Data Processing Addendum

This DPA is incorporated by reference into, and forms part of, the Agreement. By clicking “I accept the DPA” in the Service, or by continuing to use the Service after we have notified you of an updated DPA, the Controller agrees to its terms. The DPA is a stand-alone data-processing agreement for the purposes of Article 28(3) of GDPR and Article 28(3) of the UK GDPR.

• Personal Data has the meaning in Article 4(1) GDPR, including any data relating to an identified or identifiable natural person that the Controller submits to the Service.
• Processing, Controller, Processor, Sub-processor, Data Subject, Supervisory Authority and Personal Data Breach have the meanings given in Article 4 GDPR.
• Restricted Transfer means a transfer of Personal Data from the EEA, the United Kingdom, or Switzerland to a country outside that jurisdiction that is not the subject of an adequacy decision.
• Controller Personal Data means the Personal Data that the Controller submits to the Service in the form of bank-statement PDFs, client records, and any other data uploaded to or generated by the Controller’s workspace.

The parties acknowledge that, for the purposes of GDPR, the UK GDPR, the Swiss FADP, and equivalent laws:

• The Controller is the customer (typically a bookkeeper, accountant, or accounting firm) that determines the purpose and means of the Processing of Controller Personal Data in the course of providing bookkeeping or accounting services to its own clients.
• The Processor is ProofRows, which Processes Controller Personal Data only on the Controller’s documented instructions, as set out in this DPA and the Agreement.
• The data subjects are the Controller’s own clients (typically the businesses or individuals whose bank statements the Controller uploads) and any natural persons named in those statements (e.g. payees, account holders).

• Subject matter: the Processor’s provision of the bank-statement clean-up and export service to the Controller.
• Nature: receipt, storage, automated extraction, review-assistance, and export of bank-statement PDFs and the resulting transaction data.
• Purpose: providing the Service to the Controller; no other purpose.
• Duration: for the term of the Agreement, and thereafter until the Controller Personal Data is returned or deleted in accordance with §15.

• Categories of Personal Data: bank-account holder names, account numbers (typically masked to last 4 digits after extraction), bank names, transaction dates, descriptions, debit/credit amounts, balances, counter-party names appearing in transactions, and any free-text fields the Controller enters when reviewing a statement. The Service does not process special categories of data within the meaning of Article 9 GDPR, and the Controller must not upload such data.
• Categories of Data Subjects: the Controller’s own clients (typically small-business owners and sole proprietors); account holders and authorised signatories of the bank accounts appearing on uploaded statements; and any natural persons named in transaction descriptions.

The Processor shall Process Controller Personal Data only on documented instructions from the Controller, including with regard to Restricted Transfers, unless the Processor is required to do otherwise by Union or Member State law or by the law of another jurisdiction to which the Processor is subject (in which case the Processor shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest). The Controller’s initial instructions are set out in the Agreement, this DPA, and the configuration of the Controller’s workspace. If the Processor reasonably believes that an instruction infringes GDPR, the UK GDPR, the Swiss FADP, or other applicable data-protection law, it shall immediately inform the Controller.

The Processor shall:

1. Process Controller Personal Data only on the Controller’s documented instructions;
2. ensure that persons authorised to Process Controller Personal Data have committed themselves to confidentiality;
3. implement the technical and organisational measures set out in §10 and Annex II to protect Controller Personal Data;
4. engage Sub-processors only in accordance with §8;
5. assist the Controller in fulfilling the Controller’s obligation to respond to Data Subject rights requests under Chapter III GDPR (see §12);
6. assist the Controller in ensuring compliance with Articles 32 to 36 GDPR (see §10, §11, §13);
7. at the Controller’s choice, return or delete Controller Personal Data in accordance with §14;
8. make available to the Controller all information necessary to demonstrate compliance with Article 28 GDPR and allow for, and contribute to, audits and inspections in accordance with §15.

