data processing addendum.
How we process personal data on behalf of customers who use CARE 360 and The Element Profile.
1. Introduction and Scope
This Data Processing Addendum ("DPA") forms part of the Terms and Conditions (the "Terms") between In Good Company Collective, LLC, an Arizona limited liability company ("In Good Co.," "we," or "us"), and the customer that subscribes to CARE 360, The Element Profile, or both (the "Tools") ("Customer" or "you").
This DPA applies when we process Customer Personal Data on your behalf to provide the Tools. It does not apply to personal data we handle as a controller, such as account, billing, and website data, which is covered by our Privacy Policy.
How you accept it. You accept this DPA when you accept the Terms at checkout. No separate signature is required. Enterprise customers may also request a countersigned copy.
Order of precedence. For matters of personal data protection, this DPA controls over the Terms and any other Agreement. If the Standard Contractual Clauses apply under Section 10, they control over this DPA where the two conflict.
Last updated: October 11, 2026
2. Definitions
Capitalized terms not defined here have the meanings given in the Terms.
- "Customer Personal Data" means personal data in Customer Data (as defined in the Terms) that we process on your behalf to provide the Tools.
- "Data Protection Laws" means all laws that apply to the processing of Customer Personal Data under this DPA, including the GDPR, the UK GDPR, the California Consumer Privacy Act (CCPA), and other US state privacy laws.
- "GDPR" means the EU General Data Protection Regulation (Regulation (EU) 2016/679). "UK GDPR" means the GDPR as it applies in the United Kingdom.
- "Controller," "processor," "data subject," "personal data," and "processing" have the meanings given in the GDPR. Under US state laws, these include equivalent terms such as "business," "service provider," and "consumer."
- "Security Incident" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
- "Subprocessor" means any third party we engage to process Customer Personal Data.
- "Standard Contractual Clauses" or "SCCs" means the clauses approved by the European Commission in Implementing Decision (EU) 2021/914. "UK Addendum" means the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner.
3. Roles and Instructions
Roles. You are the controller of Customer Personal Data and we are your processor. If you are a coach or consultant using the Tools for your own clients, you may be a processor acting for those clients; in that case, we act as your subprocessor, and you are responsible for passing on any obligations your clients require.
Our instructions. We process Customer Personal Data only on your documented instructions. You instruct us to process it to provide, secure, and support the Tools as described in the Terms, this DPA, and Annex 1, and as you direct through your use of the Tools, including inviting participants, linking data across Tools, and generating reports and AI narratives. If we believe an instruction breaks Data Protection Laws, we will tell you. If law requires us to process data in another way, we will tell you first unless the law forbids it.
Your responsibilities. You are responsible for:
- Having a lawful basis for the processing and for any instructions you give us
- Giving Subjects, Raters, and participants any notices Data Protection Laws require, including that Administrators can see The Element Profile results and that results may be linked across Tools
- Completing any data protection impact assessment or consultation with employee representatives that your processing requires
- The accuracy of Customer Personal Data and your use of results, including the restrictions on hiring use in the Terms
De-identified data. We may create de-identified, aggregated data for improving the Tools and for research, as described in the Terms, only where the data cannot reasonably be used to identify or be linked to any person or organization and meets the requirements of applicable Data Protection Laws. Removing names or other direct identifiers alone does not make data de-identified. We will take reasonable measures to prevent identification or linkage, publicly commit to maintain and use the data only in de-identified form, and not attempt to re-identify it except to test whether our de-identification processes satisfy applicable law. We will contractually require any recipient to comply with these restrictions. These permitted uses may include aggregation across Customers for internal research and benchmarking; this provision does not independently authorize publication or disclosure of the resulting data to third parties. Only data meeting these requirements is excluded from Customer Personal Data.
4. Confidentiality and Security
Personnel. We limit access to Customer Personal Data to personnel who need it to provide, support, or secure the Tools. Everyone with access is bound by a duty of confidentiality.
Rater confidentiality. We will not reveal to you, a Subject, or anyone else which Rater gave a particular CARE 360 response, except where required by law.
Security measures. We implement and maintain the technical and organizational measures described in Annex 2, designed to protect Customer Personal Data against Security Incidents. We may update these measures over time, as long as the overall level of protection does not decrease.
5. Subprocessors
Authorization. You give us general authorization to use Subprocessors. Our current Subprocessors are listed in Annex 3.
Our obligations. We enter into a written agreement with each Subprocessor that imposes data protection obligations at least as protective as those in this DPA. We remain responsible to you for our Subprocessors' performance of those obligations.
