Important: execution is required
Publication alone does not execute this DPA or establish that the technical safeguards are in place. An accepted order must incorporate these terms and identify the data schedule, approved transfer method and authorized providers before any CRM data is received. Legal review is recommended.
1. Parties and effective scope
This proposed Data Processing Agreement (DPA) is between Bishop Shop Enterprises LLC, doing business as Live Nestora (Service Provider), and the business identified in an accepted written service order (Customer). It becomes part of an engagement only when expressly incorporated into the accepted order or separately executed by both parties. No customer should upload CRM records before the necessary data-processing arrangement and secure transfer have been approved.
2. Roles and permitted instructions
For customer records processed solely to deliver an authorized Revenue Rescue service, Customer determines the purposes and lawful basis and LiveNestora processes on documented instructions, except where law requires otherwise. Separate prospect-list products and LiveNestora's own business administration are not automatically covered by Customer's instructions. Neither party may use this agreement to authorize unlawful activities.
3. Subject matter and duration
The subject matter is the agreed review of existing customer estimates or CRM opportunity records and preparation of contracted findings and guidance. Processing begins after accepted scope and approved intake and ends under the order's retention and return/deletion provisions. The particular plan, record volume, authorized data categories and processing period must be recorded in the accepted service order.
4. Categories of information and people
Depending on the agreed scope, data may contain customer contact details, quote dates and values, service status, follow-up history, locations and related business notes. Data subjects may be customers, prospects with an existing business relationship, and authorized customer staff. Sensitive personal information and special regulated categories must not be provided without a distinct approved addendum.
5. Confidentiality, safeguards and access
LiveNestora will use reasonable technical and organizational measures appropriate to the engagement, limit access to authorized persons under confidentiality obligations and prevent deliberate use of customer data for unrelated products. The parties must verify the actual security and transfer arrangements before data intake. No particular certification or encryption standard is guaranteed by this document.
6. Approved subprocessors
LiveNestora may use service providers necessary for the authorized engagement only subject to appropriate contractual restrictions. The approved categories, material systems and any required subprocessor list or authorization procedure will be documented in the order or an accompanying schedule. Material changes will be communicated as required by law and contract, with any applicable objection process.
7. Requests, cooperation and audits
Customer remains responsible for its obligations to affected people where it acts as controller. LiveNestora will provide reasonable assistance, proportionate to the engagement, with relevant privacy requests, required assessments and documented security inquiries. Any audit scope, costs, confidentiality and protection of other customers must be agreed and consistent with mandatory law.
8. Security incidents
LiveNestora will notify the Customer without undue delay after confirming a security incident affecting the entrusted data, as required by applicable law and the accepted order. The notice will contain information reasonably available and be updated as material facts emerge. The parties will cooperate on containment, investigation and legally required notices. This agreement does not pre-assign statutory notification duties contrary to law.
9. Return, deletion and retention
Following termination or expiration, LiveNestora will return or delete entrusted data as provided by the agreed retention schedule, unless a lawful retention obligation applies. Backup and suppression exceptions, deletion confirmation process, delivery format and timeframes must be recorded before upload. Customer data will not be placed into LiveNestora prospect-data products.
10. International transfers and conflicts
The parties must identify any relevant cross-border transfers and execute additional protections where legally required. This DPA does not promise U.S.-only data residency. Mandatory privacy law prevails over inconsistent contract language. In the event of a conflict concerning entrusted customer data, the executed DPA and specifically negotiated data schedule govern over general website wording, subject to law.
Schedule required for each engagement
The signed order should identify the parties, approved systems and providers, processing instructions, permitted data categories, purpose and duration, transfer channel, access roles, retention/deletion period, incident contacts, and any applicable jurisdiction-specific terms.
Request an executed DPA