8.1 General authorisation

The Controller grants the Processor general written authorisation to engage Sub-processors, on the terms of this §8. The Privacy page publishes the current categories of Sub-processor. The Processor maintains a current list naming the Sub-processor engaged within each category, and shall provide that named list to the Controller on request at privacy@proofrows.com. The named list, as provided from time to time, is incorporated into this DPA by reference, and the Processor shall update it before engaging any new Sub-processor.

8.2 Change notification

The Processor shall give the Controller at least 30 days’ prior written notice of any intended addition or replacement of a Sub-processor where reasonably practicable. Notice may be provided through the Service, by email to the Controller’s account contact, or on the Privacy page. If a shorter period is required by law, security, or provider availability, the Processor will give notice as soon as reasonably practicable. The Controller may object to the change for reasonable data-protection grounds within the 30-day notice period by emailing privacy@proofrows.com. If the Controller objects and the Processor cannot accommodate the objection, the Controller may terminate the affected part of the Service and the Processor will refund any pre-paid, unused fees on a pro-rata basis.

8.3 Flow-down obligations

The Processor shall impose on each Sub-processor, by way of a written contract, data-protection obligations no less protective than those set out in this DPA, and shall remain fully liable to the Controller for the performance of each Sub-processor’s obligations.

9.1 EU-US Data Privacy Framework

For Restricted Transfers from the EEA to a Sub-processor in the United States that is self-certified under the EU-US Data Privacy Framework (DPF) adequacy decision of 10 July 2023, no further transfer mechanism is required. The current DPF status of each US Sub-processor is set out on the Privacy page.

9.2 EU Standard Contractual Clauses — Module 2

For Restricted Transfers from the EEA to a Sub-processor in a third country that is not the subject of an adequacy decision and is not DPF-certified, the parties incorporate by reference the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 (Module Two: Controller-to-Processor). The Annexes are:

• Annex I.A (List of Parties): the Controller is the customer identified in the executed order form or signed-up workspace; the Processor is ProofRows, a United States-based service provider. The parties’ complete notice details will be recorded in an applicable order form or executed Annex I. A template Annex I is set out at the bottom of this page.
• Annex I.B (Details of the Transfer): categories of Data Subjects and Personal Data are as described in §5; sensitive data is none; frequency is continuous; retention is as set out in §14; Sub-processor list is at /privacy.
• Annex II (Technical and Organisational Measures): the TOMs set out in §10 and Annex II below.
• Annex III (Sub-processor list): the list on /privacy.

Clause 7 (Docking clause) of the SCCs is included. For a Restricted Transfer that relies on the SCCs, the parties will record an eligible EU Member State law and forum for Clauses 17 and 18 in an executed Annex I or order form before relying on the SCCs for that transfer.

9.3 UK International Data Transfer Addendum

For Restricted Transfers from the United Kingdom, the parties incorporate the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner on 21 March 2022 (the “UK Addendum”), which modifies the EU SCCs to make them valid under the UK GDPR. The UK Addendum applies automatically to any transfer that is also an EU transfer under §9.2.

9.4 Swiss FADP SCCs

For Restricted Transfers from Switzerland, the parties incorporate the EU SCCs as set out in §9.2 with the following “Swiss Rider” adaptations required by the revised Federal Act on Data Protection (in force 1 September 2023) and recognised by the FDPIC: (a) references to GDPR are read as references to the FADP; (b) the competent Supervisory Authority is the FDPIC; (c) the governing law is the law of Switzerland and the forum is the courts of Switzerland at the Data Subject’s place of habitual residence; and (d) the parties have completed and documented a Transfer Impact Assessment.

The Processor has implemented and shall maintain the technical and organisational measures listed in Annex II at the bottom of this page. These measures are designed to ensure a level of security appropriate to the risk of the Processing, in accordance with Article 32 GDPR. The Processor reviews and updates the measures as the Service evolves, and makes the current TOMs available to the Controller on request.

