Yes. We published a Data Processing Addendum (DPA) and included it in our Terms of Service. You can find a copy here.