Last updated: June 2026
This Data Processing Addendum ("DPA") describes how Fettle processes personal data on behalf of your organization ("the Customer") when you use the Service. Where you are a data controller, Fettle acts as your data processor.
The Customer is the controller of the personal data it submits to Fettle (information about its members and their certifications). Fettle is the processor and processes that data only to provide the Service and on the Customer's documented instructions.
Fettle uses vetted sub-processors to deliver the Service, including cloud hosting and database infrastructure, transactional email delivery, and payment processing. Each is engaged under terms requiring appropriate protection of personal data.
Fettle maintains technical and organizational measures including encryption in transit, role-based access control, logical separation of each organization's data, and audit logging of changes.
The Service is not FedRAMP authorized and is not accredited or suitable for the handling, storage, transmission, or dissemination of Controlled Unclassified Information ("CUI") or data subject to NIST SP 800-171 or equivalent federal safeguarding requirements. The Customer agrees not to submit CUI to the Service and remains solely responsible for the nature of the data it submits. Fettle disclaims liability for CUI submitted in breach of this restriction; should a suspected CUI spillage be reported, Fettle will respond with care and cooperate promptly to contain and remediate it.
Where data is transferred across borders, Fettle relies on appropriate safeguards as required by applicable law.
Fettle will assist the Customer, taking into account the nature of processing, with data-subject requests and security obligations. On termination, the Customer may export its data; Fettle will then delete or anonymize it except where retention is legally required.
Data protection inquiries: support@fettlehq.com.