Last Updated: 11/10/2026
Middesk Data Processing Addendum United States
Middesk Data Processing Addendum United States
This Data Processing Addendum (“DPA”) forms part of the Agreement between the Parties where Customer has elected to include the DPA in an Order Form, and constitutes a Schedule for all purposes of the Agreement. This DPA applies where Customer contracts directly with Middesk under the Agreement; where an organization accesses the Services as an end user through a Middesk reseller, the Middesk End User Data Processing Addendum attached to the Middesk Business Verification End User Terms and Conditions applies instead. In the event of a conflict between this DPA and the Agreement, the terms of this DPA shall control with respect to Personal Information (as that term is defined in the DPA). Terms used but not defined herein shall have the meaning ascribed to them in the Agreement.
This DPA is supplemental to the Agreement and sets out the terms that apply when Personal Information is Processed by Middesk under the Agreement. The purpose of this DPA is to ensure such Processing is conducted in accordance with Applicable Laws (as defined below), including the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100, et seq., as may be amended from time to time (“CCPA”).
1. Definitions: For the purposes of this DPA:
1.1. “Applicable Laws” means all United States federal and state privacy and data protection laws applicable to Personal Information in the commercial context, including the CCPA, and any implementing regulations relating to the same; in each case, as amended, superseded, or replaced.
1.2. “Business Purpose” means the Services described in the Agreement or any other purpose specifically identified in the Agreement, as further described in Annex A.
1.3. “Consumer” means a natural person who is the subject of Personal Information.
1.4. “Consumer Requests” means requests from individuals seeking to exercise their rights under Applicable Law with respect to Personal Information.
1.5. “Processing” or “Processed” means any operation or set of operations that are performed on Personal Information or on sets of Personal Information, whether or not by automated means.
1.6. “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household and that is not otherwise exempt from the category of Personal Information as defined under Applicable Law. For purposes of clarity Personal Information does not include Middesk Data.
1.7. “Sell” and “Share” have the meaning defined in Applicable Laws.
1.8. “Subcontractor” means all subcontractors, service providers, and vendors of Middesk that are involved in Processing of Personal Information in connection with the provision of the Services.
2. Middesk Status. The Parties agree that with respect to the Personal Information Middesk is a “service provider” or “processor” as those terms are defined in Applicable Laws. For clarity, with respect to Middesk Data (including any business or beneficial-owner information that Middesk has independently collected, licensed, or generated), Middesk acts as a “business” or “controller” as those terms are defined in Applicable Laws and is independently responsible for its own compliance with Applicable Laws with respect to such data. This DPA applies only to Personal Information that Middesk Processes on Customer’s behalf.
3. Middesk Obligations. Middesk agrees that:
3.1. Middesk will notify Customer promptly and without undue delay if Middesk makes a determination that it can no longer meet its obligations under Applicable Law.
3.2. With respect to Personal Information, Middesk shall (1) only Process the Personal Information for the Business Purposes in accordance with Customer’s written instructions, including the Agreement and this DPA; (2) not Sell or Share the Personal Information; (3) not retain, use, or disclose the Personal Information for any purpose other than provision of the Services or as otherwise permitted by Applicable Law; (4) not retain, use, or disclose any Personal Information outside the direct business relationship between Middesk and Customer, except as permitted by Applicable Law; (5) not combine Personal Information with personal information Middesk received from another source, including from Middesk’s own interaction with a Consumer, except as permitted by Applicable Law.
3.3. Middesk shall ensure that any person it authorizes to Process Personal Information is subject to obligations of confidentiality.
3.4. Middesk may engage Subcontractors, where Middesk shall enter into a contract with such Subcontractor(s) that is no less protective than the applicable provisions of this Schedule and Middesk shall remain responsible for Subcontractors’ performance hereunder. When required by Applicable Laws, Middesk shall provide Customer at least thirty (30) days prior written notice of any new Subcontractor, where Customer shall have a period of twenty-one (21) days to object in good faith to the use of the new Subcontractor. In the event of such objection, Customer and Middesk shall work in good faith to resolve such objection. If the Parties cannot resolve the objection within thirty (30) days, Customer may terminate the affected Service(s) on written notice, and Middesk shall refund any pre-paid, unused Fees for such Service(s) on a pro-rated basis.
3.5. Middesk shall implement and maintain administrative, technical, and physical safeguards reasonably designed to protect the Personal Information, including safeguards required under the Agreement and any security requirements incorporated therein. For clarity, the Security Breach provisions of the Agreement shall apply with respect to Personal Information under this DPA.
3.6. Middesk shall reasonably assist Customer with meeting its compliance obligations under Applicable Law, taking into account the nature of Middesk's Processing and the information available to Middesk, including data protection impact assessments and consultation with regulatory authorities. Customer shall reimburse Middesk for any assistance that exceeds the reasonable scope of Middesk's role as a service provider.
3.7. Upon Customer’s written request, within sixty (60) days of termination or expiration of the Agreement, Middesk will delete Personal Information, except to the extent retained in standard backup systems subject to Middesk's normal retention and destruction schedule, or as required by applicable law. This obligation is in addition to, and does not supersede, the Customer Data deletion obligation that may exist in the Terms and Conditions of the Agreement.
3.8. Upon Customer’s written request, no more than once per year, unless a breach of this DPA is reasonably suspected, Middesk shall make available to Customer information reasonably necessary to demonstrate Middesk’s compliance with this DPA, consistent with the Customer Audit section of the Agreement.
4. Cooperation with Consumer Requests. With respect to Consumer Requests, the Parties agree as follows:
4.1. Middesk, taking into account the nature of the Processing of Personal Information, shall provide Customer with such assistance as may be reasonably necessary and technically feasible to assist Customer in fulfilling its obligation to respond to Consumer Requests.
4.2. Further, Middesk shall: (a) promptly and without undue delay notify Customer if it receives a Consumer Request; and (b) not respond to any Consumer Request except: (i) to advise the individual to submit the request to Customer, after which Customer will be responsible for responding to any such request; (ii) on the written instructions of Customer (and in such circumstances, at Customer’s cost); or (iii) as required by Applicable Laws.
5. Survival. This DPA shall survive termination or expiration of the Agreement for so long as Middesk Processes Personal Information.
Annex A To DPA Schedule
Personal Information Processing and Details
Subject Matter and Services of Processing:
Provision of business verification services (including matching identifying information against public records, government records, and third-party data sources, and returning verification results, risk signals, and pre-filled data values to Customer), lien filing services, and/or entity management services (including registered agent services, government account creation, and formation), as provided on the Order Form.
Duration of Processing:
Term of the Agreement
Consumer Type:
Clients of Customer who are individuals; Employees of Customer
Business Purpose:
Performing services on behalf of Customer
Personal Information Categories:
Individuals associated with clients of Customer: Identifiers, such as name, address, TIN (SSN, EIN, ITIN where applicable), email, phone number, and date of birth.
Employees of Customer:
Identifiers such as name, business email, and business phone number.
Special Categories:
None. Middesk does not knowingly solicit or process special categories of Personal Information (e.g., health data, biometric data, genetic data, racial or ethnic origin) in connection with the Services. To the extent any such information is inadvertently provided by Customer, Middesk will treat it in accordance with the security and confidentiality protections in the Agreement and will not knowingly use it for any purpose other than the Business Purpose.