Last updated: October 23, 2026 · Version 2026.10.23
This revision expands the published service and information-handling explanations. Accepted orders and signed agreements remain relevant to the service purchased.
1. Application and relationship
This addendum describes the data-processing framework for services in which JIJ processes personal data on a client's behalf. It applies with the relevant service agreement and mandatory law. The client-specific processing schedule must identify the actual engagement. A general website notice alone should not be treated as evidence that every regulated processing requirement has been satisfied.
JIJ may separately determine purposes for its own billing, account administration, security, and legal records. Payment processors, registrars, and other providers can have independent roles. The role for each activity depends on what actually happens, rather than a single label applied to every organization.
2. Processing schedule and instructions
Before placing restricted or specially regulated data into a service, agree the permitted processing and required safeguards in writing. The schedule should record subject matter, duration, purpose, systems, affected individuals, data categories, access roles, and the parties' contacts and responsibilities.
JIJ processes client-controlled information to deliver the agreed service and documented instructions. A request outside that scope, such as a new integration, disclosure, or export, requires the applicable authorization. Instructions that appear unlawful or incompatible with the agreed service should be clarified before the disputed processing proceeds.
3. Confidentiality and security
Access should be limited to personnel and approved providers who need it for the task and are subject to appropriate confidentiality obligations. Credentials are shared through approved secure methods and permissions are reviewed when work ends.
The agreed security schedule should describe the controls actually provided, including access restrictions, encrypted connections where used, logging, separation, backup scope, and incident contacts. No blanket claim of certification, data residency, end-to-end encryption, or guaranteed prevention of all incidents is made by this notice.
4. Providers and locations
JIJ can use infrastructure, portal, payment, domain, email, security, and selected product providers to deliver services. Identify the relevant provider, purpose, data, location information available, and contractual role in the engagement's provider schedule. Where law requires processor terms for a subcontractor, those terms must be in the applicable written arrangement.
Additional cross-border restrictions, customer approval rights, or industry requirements must be assessed for the specific engagement. A client should not assume that every service can meet a required location, transfer mechanism, or sector-specific agreement without prior written confirmation.
5. Assistance and incidents
Within the scope of its role and available information, JIJ will cooperate with appropriate client requests concerning data rights, security, and incident handling as required by the agreement and applicable law. Record the request, verified requester, affected systems, response owner, and any deadline that applies.
Suspected incidents should be reported promptly to support@jijweb.com. Preserve relevant facts and avoid circulating secrets or unnecessary personal records. The incident process should identify investigation, containment, evidence, and communications responsibilities. This policy does not declare that every technical incident is legally a reportable breach or establish an unverified universal notification deadline.
6. End of services and retention
The client-specific schedule should provide for return or deletion of client-controlled data at the end of service, subject to applicable law and an agreed transition. Identify exports, formats, timing, backups, retained legal records, and any continuing confidentiality duties. Cancellation alone does not establish that every mailbox, backup, or downloaded copy has been erased.
JIJ's product-specific retention periods, including optional AI memory, LinkStudio records, and fax inbox copies, are described in the Privacy Policy. Records JIJ must maintain for its own lawful purposes remain subject to their appropriate retention controls rather than being treated as client content.
7. Review and required schedules
An engagement should retain the processing description, verified provider list, security measures, retention/return plan, and authorized signatures or acceptance evidence where required. Information reasonably needed to demonstrate the applicable processing obligations should be made available through an appropriate protected review process.
Contact JIJ before submitting data that requires a specialized agreement or assurance. Iowa Code Chapter 715D has scope thresholds and exemptions; applicability and any additional state, federal, or international requirements must be evaluated for the actual facts. A client-specific DPA can add required terms without relying on a short policy summary.
References: Iowa Code 715D.2; Iowa Code 715D.5.