Data Processing Agreement

Introduction

This Data Processing Agreement ("DPA") forms part of the Master Service Agreement, Terms of Service, or other subscription agreement (the "Agreement") between PropperDocs, Inc. ("Propper") and the entity identified as Customer in the Agreement ("Customer").

This DPA governs Propper's Processing of Personal Data on behalf of Customer in connection with the Services. The terms of this DPA prevail over any conflicting terms in the Agreement with respect to data protection matters.

This DPA is effective as of the Effective Date of the Agreement or, if later, the date Customer accepts this DPA.

1. Definitions

"Applicable Data Protection Laws" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including:

• U.S. state privacy laws (e.g., California CCPA/CPRA, Virginia CDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA)

"Controller" means the entity that determines the purposes and means of Processing Personal Data.

"Data Subject" means the identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means any information relating to an identified or identifiable natural person that is Processed by Propper in connection with the Services.

"Process" or "Processing" means any operation performed on Personal Data, including collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, erasure, or destruction.

"Processor" means an entity that Processes Personal Data on behalf of a Controller.

"Security Incident" means any unauthorized access to, acquisition of, or disclosure of Personal Data that compromises the security, confidentiality, or integrity of such Personal Data.

"Subprocessor" means any third party engaged by Propper to Process Personal Data on Propper's behalf.

2. Roles and Responsibilities

2.1 Roles of the Parties

The Parties acknowledge and agree that:

• Customer is the Controller (or acts on behalf of a Controller) of Personal Data Processed through the Services
• Propper is the Processor of Personal Data and Processes Personal Data solely on behalf of Customer in accordance with this DPA

2.2 Customer Responsibilities

Customer is responsible for:

• Determining the lawful basis for Processing Personal Data
• Providing any required notices to Data Subjects
• Obtaining any necessary consents or authorizations
• Ensuring that Customer's instructions to Propper comply with Applicable Data Protection Laws
• Responding to Data Subject requests (with Propper's assistance as set forth herein)

2.3 Customer Instructions

Customer instructs Propper to Process Personal Data for the following purposes:

• Providing the Services in accordance with the Agreement
• Processing initiated by Users in their use of the Services
• Processing necessary to comply with Customer's documented instructions
• Processing required to comply with applicable law

Customer's instructions must comply with Applicable Data Protection Laws. If Propper believes an instruction violates Applicable Data Protection Laws, Propper will promptly notify Customer.

3. Data Processing

3.1 Processing Details

The details of Processing are set forth in Annex I (Description of Processing) below.

3.2 Processing Limitations

Propper will:

• Process Personal Data only on Customer's documented instructions, unless required by applicable law
• Not sell, share, or use Personal Data for any purpose other than providing the Services
• Not combine Personal Data with data from other sources except as necessary to provide the Services
• Treat Personal Data as Confidential Information under the Agreement

3.3 Compliance

Propper will comply with Applicable Data Protection Laws in its Processing of Personal Data on Customer's behalf.

4. Data Subject Rights

4.1 Requests to Customer

Customer is responsible for responding to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws (e.g., access, correction, deletion, portability, objection).

4.2 Requests to Propper

If Propper receives a request directly from a Data Subject, Propper will promptly redirect the Data Subject to Customer and notify Customer of the request, unless prohibited by law.

4.3 Assistance

Taking into account the nature of the Processing, Propper will provide reasonable assistance to Customer in responding to Data Subject requests, including by:

• Providing access to Personal Data within Propper's possession
• Correcting, deleting, or restricting Processing of Personal Data as instructed by Customer
• Providing Personal Data in a structured, commonly used format where required for portability

Propper may charge reasonable fees for assistance beyond what is required to provide the Services.

5. Personnel and Confidentiality

5.1 Personnel

Propper will ensure that personnel authorized to Process Personal Data:

• Are subject to confidentiality obligations
• Have received appropriate training on data protection
• Process Personal Data only as necessary to perform their duties

5.2 Access Limitation

Propper will limit access to Personal Data to personnel who require access to perform the Services.

6. Security

6.1 Security Measures

Propper will implement and maintain appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful Processing, accidental loss, destruction, or damage. These measures are described in Annex II (Security Measures) below.

6.2 Security Assessment

Propper regularly assesses and updates its security measures to address evolving threats. Propper will not materially reduce the overall security of the Services during the term of the Agreement.

7. Security Incidents

7.1 Notification

Propper will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Personal Data.

7.2 Notification Content

The notification will include, to the extent known:

• A description of the nature of the Security Incident, including categories and approximate number of Data Subjects and records affected
• Contact information for Propper's privacy or security team
• Likely consequences of the Security Incident
• Measures taken or proposed to address the Security Incident

7.3 Cooperation

Propper will cooperate with Customer's reasonable requests for additional information and will take appropriate measures to remediate the Security Incident.

