor never receives raw payment-card data) | United States |
| Resend | Transactional email delivery (invitations, one-time-password codes) | United States |
| Render | Cloud hosting and persistent storage for the Platform and its database | United States (Oregon) |
| Backblaze, Inc. | Encrypted off-site backup storage (receives only encrypted backup artifacts; does not hold decryption keys) | United States |
| Cloudflare, Inc. | Object storage for files Controller uploads, including documents, logos, inspector card photos, and expense receipts (holds no Completion Records, no resident information, and no billing data) | United States |
| Google LLC (Google Cloud) | Hosting, database, and encrypted backups for Resident logs, only for Controllers that turn Resident logs on | United States (Oregon) |
| Twilio Inc. | Text message provider: sends sign-in codes, clock-in and clock-out confirmations, and alerts that need attention, on behalf of Controller (no resident information) | United States |
7.3. Before engaging a new Sub-processor or replacing an existing one, Processor shall notify Controller at least thirty (30) days in advance by email to the address Controller designates for notices, or to Controller's account address if none is designated. The notice shall identify the new Sub-processor, describe the processing it will perform, and state its location.
7.4. Controller may object to a new Sub-processor by notifying Processor in writing within fifteen (15) days of receiving notice. If Controller raises a reasonable objection and the parties cannot resolve the objection within thirty (30) days, Controller may terminate the Agreement with respect to the affected processing activity without penalty.
7.5. Processor shall enter into a written agreement with each Sub-processor that imposes data-protection obligations no less protective than those in this DPA. Processor remains fully liable to Controller for the acts and omissions of its Sub-processors.
8. Data Retention, Return, and Deletion
8.1. Controller sets retention periods for Completion Records based on its own legal or business requirements; unless Controller sets one, records are kept indefinitely. Controller may set a period for each record, for each course, or by rule, may change it later, and may place holds. Controller is responsible for choosing the retention period appropriate to its use and configuring the Service accordingly.
8.2. Upon a Completion Record reaching the end of its retention period, or upon a valid deletion request, Processor performs Disposal of that record. The record itself is retained and remains verifiable; it no longer identifies the individual who completed the training.
8.3. Upon termination of the Agreement, Processor shall, at Controller's election:
(a) Provide Controller with a complete export of Controller's Tenant Workspace data in CSV or JSON format; and/or
(b) Perform Disposal of Personal Data in Controller's Tenant Workspace.
Controller shall communicate its election within sixty (60) days of termination. If Controller makes no election within that period, Processor shall perform Disposal after the expiration of the applicable retention period.
8.4. Resident information is not subject to Disposal and is not deleted on a schedule. When Controller's use of Resident logs ends, Controller may download a complete copy, and Processor then deletes the resident information, including from backups, within thirty (30) days after that date. Processor keeps a log of who opened, added, or exported resident information, without resident names or log contents, for six (6) years, and a record of the closing.
9. Data Subject Rights
9.1. Processor shall assist Controller in responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Law, including rights of access, rectification, deletion, restriction, portability, and objection.
9.2. If Processor receives a request directly from a Data Subject, Processor shall promptly redirect the request to Controller, unless Processor is required by applicable law to respond directly.
9.3. Controller acknowledges that rectification of data within issued Completion Records is accomplished by amendment rather than by altering prior entries, and that deletion is accomplished through Disposal as defined in Section 1. Resident log entries are likewise corrected by a new entry rather than by changing the earlier one, and resident information is deleted as described in Section 8.4.
10. Security Incident Notification
10.1. Processor shall notify Controller of a Security Incident without undue delay after becoming aware of the incident.
10.2. Notification shall include, to the extent known at the time:
(a) A description of the nature of the Security Incident, including the categories and approximate number of Data Subjects and records affected.
(b) The likely consequences of the incident.
(c) The measures taken or proposed to address the incident and mitigate its effects.
(d) The name and contact details of the point of contact for further information.
