SmartSuite offers a Data Processing Addendum (DPA) that forms part of the SmartSuite customer agreement and applies where SmartSuite processes personal data on your behalf. The full text is published on the website's Data Processing Addendum page; to enter into it, contact your account manager or the sales team.
The website page is the text of record (Last Modified: October 31, 2026). This article summarizes it and does not replace it.
Example: a compliance team's legal counsel needs a signed DPA before the team loads vendor contact data. She reads the published DPA, then asks the account manager to send it for signature.
Plan Availability | All plan types. |
Permissions | Administrators, or the customer's legal contact, request the DPA. |
Platform | Web |
Related Reading |
What does the DPA cover?
The DPA governs how SmartSuite acts as a processor for the personal data a customer stores on the platform.
If there is a conflict between the DPA and the customer agreement regarding the processing of personal data, the DPA controls.
For transfers it incorporates the EU Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum (or other applicable UK transfer mechanism).
Annex 2 summarizes the technical and organizational measures.
Section 6.3 gives at least 30 days' notice before a new subprocessor starts processing personal data. The notice is an update to the subprocessor list and an email to the notice contact on your account, or to the account email when none is designated.
Section 6.4 runs the 30-day objection window from that notice.
Annex 3 names the website's Subprocessors page as the list of record, with SmartSuite Subprocessors as its copy. Where the two differ, the website page controls.
See Is SmartSuite GDPR compliant and where is my data hosted: SmartSuite and GDPR for GDPR background.
How do I request it?
Read the published DPA at www.smartsuite.com/legal/customer-dpa.
Contact your account manager, or the sales team through the contact route on the security page. Ask to enter into the DPA and include your organization's name.
Your account manager or the sales team sends you the DPA for signature.
Note: The DPA is tailored to SmartSuite's service. Contact the sales team about any request to change the DPA wording.
Frequently asked questions
Who can answer a question about the DPA's terms?
Who can answer a question about the DPA's terms?
The sales team. Contact them through your account manager or the sales contact on the security page. Contact the sales team about any request to change the DPA wording.
Does the DPA include standard contractual clauses?
Does the DPA include standard contractual clauses?
Yes. The DPA incorporates the EU Standard Contractual Clauses (Module Two: Controller-to-Processor) and the UK International Data Transfer Addendum (or other applicable UK transfer mechanism).
Does the DPA cover health data or other special categories?
Does the DPA cover health data or other special categories?
Annex 1 of the DPA states that special categories of data are not intended unless expressly agreed in writing, for example through an addendum such as a BAA where applicable. See HIPAA at SmartSuite: audit report and BAA.
Can we change the DPA wording?
Can we change the DPA wording?
Contact the sales team about any request to change the DPA wording.
How much notice do we get of a new subprocessor?
How much notice do we get of a new subprocessor?
At least 30 days, under Section 6.3. The 30-day objection window under Section 6.4 runs from that notice.
Last verified 1 Nov 2026.