Data Processing Addendum

This addendum is part of the agreement between you, the customer, and ProfytAI Pte. Ltd. under our Terms of Service, or under a written order that references them. Together they are the agreement. It takes effect when the agreement does and lasts for as long as we process customer personal data for you.

You accept it by accepting the Terms of Service. No signature is needed for it to bind both parties. If your procurement or compliance process needs a countersigned copy for your records, ask through our contact page. Signing a copy does not change these terms.

For customer personal data, this addendum controls over any conflicting term elsewhere in the agreement. Where the Standard Contractual Clauses or the UK Addendum apply under section 11, they control over this addendum.

Words defined in the Terms of Service have the same meaning here, including customer, workspace, workspace admin, viewer, lead data, customer content, customer personal data and data protection law. This addendum also uses the following.

• Controller, processor, data subject, personal data and processing have the meanings data protection law gives them. A business and a service provider under United States state law are treated as a controller and a processor.
• Subprocessor. A third party we engage that processes customer personal data in providing the service.
• Personal data breach. A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, customer personal data that we or our subprocessors hold.
• Standard Contractual Clauses. The clauses approved by Commission Implementing Decision (EU) 2021/914 for transfers of personal data to third countries.
• UK Addendum. The International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner.

For customer personal data, you are the controller, or a processor acting for your own client, and ProfytAI Pte. Ltd. is your processor, or your subprocessor. Each party will comply with the data protection law that applies to it. Annex 1 describes the processing.

Where we are a controller. For account, sign-in, billing, website, support and security data, and for the product usage records described in our Privacy Policy, ProfytAI Pte. Ltd. is an independent controller under that policy, and this addendum does not apply to it.

Your responsibilities. You are responsible for the lawfulness of the customer personal data you give us and of your instructions, including the matters in clause 09 of the Terms of Service on lead capture. You warrant that you have given every notice and obtained every consent data protection law requires for us to process customer personal data under this addendum.

We will process customer personal data only on your documented instructions, unless the law requires otherwise, in which case we will tell you before processing unless the law forbids it. The agreement, your settings and your use of the service’s features are your complete instructions. Any further instruction must be consistent with the agreement. We will tell you if we believe an instruction breaks data protection law.

Proovyt has no generative AI features. We do not send customer personal data to any AI provider, and we do not use it to train machine-learning models, ours or anyone else’s.

We will make sure that everyone we authorize to process customer personal data is bound by an obligation of confidentiality and has access only as needed to provide, support and secure the service.

We will maintain appropriate technical and organizational measures to protect customer personal data, taking into account the state of the art, the cost, the nature of the processing and the risks to people. They include at least the measures in Annex 2. We may update them, provided an update does not lower the overall level of protection.

The service lets you export and delete lead data yourself, on every plan, which is how you answer most requests from data subjects. If we receive a request from a data subject about customer personal data, we will not answer it ourselves, other than to tell the person to contact you, and we will pass it to you without undue delay. Where you cannot answer a request with the service’s own tools, we will give you reasonable help.

Taking into account the nature of the processing and the information available to us, we will give you reasonable help with data protection impact assessments, with prior consultations with regulators, and with your own security obligations.

If a government or law enforcement body asks us for customer personal data, we will try to redirect it to you and, where the law allows, tell you before we answer. We will not disclose customer personal data unless the law requires us to.

We will notify you without undue delay, and in any case within 72 hours, after we become aware of a personal data breach. We will notify the workspace admin by email. Our notice will describe, as far as we then know, the nature of the breach, the categories and approximate number of people and records affected, the likely consequences, and the measures taken or proposed. We may give this information in stages as we learn it.

We will take reasonable steps to contain the breach and reduce its effects, and we will cooperate with you in meeting your own notification duties. Our notice is not an admission of fault.

We will make available to you the information reasonably necessary to demonstrate compliance with this addendum, including written answers to a reasonable security questionnaire once in any 12 month period.

If that information is not enough to meet a requirement of data protection law or a regulator, you may audit our compliance once in any 12 month period, on at least 30 days’ written notice, during business hours, at your own cost, with a scope agreed in advance, and under a duty of confidentiality, through an independent auditor who is not our competitor. An audit must not give access to other customers’ data or unreasonably disrupt the service. A regulator’s audit is not limited by this section.

Where the California Consumer Privacy Act as amended, or a similar United States state privacy law, applies to customer personal data, we act as your service provider or processor. We will not sell or share it, as those laws use the words. We will not retain, use or disclose it for any purpose other than providing the service, or outside our direct business relationship with you. We will not combine it with personal data we receive from other sources, except as those laws permit a service provider to do. We will tell you if we can no longer meet these obligations, and you may then take reasonable steps to stop and remedy unauthorized use.