7.4 No Admission

Propper's notification of a Security Incident is not an acknowledgment of fault or liability.

8. Subprocessors

8.1 Authorization

Customer grants Propper general authorization to engage Subprocessors to Process Personal Data, subject to the requirements of this Section 8.

8.2 Current Subprocessors

8.3 New Subprocessors

Propper will notify Customer at least fifteen (15) days before engaging a new Subprocessor by updating the Subprocessor list and notifying Customer via email.

8.4 Objection

If Customer has a reasonable, documented objection to a new Subprocessor based on data protection concerns, Customer must notify Propper in writing within fifteen (15) days of receiving notice. The Parties will work in good faith to address Customer's concerns.

If the Parties cannot resolve the objection within thirty (30) days, Customer may terminate the affected Services by providing written notice. Propper will refund prepaid Fees for the unused portion of the Subscription Term.

8.5 Subprocessor Agreements

Propper will enter into written agreements with Subprocessors that impose data protection obligations no less protective than those in this DPA.

8.6 Liability

Propper remains liable to Customer for the acts and omissions of its Subprocessors to the same extent Propper would be liable if performing the Processing directly.

9. Data Location

9.1 United States Processing

Propper Processes and stores Personal Data in data centers located in the United States. Propper does not transfer Personal Data outside the United States in providing the Services.

9.2 Safeguards

Propper maintains technical and organizational measures to protect Personal Data wherever it is Processed, including encryption of data in transit and at rest as described in Annex II.

10. Audits

10.1 Audit Information

Upon Customer's written request (no more than once per year), Propper will provide information demonstrating compliance with this DPA, which may include:

• Relevant security certifications (e.g., SOC 2 Type II reports)
• Third-party audit reports
• Responses to security questionnaires
• Relevant policies and procedures

10.2 On-Site Audits

If Customer reasonably determines that the information provided under Section 10.1 is insufficient, Customer may request an on-site audit subject to the following:

• Written request at least thirty (30) days in advance
• Scope limited to Propper's Processing of Personal Data for Customer
• Conducted during normal business hours with minimal disruption
• Auditor must execute a confidentiality agreement
• Customer bears all costs of the audit
• Propper may require that auditors who are competitors execute additional protections

10.3 Confidentiality

Audit reports and related information constitute Propper's Confidential Information.

11. Data Protection Impact Assessments

Upon Customer's reasonable request, Propper will provide information reasonably necessary for Customer to conduct data protection assessments required by Applicable Data Protection Laws.

12. Return and Deletion

12.1 During Subscription Term

Customer may export Personal Data at any time during the Subscription Term using the functionality provided in the Services.

12.2 Post-Termination

Following termination or expiration of the Agreement:

• Propper will retain Personal Data for thirty (30) days to allow Customer to export
• After thirty (30) days, Propper will delete Personal Data in accordance with its standard practices
• Propper may retain Personal Data as required by applicable law or for legitimate business purposes (e.g., transaction records for legal compliance)

12.3 Deletion Certification

Upon Customer's written request, Propper will certify deletion of Personal Data.

13. General

13.1 Conflicts

In the event of conflict between this DPA and the Agreement, this DPA shall prevail with respect to data protection matters.

13.2 Liability

Liability under this DPA is subject to the limitations set forth in the Agreement.

13.3 Termination

This DPA will terminate automatically upon termination or expiration of the Agreement.

13.4 Amendments

Propper may update this DPA from time to time to reflect changes in Applicable Data Protection Laws. Material changes will be communicated at least thirty (30) days before taking effect.

Annex I: Description of Processing

A. List of Parties

B. Description of Processing

Annex II: Security Measures

Propper implements the following technical and organizational security measures:

1. Access Control

• Role-based access controls with least-privilege principles
• Multi-factor authentication for administrative access
• Unique user identification and authentication
• Automatic session timeout
• Access logging and monitoring

2. Data Encryption

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest using AES-256
• Secure key management practices

3. Network Security

• Firewalls and intrusion detection/prevention systems
• DDoS protection
• Network segmentation
• Regular vulnerability scanning

4. Physical Security

• Data hosted in Google Cloud Platform data centers
• Physical access controls, surveillance, and environmental protections
• Geographic redundancy

5. Operational Security

• Documented security policies and procedures
• Security awareness training for personnel
• Background checks for personnel with access to Personal Data
• Incident response procedures

6. Data Protection

• Regular backups with encryption
• Disaster recovery capabilities
• Data deletion procedures

7. Vendor Management

• Security assessment of Subprocessors
• Contractual security requirements for Subprocessors

8. Monitoring and Testing

• Continuous security monitoring
• Regular penetration testing and vulnerability assessments
• Security incident logging and analysis