The Processor shall notify the Controller of a Personal Data Breach affecting Controller Personal Data without undue delay, and in any event within 48 hours of becoming aware of the breach, so that the Controller can satisfy its own obligations under Article 33 GDPR (72-hour supervisory-authority notification) and Article 34 GDPR (Data Subject notification). The initial notification shall, to the extent then known, describe the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, and the measures taken or proposed. Further information shall be provided in phases as it becomes available.

Taking into account the nature of the Processing, the Processor shall assist the Controller, by appropriate technical and organisational measures, in responding to Data Subject rights requests. The Service provides self-service tools in Settings for the Controller to action most requests; for anything else, the Controller may email privacy@proofrows.com. The Processor shall not respond directly to a Data Subject except to redirect the Data Subject to the Controller, unless instructed in writing by the Controller.

The Processor shall provide the Controller, on request, with the information reasonably necessary to enable the Controller to conduct a Data Protection Impact Assessment under Article 35 GDPR or to engage in prior consultation with a Supervisory Authority under Article 36 GDPR.

On termination of the Agreement (or sooner on the Controller’s written request), the Processor shall, at the Controller’s choice:

• Return all Controller Personal Data to the Controller in a structured, commonly used, machine-readable format (CSV, JSONL, or PDF, as the Controller requests and the data allows); and thereafter
• Delete all copies of Controller Personal Data in the Processor’s possession or control, within 30 days of the termination date, except where retention is required by applicable law.

Account self-deletion in Settings → Danger zone satisfies the Controller’s return-and-delete election in a single step.

The Processor shall make available to the Controller, on reasonable request and not more than once per calendar year, the information necessary to demonstrate compliance with this DPA, by:

• responding in writing to a reasonable security questionnaire;
• providing the Controller with a copy of docs/SECURITY_AND_PRIVACY.md and any updated TOMs;
• allowing the Controller (or an independent auditor bound by confidentiality) to conduct a remote review of the Processor’s security documentation, with at least 30 days’ prior written notice; and
• on the Controller’s written request and at the Controller’s cost, permitting an on-site audit of the Processor’s Processing locations during business hours, with at least 30 days’ prior written notice, no more than once per calendar year, subject to confidentiality.

The Processor does not currently hold a SOC 2 Type II or ISO 27001 attestation; once obtained, the audit-rights clause will be updated to grant the Controller a right of access to the report on the same notice terms.

Liability under this DPA is allocated in accordance with the limitation-of-liability provisions of the Agreement, except that the parties’ respective liability for damages caused by their own infringement of GDPR, the UK GDPR, or the Swiss FADP shall not be subject to any contractual cap that is lower than the cap permitted by the applicable data-protection law.

The Processor’s privacy contact for all matters under this DPA is privacy@proofrows.com. The Processor has not appointed a Data Protection Officer under Article 37 GDPR because its core activities do not consist of large-scale regular and systematic monitoring of Data Subjects, large-scale processing of special categories of data, or processing by a public authority. This determination shall be kept under review and a DPO shall be appointed if the triggering criteria are met.

Where required by Article 27 GDPR, Article 27 UK GDPR, or similar regional law, the Processor will appoint a representative and publish the representative’s contact details on the Privacy page.

In the event of any conflict between this DPA and the Agreement with respect to the Processing of Controller Personal Data, this DPA shall prevail. For all other matters, the Agreement prevails.

The Processor may update this DPA from time to time. Material changes will normally be notified to the Controller at least 30 days in advance through the Service, by email, or on this page. Continued use of the Service after the effective date of the updated DPA constitutes acceptance, except for changes that materially increase the Processor’s data-protection obligations, in which case the Controller may terminate the affected part of the Service and receive a pro-rata refund of any pre-paid, unused fees.

This DPA follows the governing-law and dispute provisions in the Agreement, except where applicable data-protection law requires a different result. The SCCs, the UK Addendum, and the Swiss rider are governed by their own choice-of-law clauses and any selections recorded in the applicable Annex or order form.

For all privacy, DPA, sub-processor, breach, and Data Subject rights matters: privacy@proofrows.com. To request the executed Annex I (Parties), Annex II (TOMs), or Annex III (Sub-processors) for your account, email privacy@proofrows.com with your workspace name.