You can export lead data as CSV files, and your demos as a project backup, at any time while your account exists, on every plan. Lead data is deleted automatically at the end of the retention period your workspace chooses, and when you delete a lead or its demo.

When a workspace is deleted, because its only member deleted their account or because we closed it, we will delete its customer personal data from the live service within 30 days. Self-serve account deletion does so within 8 days, which is the 7 day grace period and the next daily run. Copies in backups are overwritten in the ordinary course, within 14 days for the database and 90 days for earlier versions of stored files, and stay protected under this addendum until then. On request, we will confirm the deletion in writing.

We may keep customer personal data for longer only where the law requires it. We will then keep protecting it under this addendum and process it only for that purpose.

Each party’s liability under this addendum, the Standard Contractual Clauses and the UK Addendum, taken together, is subject to the limitations and exclusions in clause 20 of the Terms of Service, except where data protection law or those clauses do not allow it to be limited. Nothing in this addendum limits the rights of data subjects.

Term. This addendum ends when we have deleted all customer personal data under section 14. The sections that by their nature should continue survive it.

Changes. We may update this addendum as the law and the service change. We will give at least 30 days’ notice of a material change by email to the workspace admin, and no change will lower the protection of customer personal data during a paid subscription term, unless the law requires it.

Governing law. This addendum is governed by the law and courts chosen in clause 22 of the Terms of Service, except where the Standard Contractual Clauses, the UK Addendum or data protection law require otherwise.

Severability. If any provision is held unenforceable, the rest of this addendum stays in effect, and the unenforceable provision is limited to the minimum extent needed.

• Parties. The data exporter is the customer, whose name, address and contact are those on its Proovyt account, acting as controller or processor. The data importer is ProfytAI Pte. Ltd., UEN 202542653R, 10 Anson Road, #17-11, International Plaza, Singapore 079903, reachable through our contact page, acting as processor or subprocessor.
• Subject matter and purpose. Providing the service to the customer. That means storing, hosting, encrypting, displaying, analyzing, exporting and deleting customer personal data so the customer can publish demos, collect leads, see viewer analytics and use the rest of the service.
• Data subjects. Viewers of the customer’s demos, viewers who send its lead forms, and people who appear in its customer content.
• Categories of personal data. For lead form submitters, name, email address, company if given, the consent answer and the consent wording shown, submission times and count, and visits, steps reached, completion, time in the demo and last seen. For other viewers, the pseudonymous analytics events described in our Privacy Policy, which hold no cookie and no stored IP address. For people in customer content, whatever the screenshots, page copies and text contain.
• Sensitive data. None is intended. The customer must not submit special categories of personal data or sensitive personal data through the service.
• Frequency. Continuous, while the service is in use.
• Duration and retention. For as long as the customer uses the service, and until the data is deleted under section 14. Lead data is kept for the period the workspace admin chooses, from 30 to 730 days, 365 by default. Viewer analytics events are kept for 6 months.
• Transfers to subprocessors. For the purposes and in the locations listed in Annex 3.

• Encryption in transit with TLS 1.2 or later, and encryption at rest for the database and file storage.
• Encryption of every lead form field, the consent answer and the consent wording with AES-256-GCM under a dedicated key, bound to the workspace, demo and record.
• Access to lead data limited to the demo’s owner and the workspace admins.
• Each workspace’s content in its own database schema, and access decisions made by a central access control service that refuses access when it cannot answer.
• Passwords that never reach our servers, optional two-factor authentication for customers, and session tokens stored only as one-way hashes.
• Pseudonymous viewer analytics with no cookies, no stored IP address, and a daily salt that is deleted after its day.
• Protected demos served from private storage with short-lived signed links, and never cached by the content delivery network.
• Rate limits, bot filtering, web application firewalls and least-privilege database roles.
• Staff access through an operator console with required two-factor authentication and an append-only audit log.
• No lead field written to application logs, and error reports scrubbed of email addresses and tokens.
• Database backups kept for 14 days and earlier versions of stored files for 90 days, so deleted data does not persist indefinitely.
• Physical security of the data centers, provided by Amazon Web Services.

The subprocessors authorized under section 7 are those on our Subprocessors page, with what each one does and where it processes data. Today they are Amazon Web Services, Amazon Web Services (Amazon CloudFront), Amazon Web Services (Amazon Cognito), Amazon Web Services (Amazon SES), Stripe. The page also lists, as not yet in use, Sentry (Functional Software, Inc.), which will process data only once its notice period under section 7.2 has passed.