Data Processing Addendum

Draft notice: This DPA is in technical scaffold form pending review by outside counsel. The clickwrap on POST /v1/keys already enforces version-pinned acceptance against this URL — final legal copy will land here without code changes.

1. Roles & scope

OpenParcel ("Processor") processes Personal Data on behalf of the Customer ("Controller") solely for the purpose of providing the OpenParcel API service. This addendum supplements the Master Services Agreement and applies to all Personal Data processed by OpenParcel under the Customer's API key(s).

2. Categories of Personal Data

Property owner records sourced from NJ MOD-IV public tax rolls and county clerk filings.
Skip-traced contact data (phone numbers, email addresses, mailing addresses) sourced from third-party aggregators (the "Sub-processors" listed at /legal/sub-processors).
Daniel's Law-protected names stored solely to refuse processing of those data subjects' records.

3. Sub-processors

The current sub-processor list is published at /.well-known/sub-processors.json in machine-readable form. OpenParcel will provide at least 30 days' notice before adding or replacing any sub-processor; Customer may object in writing.

4. Data subject rights (DSAR)

Customer may submit deletion or access requests on behalf of any data subject via DELETE /v1/owner_contacts. OpenParcel will honor the request within 24 hours, zero the cached PII, and add the contact to a permanent suppression list. A delivery confirmation is returned synchronously.

5. Daniel's Law (N.J.S.A. 47:1B-1)

OpenParcel does not knowingly process or return contact data for individuals on the New Jersey Office of Information Privacy redaction list. The protected-names registry is refreshed on a daily cadence (see privacy policy). Customers who subscribe to the redaction.created webhook will receive a signed event when a name is newly added so they may purge their own caches.

6. Security

All API traffic is TLS-encrypted. API keys are SHA-256 hashed in OpenParcel's database (plaintext is never stored). Webhook payloads are signed with HMAC-SHA256 using a per-customer secret.

7. International transfers

OpenParcel hosts all production infrastructure in the United States. Customers operating from the EU/UK should contact legal@openparcel.io to execute Standard Contractual Clauses prior to onboarding.

8. Governing law

This addendum is governed by the laws of the State of New Jersey, without regard to conflict-of-law principles.

Acceptance: By submitting accepts_dpa: true with dpa_version: "2026-04" on POST /v1/keys, Customer confirms they have read and agree to this addendum on behalf of their organization.