The Controller may use this template to record the parties and details of the Restricted Transfer covered by the EU SCCs Module 2, the UK Addendum, and the Swiss rider. Send the completed form to privacy@proofrows.com; we will countersign and return a copy for your records.

A. Parties

• Data exporter (Controller): the customer legal name, address, contact name, role, email, and phone recorded in the customer’s completed Annex or order form.
• Data importer (Processor): ProofRows, a United States-based service provider. The business address will be recorded in the executed Annex. Contact: privacy@proofrows.com.

B. Details of the Transfer

• Categories of Data Subjects: the Controller’s own clients (data subjects whose bank statements the Controller processes) and natural persons named in those statements.
• Categories of Personal Data: account-holder names, masked account numbers, transaction dates, descriptions, debit/credit amounts, balances, counter-party names, and free-text fields entered by the Controller during review.
• Sensitive data: none. The Controller must not upload special-category data within Article 9 GDPR.
• Frequency: continuous, for the duration of the Agreement.
• Retention: per-client retention period configured in the Controller’s workspace (default 30 days for source PDFs; transactions and export logs retained for the life of the account unless the Controller deletes them).
• Sub-processor list: /privacy, incorporated by reference.
• Competent Supervisory Authority: the Supervisory Authority of the Controller’s place of establishment (EU/UK), or the FDPIC (Switzerland).

Mapped to Article 32 GDPR. The Processor shall implement and maintain, as a minimum, the following measures:

1. Pseudonymisation and encryption. TLS 1.2+ in transit for all client and inter-service traffic. AES-256 encryption at rest in Supabase Postgres and the private statement-files storage bucket. API keys are stored as one-way hashes in api_keys.key_hash; the plaintext token is shown to the user once and never persisted.
2. Confidentiality. Personnel with access to Controller Personal Data are limited to authorised operators with a need to provide or support the Service and are subject to confidentiality obligations. Product access is gated by Supabase Auth and role-based workspace membership. Privileged service credentials remain server-side and are not exposed to browser clients.
3. Integrity. Row-Level Security on every product table restricts read and write to the owning user or org. PDF access is via 60-second signed URLs minted only after an RLS-scoped read. The service-role key bypasses RLS only on the explicit allowlist documented in docs/SECURITY_AND_PRIVACY.md.
4. Availability and resilience. The Service uses managed database, object-storage, and application-hosting providers. Automated health probes cover the application, database contracts, object storage, and extraction-provider configuration. Background work is retryable and failed jobs remain visible to authorised operators.
5. Restoration and deletion. Source-file deletion is separated from structured transaction records so retention cleanup does not erase completed ledger data. Database recovery depends on the backup capability enabled for the production database account; ProofRows documents and periodically tests the applicable recovery procedure and does not represent that point-in-time recovery is active unless confirmed in writing.
6. Regular testing. The Processor maintains a security regression test suite: scripts/test-upload-e2e.mjs (cross-user RLS isolation), scripts/test-auth-gating.mjs (page and API gating), scripts/test-csv-export.ts and scripts/test-export-profiles.ts (export-injection protection), and scripts/test-sentry-scrub.ts (PII scrubbing before observability export). These tests run on every change before deploy.
7. Incident response. A documented incident-response process is maintained, anchored on the breach-notification obligation in §11. Automated production health and dependency checks surface service failures; the Processor records the discovery time, scope, remediation, and notification decisions for a confirmed incident.
8. Sub-processor management. The Privacy page publishes the current categories of Sub-processor and the named list is available on request. Each engaged Sub-processor is subject to written data-protection terms, and the change-notification process in §8.2 applies.
9. Logging discipline. The structured logger (lib/observability/log.ts) uses a constrained set of operational fields. Transaction descriptions, vendor names, account numbers, balances, and statement text must not be logged. When external error reporting is configured, the same sensitive fields are scrubbed before an event is sent.