Notice of changes. We will post changes to our Subprocessor list on the Site and notify you by email at least 30 days before adding or replacing a Subprocessor.
Objection. You may object to a new Subprocessor on reasonable data protection grounds by emailing info@ingoodcocollective.com within the 30-day notice period. We will work with you in good faith to address the objection. If we cannot resolve it, you may cancel the affected subscription before the change takes effect and receive a refund of any prepaid fees for the unused period.
6. Assistance
Privacy requests. If we receive a request from a data subject about Customer Personal Data, such as a request to access or delete it, we will refer the person to you and will not respond ourselves unless you authorize us or the law requires it. Taking into account the nature of the processing, we will help you respond to such requests, including through features of the Tools that let you view, export, and delete data. We will not reveal which Rater gave a particular CARE 360 response, including in response to a request from a Subject, except where disclosure is required by law, consistent with Section 4.
Impact assessments and regulators. We will provide reasonable information to help you complete data protection impact assessments and consult with supervisory authorities, to the extent the information is available to us and relates to our processing.
Government requests. If a government authority asks us for Customer Personal Data, we will try to redirect it to you. Unless the law forbids it, we will notify you promptly so you can seek a protective order or other remedy. We will disclose only the minimum data required.
7. Security Incidents
Notice. We will notify you without undue delay, and in any event within 72 hours, after confirming a Security Incident affecting your Customer Personal Data. We will send notice to the email address on your account.
What we will tell you. To the extent known at the time, our notice will describe the nature of the incident, the categories and approximate number of data subjects and records affected, the likely consequences, and the steps we have taken or plan to take. If some information is not yet available, we will provide it as soon as it is.
Our response. We will take reasonable steps to contain the incident, reduce its effects, and prevent it from happening again, and we will cooperate with you in meeting your own notification obligations.
No admission. Notifying you of a Security Incident is not an admission of fault or liability.
8. Deletion and Return of Data
During your subscription. You can delete Customer Personal Data through the Tools at any time. Otherwise, we keep assessment data for 24 months after an assessment closes.
After your subscription ends. You may choose to have Customer Personal Data returned to you or deleted by emailing info@ingoodcocollective.com. Unless you instruct us to delete it earlier, we keep Customer Personal Data for up to 60 days so you can resubscribe or request an export. We will comply with an earlier deletion instruction without undue delay. If you request return, we will provide an export and then delete the remaining copies, subject to the backup provisions below and any retention required by applicable law. In all cases, after 60 days we delete Customer Personal Data from our active systems unless applicable law requires retention. Data retained under a legal requirement remains protected under this DPA and is processed only for that requirement. Backup copies remain subject to the safeguards and deletion cycle described below.
Backups. Copies may remain in our automated database backups until those backups are overwritten in our normal backup cycle. Backups are kept secure and used only to recover from data loss or system failure. If we ever restore a backup, we will delete again any data previously scheduled for deletion before resuming normal operations.
Suspended accounts. If a subscription is suspended for non-payment, Customer Personal Data is kept while it is suspended. If the subscription is then cancelled, the 60-day period above applies.
AI provider. Data sent to our AI provider to generate narratives is deleted by that provider within 30 days, except where it must keep it longer to investigate misuse or comply with law.
9. Audits and Information
How we show compliance. We will make available the information reasonably needed to demonstrate our compliance with this DPA by:
- Answering your reasonable written security and privacy questionnaires
- Pointing you to, or sharing where our providers allow it, the independent security reports and certifications of our infrastructure Subprocessors (for example, SOC 2 or SOC 3 reports and PCI DSS attestations)
Requests must be made in writing. Routine requests are limited to once in any 12-month period, except where additional information is reasonably necessary because of a Security Incident affecting Customer Personal Data, a reasonable indication of material noncompliance, a request from a competent supervisory authority, or a requirement of Data Protection Laws or the Standard Contractual Clauses. Non-public information we share is our confidential information, subject to disclosures required by law or to a competent supervisory authority.
Audits. We will allow for and contribute to reasonable audits and inspections of our processing of Customer Personal Data by you or an independent auditor you appoint who is bound by confidentiality obligations, as necessary to demonstrate compliance with this DPA and applicable Data Protection Laws. Where sufficient to meet that purpose, the parties will first use the information and reports described above. Routine audits are limited to once in any 12-month period, at your expense, with at least 30 days' written notice, during normal business hours, and subject to reasonable security and confidentiality safeguards and without access to other customers' data. Additional audits or shorter notice will be permitted where reasonably necessary because of a Security Incident affecting your Customer Personal Data, a reasonable indication of material noncompliance, a request from a competent supervisory authority, or a requirement of Data Protection Laws or the Standard Contractual Clauses. The parties will reasonably cooperate to minimize disruption. These procedures do not restrict rights of competent supervisory authorities or audit and information rights required by applicable Data Protection Laws or the Standard Contractual Clauses. Reports and certifications of our Subprocessors supplement, but do not replace, information needed to demonstrate our own compliance.
