Data Processing Addendum

1.1 The Customer is the controller of personal data contained in Customer Content. Prooff is the processor of that data.

1.2 Prooff is a controller in its own right for account, subscription, billing, support and security-log data relating to the Customer and its users. That processing is described in the Privacy Policy and is outside the scope of this DPA.

1.3 Each party complies with the data protection law applicable to it. The Customer is responsible for the lawfulness of the data it puts into the Service, including having a lawful basis to collect it and to share it with the project participants it gives access to, and for providing any notices its own data subjects require.

2.1 Instructions. Prooff processes personal data contained in Customer Content only: (a) on the Customer’s documented instructions — which include these Terms, this DPA, the configuration the Customer chooses in the Service, and the use of the Service by the Customer’s users; and (b) where required by law that applies to Prooff, in which case Prooff will inform the Customer of that requirement before processing, unless the law prohibits it.

2.2 Prooff will tell the Customer if, in its opinion, an instruction infringes applicable data protection law.

2.3 No secondary use. Prooff does not sell Customer personal data, does not use it for its own purposes, does not use it for advertising or profiling, and does not use it to train artificial intelligence models. Aggregated statistics that cannot identify any individual or any customer may be used to operate and improve the Service.

2.4 Details. The subject matter, duration, nature and purpose of the processing, the categories of personal data and of data subjects are set out in Annex I.

Prooff ensures that every person authorised to process Customer personal data is bound by an obligation of confidentiality, is granted access only where necessary for their role, and receives instruction on their obligations.

4.1 Prooff implements and maintains the technical and organisational measures set out in Annex II, appropriate to the risk, in accordance with Article 32 GDPR.

4.2 Prooff may update those measures over time, provided the level of protection is not reduced.

4.3 The Customer is responsible for the security decisions within its own control: managing its users, assigning roles and permissions, deciding which project participants receive access, revoking access when people leave, and choosing what data it uploads.

5.1 Authorisation. The Customer gives general authorisation for Prooff to engage the subprocessors listed in Annex III.

5.2 Terms. Prooff imposes on each subprocessor data protection obligations no less protective than those in this DPA, and remains fully liable to the Customer for each subprocessor’s performance.

5.3 Changes. Prooff will give the Customer at least 30 days’ notice before adding or replacing a subprocessor, by email to the Entity’s administrators. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection, the Customer may terminate the affected subscription and receive a refund of the unused portion of prepaid fees.

6.1 Data subject requests. Taking into account the nature of the processing, Prooff assists the Customer with appropriate technical and organisational measures in responding to data subject requests. Most requests can be satisfied by the Customer directly through the Service — it can access, correct, export and delete project content itself. Where it cannot, Prooff assists on request.

6.2 Requests received directly. If Prooff receives a request from a data subject relating to Customer Content, it will not respond on the merits (except to acknowledge and redirect) and will forward the request to the Customer without undue delay.

6.3 Other assistance. Prooff provides reasonable assistance with data protection impact assessments, prior consultations with supervisory authorities, and security obligations under Articles 32–36 GDPR, taking into account the information available to it.

7.1 Prooff notifies the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer personal data.

7.2 The notice will describe, so far as known: the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed, and a contact point for more information. Where full information is not available at once, it is provided in phases without further undue delay.

7.3 Prooff does not notify supervisory authorities or data subjects on the Customer’s behalf unless legally required or asked to do so; that responsibility sits with the Customer as controller.

8.1 During the subscription, the Customer may export and delete Customer Content through the Service at any time.

8.2 On termination, Customer Content remains available for export for 30 days, after which it is deleted from production systems. Copies in encrypted backups are deleted as those backups expire on their normal rotation (currently within 7 days), during which time they remain protected by this DPA and are not accessed for any purpose other than restoring the Service.

8.3 Prooff retains personal data after termination only where required by law (chiefly invoicing and tax records), for the periods stated in the Privacy Policy.

8.4 On written request, Prooff will confirm deletion.

9.1 Prooff makes available the information reasonably necessary to demonstrate compliance with this DPA, including its security documentation and the reports and certifications of its subprocessors where it is permitted to share them.

9.2 The Customer may, no more than once in any 12-month period, request further information by means of a written security questionnaire, which Prooff will answer within 30 days.

9.3 On-site audits are available only where a supervisory authority requires one or where a documented security incident affecting the Customer has occurred. Such an audit is arranged on at least 30 days’ notice, during business hours, without disrupting the Service or the confidentiality of other customers’ data, at the Customer’s cost, and subject to confidentiality.

10.1 Personal data is processed in the regions listed in Annex III and may be transferred outside the country in which the Customer is established.

10.2 Where the transfer of personal data protected by the EU GDPR to a country without an adequacy decision takes place, the parties agree that the European Commission’s Standard Contractual Clauses (Decision 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and apply to that transfer, with:

• the Customer as data exporter and Prooff as data importer;
• Clause 7 (docking) applying;
• Clause 9, Option 2 (general written authorisation) with the notice period in clause 5.3 of this DPA;
• Clause 11 optional redress clause not applying;
• Clause 17: the governing law being the law of the Republic of Ireland;
• Clause 18(b): the courts of Ireland;
• Annexes I, II and III of this DPA populating Annexes I, II and III of the Clauses.

10.3 For personal data protected by the UK GDPR, the UK International Data Transfer Addendum to the Standard Contractual Clauses applies, with Tables 1–4 completed by reference to this DPA and Part 2 Mandatory Clauses incorporated.

10.4 Prooff has equivalent transfer terms in place with each subprocessor listed in Annex III.

Each party’s liability under this DPA is subject to the exclusions and limitations of liability in the Terms of Service. Where the Standard Contractual Clauses apply, nothing in this DPA limits liability towards data subjects to the extent the Clauses prohibit it.

12.1 This DPA takes precedence over the Terms of Service to the extent of any conflict about the processing of personal data. The Standard Contractual Clauses take precedence over this DPA to the extent of any conflict.

12.2 This DPA is governed by the law and jurisdiction stated in the Terms of Service, except where clause 10 or mandatory law provides otherwise.

12.3 We may update this DPA at any time. The current version is the one published on this page, and the “last updated” date at the top shows when it last changed. Changes to the subprocessor list are notified in advance under clause 5.3.

12.4 If a provision of this DPA is held invalid, the rest remains in force.