Updated July 10, 2026
Data Processing Agreement
This Data Processing Agreement ("DPA") sets out how Aleksi Consulting Corp, operating as myBloom ("myBloom") processes personal data on behalf of a client when delivering the Services, and the commitments we make when we access a client's own systems and accounts. A client accepts this DPA before we process their data or connect their Google, Meta, DNS, or advertising accounts. Effective July 10, 2026.
1. Roles
For personal data a client uploads or entrusts to us, the client is responsible for that data (the controller) and myBloom processes it on the client's documented instructions and only to deliver the agreed Services (the processor). Where we decide the means and purposes of processing our own business data, we act as controller and our Privacy Policy applies.
2. Scope of processing
We process the categories of data needed to run the agreed modules, for example contact and lead records, booking details, website and content assets, and connected-account metadata from Google, Meta, and advertising platforms. Processing lasts for the term of the engagement plus any legally required retention window.
3. Connected accounts and consent
Before we access a client's third-party account (such as Google Business Profile, Search Console, Ads, Calendar, Gmail, Meta Business, Meta Ads, DNS, or a payment method on file), the client authorizes that access and we record the consent. Privileged access we make afterward is written to an append-only audit log, so there is a durable record of what was accessed, when, and by whom.
4. Confidentiality and security
Access to client data is limited to staff who need it to deliver the Services, under confidentiality obligations. Secrets such as access tokens and payment references are encrypted at rest and never stored in plaintext. We apply access controls, tenant isolation, and least-privilege service credentials as technical and organizational measures.
5. Sub-processors
We use a limited set of sub-processors to deliver the Services, for example cloud hosting, database, email, messaging, AI, and payment providers, each under agreements that protect the data. A current list is available on request, and we will give notice of material changes so a client can object.
6. International transfers
Where data is processed outside the client's region, including in the United States, we rely on lawful transfer mechanisms and appropriate safeguards. The specific mechanisms and locations that apply should be confirmed with counsel for a given engagement.
7. Assistance and breach notice
Taking into account the nature of processing, we assist the client in responding to data-subject requests and in meeting the client's own security, breach-notification, and impact-assessment obligations. We notify the client without undue delay after becoming aware of a personal-data breach affecting their data.
8. Return and deletion
On termination, at the client's choice, we return or delete the personal data we process on their behalf, except where retention is required by law. This complements the offboarding package described in our Terms. Backups age out on their normal cycle.
9. Acceptance
By accepting this DPA, an authorized representative of the client agrees to it on the client's behalf. Acceptance is recorded with a timestamp, the accepting user, and this document version in myBloom's consent records.