10. International Transfers
We are based in the United States, and Customer Personal Data is processed in the United States. When Customer Personal Data subject to the GDPR or UK GDPR is transferred to us, the following safeguards apply and are incorporated into this DPA by reference.
EU transfers: Standard Contractual Clauses. The SCCs apply, with you as "data exporter" and us as "data importer," completed as follows:
- Module Two (controller to processor) applies where you are a controller; Module Three (processor to processor) applies where you are a processor acting for your own clients
- Clause 7 (docking clause) does not apply
- Clause 9(a): Option 2 (general written authorization) applies, with 30 days' notice of changes as described in Section 5
- Clause 11(a): the optional independent dispute resolution language does not apply
- Clause 13: the competent supervisory authority is the one determined under Clause 13(a) based on your establishment or representative
- Clause 17: Option 1 applies; the governing law is the law of Ireland
- Clause 18(b): disputes will be resolved in the courts of Ireland
- Annexes: Annex I.A of the SCCs is completed by the party details, roles, activities, and acceptance information in Annex 1. Annex I.B is completed by the processing and transfer description in Annex 1. Annex I.C is completed by the competent supervisory authority determined under Clause 13(a) as specified above. Annex II is completed by Annex 2, and Annex III by Annex 3 to the extent applicable.
UK transfers: UK Addendum. For restricted transfers subject to the UK GDPR that rely on the UK Addendum, the parties incorporate Part 2: Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament under section 119A of the Data Protection Act 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses. Table 1 is completed by the parties, contacts, and acceptance information in Annex 1; the Start Date is the date this DPA becomes binding between the parties. Table 2 selects the SCCs approved in Decision (EU) 2021/914 with Module Two or Module Three and the clause selections stated above, as applicable. Table 3 is completed by Annexes 1, 2, and 3 using the mapping stated above. For Table 4, both the Importer and Exporter may end the UK Addendum as permitted by Section 19. The Mandatory Clauses govern interpretation and precedence for UK restricted transfers.
Other mechanisms. If we later adopt another lawful transfer mechanism, such as certification under the EU-U.S. Data Privacy Framework, we may rely on it instead and will tell you.
Onward transfers. We will ensure that onward transfers of Customer Personal Data comply with applicable Data Protection Laws and, where applicable, the SCCs and UK Addendum, including by using a valid transfer mechanism where required. Written Subprocessor obligations supplement, and do not replace, any required transfer mechanism. We will provide information reasonably necessary for the parties to complete and document required transfer assessments and cooperate in implementing necessary supplementary measures. If we become unable to comply with the applicable transfer safeguards, we will promptly notify you and suspend affected transfers or processing as required until compliance is restored or another lawful mechanism is in place. The suspension, termination, return, and deletion provisions of the SCCs or UK Addendum apply where required.
11. US State Privacy Laws
Where the CCPA or similar US state privacy laws apply, we act as your "service provider" or "processor," and we:
- Process Customer Personal Data only for the business purposes described in Annex 1 and the Terms
- Do not sell or share Customer Personal Data, as those terms are defined in the CCPA
- Do not retain, use, or disclose Customer Personal Data outside our direct business relationship with you, or for any purpose other than those business purposes, except as the law allows
- Do not combine Customer Personal Data with personal data we receive from other sources, except as the law allows (for example, to provide the Tools)
- Provide the same level of privacy protection the law requires of you, and notify you if we determine we can no longer meet our obligations
- Allow you to take reasonable and appropriate steps to ensure that our use of Customer Personal Data is consistent with your obligations under applicable US state privacy laws, including through the information and audit procedures in Section 9, and, upon notice, to stop and remediate any unauthorized use of Customer Personal Data
We certify that we understand and will comply with these restrictions.
12. Liability, Term, and General Terms
Liability. Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Laws or the Standard Contractual Clauses do not allow those limits, such as for the rights of data subjects under the SCCs.
Term. This DPA stays in effect for as long as we process Customer Personal Data on your behalf, including after your subscription ends until the data is deleted under Section 8.
Changes. We may update this DPA to reflect changes in Data Protection Laws, our Subprocessors, or the Tools. We will notify you of material changes by email at least 14 days before they take effect, and no change will reduce the overall protection of Customer Personal Data.
