Data Processing Notice

1. Purpose and Scope

This document explains how Acadia Marketing LLC, a Maine limited liability company ("Acadia Marketing LLC", "we", "us"), handles data that a client entrusts to us while we provide website design and development, website hosting, domain name management, email setup, search and advertising management, SMS and text-message lead alerts, and client website and domain transfer services. It applies to acadiamarketingmaine.com and to any page, subdomain or transfer page we operate or issue to clients (the "Sites"). It supplements the Terms of Use, the Privacy Policy, the Cookie Notice and the applicable agreement between us and the client. If this document conflicts with the applicable agreement, the applicable agreement controls.

2. Client Data We Handle

"Client Data" means information that a client or the client's customers, visitors or leads provide to us, or that we collect on the client's behalf, in the course of the services. Depending on the services, Client Data may include:

business and account details, such as company names, contact information and billing contacts;
website content, files, images, forms and the submissions visitors send through them;
lead information, such as names, phone numbers, email addresses and the content of inquiries;
domain, registrar, hosting and email account configuration details, including any access code or transfer code issued in connection with the services;
advertising and analytics account information and related performance data;
message content and delivery records connected to text-message lead alerts.

Information we collect about visitors to our own Sites for our own purposes is described in the Privacy Policy and is not Client Data.

3. Our Role as Processor

For Client Data, the client decides what is collected and why, and we act as a processor, meaning a service provider that handles the data on the client's behalf. We process Client Data only to provide the services, to follow the client's documented instructions, to maintain and secure our systems, and to meet legal obligations. We do not sell Client Data and we do not use it to market our own services to the client's customers. The client is responsible for having a lawful basis and any required notices or consents for the data it asks us to collect or use, including for contacting its leads by text message or email.

4. Client Instructions and Responsibilities

The applicable agreement, together with the settings and requests the client gives us in writing, constitutes the client's instructions. If we believe an instruction would violate applicable law, we may decline to carry it out and will tell the client. Clients are responsible for the accuracy of the information they give us, for the lawfulness of the content they ask us to publish, and for keeping their own access codes, transfer codes and other credentials confidential, as further described in the Access Code and Authentication Policy and the Acceptable Use Policy.

5. Security Measures

We use administrative, technical and organizational safeguards that are reasonable for the nature of the data and the services. In general terms, these include limiting access to personnel and providers who need it, requiring authentication for administrative systems, using encrypted connections for data in transit, keeping software and systems maintained, and recording certain access and security events as described in the Access Logging and Security Notice. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

6. Sub-Processors by Category

We use third-party providers to deliver the services. We describe them by category and do not name them here. The categories include:

website hosting and content delivery providers;
domain registrars and domain name system providers;
email hosting and email delivery providers;
messaging carriers and text-message delivery platforms;
advertising, search and analytics platforms that the client authorizes us to use;
database, storage, backup and monitoring providers;
payment and billing processors.

We select providers with regard to their security practices and require them, through their terms or our arrangements with them, to protect data they handle for us. We remain responsible for our use of them as described in the applicable agreement. A client may ask us in writing for further information about the categories relevant to its services.

7. Transfers and Hosting After a Transfer

Where we transfer a website or domain to a client or to the client's designated recipient, the Website and Domain Transfer Terms govern the transfer. Where hosting or other services are relevant after a transfer, they continue under the existing agreements unless the parties agree otherwise in writing. Once a transfer is complete, the receiving party is responsible for the security and handling of the transferred materials, including any transfer code or access code.

8. Return and Deletion at Termination

When the services end, we will, at the client's written request and as provided in the applicable agreement, make Client Data reasonably available to the client in a commonly used format, or delete it. Following the end of the services, we will delete or de-identify Client Data in the ordinary course on the agreed schedule, except where we must keep it to comply with law, resolve disputes, enforce our agreements, or maintain records of our own business, or where it remains in routine backups until those backups are overwritten. Retained data remains subject to this document for as long as we hold it. Ownership of content and materials is addressed in Intellectual Property and Copyright.

9. Incident Notification

If we become aware of unauthorized access to, or loss or disclosure of, Client Data in our control, we will investigate, take reasonable steps to contain and remediate it, and notify affected clients as the applicable agreement and law require. Our notice will describe, to the extent known, the nature of the incident, the categories of data involved and the steps taken or recommended. Notices are given under Electronic Communications and Notices. Notifying a client is not an admission of fault or liability.

10. Cooperation and Requests

Individuals sometimes contact us about data that belongs to a client's business. Where we can identify the client concerned, we will refer the request to that client and will reasonably assist it in responding, taking into account the nature of the services. We will also reasonably assist a client with lawful requests from authorities that concern Client Data, unless the law prevents us from doing so.

Our responsibilities regarding Client Data are subject to the Disclaimers and Limitation of Liability and the Governing Law and Dispute Resolution documents. This document is governed by the laws of the State of Maine, with venue in Cumberland County, Maine. We may update this document from time to time, and the version posted on the Sites applies from the time it is posted.

12. Contact

Questions or notices about Client Data should be sent to Acadia Marketing LLC, 218 Pond Road, Wilton, ME 04294, by email to info@acadiamarketingmaine.com, or by phone at (207) 716-9079.