hsam.net / data-processing-addendum
Data Processing Addendum
HSAM.net is maintained by the Institute for Civil Memory, the nonprofit section of GLC / Gwyn Legacy. This general DPA page describes baseline data processing terms for service relationships where HSAM.net, the Institute for Civil Memory, or GLC / Gwyn Legacy processes data on behalf of another party.
01 — Roles
Controller and processor-style language
Depending on the service and applicable law, a client, partner, researcher, participant organization, or data owner may act as a controller, business, covered entity, or data owner, while HSAM.net, the Institute for Civil Memory, GLC / Gwyn Legacy, or an approved service provider may act as a processor, service provider, contractor, vendor, or similar role. Exact roles should be documented in the applicable written agreement.
02 — Processing
Instructions and scope
Covered services may process data to provide agreed services, operate applications and dashboards, support users, secure systems, troubleshoot issues, maintain backups, document service records, and perform other activities described in the applicable agreement, consent, permission, or instructions.
03 — Safeguards
Security and subprocessors
Reasonable technical and organizational measures may include access controls, least privilege, logging, backups, encryption where applicable, confidentiality expectations, and vendor review appropriate to the service. Subprocessors or service providers may be used for hosting, storage, analytics, communications, payment, security, and operational support.
04 — Requests
Export, deletion, and return
Clients may request export, deletion, return, correction, or restriction of client data subject to identity verification, technical feasibility, backup retention, legal obligations, active disputes, and the governing agreement. Jurisdiction-specific terms, subprocessors, transfer mechanisms, audit rights, and retention schedules are handled in the applicable written DPA or service agreement when required.
DPA and data-rights requests should be submitted through Contact or Support unless a signed agreement provides another channel.