10.3. Processor shall cooperate with Controller in investigating and remediating the Security Incident and shall provide reasonable assistance to Controller in fulfilling Controller's own breach-notification obligations under Applicable Data Protection Law.
10.4. Notification of a Security Incident under this Section shall not be construed as an acknowledgment of fault or liability by Processor.
11. Data Protection Impact Assessments and Consultations
11.1. Processor shall provide reasonable assistance to Controller in conducting data protection impact assessments and prior consultations with supervisory authorities, to the extent required by Applicable Data Protection Law and to the extent that such assessments relate to the processing performed by Processor under this DPA.
12. International Data Transfers
12.1. The Service is hosted in the United States, in Oregon. If Controller or its Data Subjects are located outside the United States, Personal Data may be transferred to and processed in the United States.
12.2. Where such transfer requires a lawful transfer mechanism under Applicable Data Protection Law, the parties agree to execute the Standard Contractual Clauses approved by the European Commission (or the UK International Data Transfer Addendum, as applicable) as an appendix to this DPA. In such case:
(a) Controller is the "data exporter" and Processor is the "data importer."
(b) The details of processing in Section 3 of this DPA shall serve as Annex I to the Standard Contractual Clauses.
(c) The technical and organizational measures in Section 6 of this DPA shall serve as Annex II to the Standard Contractual Clauses.
(d) The Sub-processor list in Section 7.2 shall serve as Annex III to the Standard Contractual Clauses.
12.3. Processor shall not transfer Personal Data to any country or territory outside the scope of the original transfer unless it has taken measures necessary to ensure the transfer complies with Applicable Data Protection Law.
13. Audits
13.1. Processor shall make available to Controller, upon reasonable request and subject to reasonable confidentiality obligations, information necessary to demonstrate compliance with this DPA.
13.2. Controller (or a qualified third-party auditor appointed by Controller and bound by confidentiality obligations) may conduct an audit of Processor's processing activities under this DPA no more than once per twelve-month period, upon at least thirty (30) days' prior written notice. Audits shall be conducted during normal business hours, shall not unreasonably interfere with Processor's operations, and shall be at Controller's expense.
13.3. If an independent third-party audit report or certification covering the processing activities under this DPA becomes available, Processor may provide such report or certification to Controller in satisfaction of an audit request under this Section.
14. Liability
14.1. Each party's liability under this DPA is subject to the limitations and exclusions of liability set forth in the Agreement.
14.2. This DPA does not create any rights or remedies for any third party, including any Data Subject.
15. Term and Termination
15.1. This DPA takes effect on the effective date of the Agreement and remains in effect for so long as Processor processes Personal Data on behalf of Controller.
15.2. The obligations in Sections 5, 6, 8, 9, 10, and 13 survive termination or expiration of this DPA to the extent necessary to fulfill their purposes.
16. Changes to This DPA
16.1. Processor may update this DPA at any time. The current version is the one posted at myrecordlocker.com/dpa/, and the Effective Date at the top shows when it last changed. Continued use of the Service after that date constitutes acceptance of the revised DPA.
16.2. Section 7.3 is unaffected: advance notice of a new or replacement Sub-processor is given as set out in that Section, whether or not this DPA has otherwise changed.
17. Conflict
17.1. In the event of a conflict between this DPA and the Agreement, this DPA shall prevail with respect to the processing of Personal Data.
18. Governing Law
18.1. This DPA is governed by the same law that governs the Agreement (the laws of the State of California; exclusive jurisdiction in the state and federal courts located in Contra Costa County, California).
19. Acceptance
This DPA is incorporated by reference into the Agreement and takes effect automatically upon Controller's acceptance of the Agreement, without requirement of a separate signature, consistent with Section 2 (Acceptance of Terms) of the Terms of Service. Where an enterprise Controller requires a countersigned copy or negotiated terms, Processor will provide an executable version of this DPA (or the Standard Contractual Clauses referenced in Section 12) upon request.