Data Processing Agreement

Last Updated: March 15, 2026

1. Definitions

In this DPA:

• "Customer" means the entity that has agreed to the Terms of Service
• "Customer Data" means any data uploaded by Customer to the Service
• "Personal Data" means any information relating to an identified or identifiable natural person
• "Processing" means any operation performed on Personal Data
• "Sub-processor" means any third party engaged by SpotProof to process Customer Data
• "Data Protection Laws" means applicable laws relating to data protection and privacy, including CCPA, PIPEDA, and GDPR where applicable

2. Scope and Roles

2.1 Scope

This DPA applies to the Processing of Customer Data by SpotProof in connection with providing the Service.

2.2 Roles

For purposes of this DPA:

• Customer is the Data Controller (or "Business" under CCPA) determining the purposes and means of Processing
• SpotProof is the Data Processor (or "Service Provider" under CCPA) Processing data on Customer's behalf

3. Data Processing Details

4. SpotProof's Obligations

4.1 Processing Limitations

SpotProof will:

• Process Customer Data only as instructed by Customer and as necessary to provide the Service
• Not sell, rent, or share Customer Data with third parties except as permitted by this DPA
• Not Process Customer Data for its own purposes beyond providing the Service
• Promptly notify Customer if an instruction appears to violate Data Protection Laws

4.2 Data Security

SpotProof will implement appropriate technical and organizational measures including:

• Encryption of data in transit via TLS
• Access controls limiting data access to authorized personnel
• Regular security assessments and monitoring
• Incident response procedures
• Employee confidentiality obligations and training

4.3 Data Minimization

SpotProof implements data minimization practices:

• Secure internal copies of uploaded files may be retained in limited circumstances for parser testing and quality improvement
• Only structured results and metadata are retained
• Template learning extracts only structural patterns, not data content
• Personal Data is not used for purposes unrelated to the Service

4.4 Confidentiality

SpotProof will ensure that personnel authorized to process Customer Data are bound by confidentiality obligations.

4.5 Data Subject Requests

SpotProof will:

• Promptly notify Customer of any data subject requests received
• Not respond directly to data subjects except to direct them to Customer
• Provide reasonable assistance to enable Customer to respond to requests

5. Sub-processors

5.1 Current Sub-processors

5.2 Sub-processor Changes

SpotProof will:

• Notify Customer of new sub-processors at least 14 days before engagement
• Ensure sub-processors are bound by data protection obligations no less protective than this DPA
• Remain liable for sub-processor compliance

Customer may object to a new sub-processor by notifying SpotProof within 14 days. Parties will work in good faith to resolve objections.

6. Customer's Obligations

Customer will:

• Ensure it has lawful basis to transfer data to SpotProof
• Provide required notices and obtain necessary consents from data subjects
• Not upload data prohibited by the Terms of Service
• Maintain appropriate security of its own systems and credentials

7. Data Breach Notification

7.1 Notification

SpotProof will notify Customer without undue delay (and in any event within 72 hours) after becoming aware of a security incident affecting Customer Data.

7.2 Notification Content

Notification will include, to the extent known:

• Nature of the incident and categories of data affected
• Approximate number of data subjects and records affected
• Likely consequences of the incident
• Measures taken or proposed to address the incident

7.3 Cooperation

SpotProof will cooperate with Customer's investigation and provide reasonable assistance in meeting breach notification obligations.

8. Audits

8.1 Documentation

SpotProof will maintain documentation demonstrating compliance with this DPA and make it available upon request.

8.2 Audit Rights

Upon reasonable notice (at least 30 days), Customer may:

• Request and review security certifications and audit reports
• Submit written questions about SpotProof's data protection practices
• For Agency plan customers: conduct or commission an on-site audit (once per year, during business hours, at Customer's expense)

9. Data Deletion and Return

9.1 During Term

Customer may export or delete data through the Service at any time.

9.2 Upon Termination

Upon termination of the agreement:

• Customer may export data within 30 days
• After 30 days, SpotProof will delete Customer Data except where retention is required by law
• SpotProof will provide written confirmation of deletion upon request

10. International Transfers

10.1 Transfer Mechanisms

Customer Data may be processed in the United States. For transfers from jurisdictions requiring additional safeguards:

• SpotProof relies on Standard Contractual Clauses where applicable
• Sub-processors maintain appropriate certifications and transfer mechanisms

10.2 Government Access Requests

If SpotProof receives a government request for Customer Data, it will:

• Notify Customer before disclosure (unless legally prohibited)
• Challenge requests that appear unlawful
• Provide only the minimum data legally required

11. Liability

Liability under this DPA is subject to the limitations set forth in the Terms of Service. Nothing in this DPA limits either party's liability for:

• Death or personal injury caused by negligence
• Fraud or fraudulent misrepresentation
• Any liability that cannot be limited by applicable law

12. Term

This DPA remains in effect for the duration of SpotProof's Processing of Customer Data. Obligations regarding confidentiality and data deletion survive termination.

13. Modifications

SpotProof may update this DPA to reflect changes in Data Protection Laws or sub-processors. Material changes will be communicated at least 30 days in advance.

14. Contact

For DPA-related inquiries:

SpotProof Data Protection
Email: [email protected]
Website: https://spotproof.app

Appendix A: Standard Contractual Clauses

For customers requiring Standard Contractual Clauses (SCCs) for international data transfers, SpotProof will execute the EU Commission's SCCs upon request. Contact [email protected] to request execution.