Governing law. Except where the Standard Contractual Clauses or UK Addendum require otherwise, this DPA is governed by the law and dispute resolution terms of the Terms.
Contact. Questions about this DPA: In Good Company Collective, LLC, info@ingoodcocollective.com, 2640 E Sunrise Place, Chandler, AZ 85286.
Annex 1: Description of the Processing
| Item | Description |
|---|---|
| Data exporter (controller or processor) | The Customer, with its full legal name, registered or main address, and Administrator contact details and job title recorded in its account or applicable order form. The Customer acts as controller or, where processing for its own clients, processor. Activities: using the Tools for the assessment and reporting purposes described below. |
| Data importer (processor) | In Good Company Collective, LLC, Arizona, United States; trading as In Good Co. Address: 2640 E Sunrise Place, Chandler, AZ 85286. Privacy contact job title: Co-Founder and CEO; email: info@ingoodcocollective.com. Role: processor, or subprocessor where the Customer is a processor. Activities: providing the Tools and the processing described below. |
| Data subjects | Subjects, Raters, and other participants invited by the Customer, typically the Customer's employees, contractors, or coaching clients, including Administrators when they take part in an assessment. Administrator account, login, and billing data is processed by us as a controller under our Privacy Policy, not under this DPA. |
| Categories of personal data | Names, work email addresses, job titles, organization, rater relationship to the Subject; assessment ratings, answers, and written comments; The Element Profile answers; reports and AI-generated narratives; data linking a person's records across Tools within the Customer's account by email address; invitation, access, and technical data participants generate when taking assessments |
| Sensitive data | None intended. Participants are asked not to include health or other sensitive details in written answers |
| Frequency of transfer | Continuous, for as long as the Customer uses the Tools |
| Nature and purpose of processing | Hosting, storing, and organizing data; sending invitations and reminders; calculating group averages and generating reports; generating AI narratives; linking data across Tools; providing support and security |
| Duration and retention | For the subscription term. Assessment data is kept 24 months after an assessment closes unless deleted earlier, and deleted from active systems 60 days after the subscription ends, as described in Section 8 |
| Transfers to Subprocessors | As listed in Annex 3, for the purposes described there and for the duration of the subscription |
| Acceptance and date | The parties enter into the applicable SCCs and UK Addendum when this DPA becomes binding through acceptance of the Terms or execution of an agreement incorporating it. That acceptance constitutes each party's signature for these purposes. The date and evidence of acceptance are recorded with the account or signed agreement. |
Annex 2: Security Measures
We maintain the following technical and organizational measures, taking into account the nature of the processing and the risks to data subjects.
| Area | Measures |
|---|---|
| Encryption | Data is encrypted in transit using HTTPS/TLS and encrypted at rest in our database and backups |
| Access control | Access to production systems and Customer Personal Data is limited to authorized personnel who need it, using individual accounts and multi-factor authentication on infrastructure and provider accounts |
| Customer separation | Each customer's data is logically separated, and database access rules prevent one customer from accessing another's data |
| Authentication | User passwords are never stored in plain text; authentication is handled by our database provider using industry-standard hashing |
| Rater confidentiality | The Tools do not display Rater identities alongside individual responses to any platform user |
| Data minimization | We send our AI provider only the assessment information needed to generate each narrative |
| Payment data | Card payments are handled by Stripe; we do not store full card numbers |
| Backups and recovery | Automated database backups support recovery from data loss or system failure |
| Logging and monitoring | System and access activity is logged and reviewed to detect and investigate suspicious activity |
| Software maintenance | We apply security updates to our software and dependencies in a timely manner |
| Personnel | Personnel with access to Customer Personal Data are bound by confidentiality obligations |
| Vendor management | We use infrastructure providers that maintain independent security certifications, such as SOC 2 and PCI DSS, under written data protection terms |
| Incident response | We maintain a process to investigate, contain, and notify customers of Security Incidents as described in Section 7 |
Annex 3: Subprocessors
| Subprocessor | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase, Inc. | Database and user authentication | All Customer Personal Data | United States |
| Railway Corporation | Application hosting | All Customer Personal Data, as it passes through the application | United States |
| Resend, Inc. | Transactional email (invitations, reminders, notifications) | Names and email addresses; email content | United States |
| Anthropic, PBC | Generating AI narratives in reports | Assessment responses and comments needed for each narrative | United States |
| Stripe, Inc. | Payment processing | Administrator billing details (not assessment data) | United States |
Stripe processes billing data that we control rather than Customer Personal Data, and is listed for completeness.