Data Processing Addendum

1. Scope and definitions

This DPA forms part of the customer agreement that expressly incorporates it between Proclify LLC (“Proclify”) and the customer (“Customer”). “Customer Data” means personal data that Customer or its users provide to, store in, or make available through the applicable service. “Personal Data,” “process,” “controller,” “processor,” “data subject,” and “personal data breach” have the meanings given by applicable data protection law.

“Subprocessor” means a third party engaged by Proclify to process Customer Data for the service. “Data Protection Law” means the privacy and data protection laws that apply to the processing described in the customer agreement. If this DPA conflicts with a mandatory rule of applicable law, that rule controls.

2. Roles and documented instructions

For Customer Data processed to provide the service, Customer is the controller or processor that determines the purposes and means of processing, and Proclify is the processor or subprocessor acting on Customer's behalf. Customer is responsible for its instructions, notices, permissions, and legal basis. Proclify may act as an independent controller for account, billing, security, or relationship information that it uses for its own lawful purposes, as described in the Privacy Policy.

Proclify will process Customer Data only to provide, secure, support, maintain, and improve the applicable service as instructed in the customer agreement, this DPA, documented support requests, or the service configuration. Proclify will tell Customer if it believes an instruction conflicts with applicable law, unless law prohibits that notice.

3. Confidentiality

Proclify will keep Customer Data confidential and will provide access only to personnel, contractors, and subprocessors who need it for the applicable service and who are bound by confidentiality duties. Proclify may disclose Customer Data when required by law; where legally permitted, Proclify will give Customer advance notice and reasonable assistance so Customer can seek a protective measure.

4. Security

Proclify will maintain reasonable technical and organizational measures appropriate to the risk, nature, scope, context, and purposes of processing. The measures are described in Annex 2 and may be updated as the service and risk profile change. Customer remains responsible for its users, endpoints, credentials, configurations, instructions, and decisions about what data to submit.

5. Personal data incidents

If Proclify confirms a personal data breach affecting Customer Data, Proclify will notify Customer without undue delay after confirmation, subject to legal restrictions. The notice will include information reasonably available about the nature of the incident, affected data or systems, likely consequences, and response measures. Proclify will take reasonable steps to contain, investigate, and remediate the incident and will provide reasonable updates as appropriate.

Customer is responsible for notifying regulators, data subjects, or other parties when required for its role, unless the parties agree otherwise. An incident notice is not an admission of fault or liability.

6. Subprocessors

Customer gives Proclify general authorization to engage subprocessors that are needed to provide the applicable service. Proclify will require each subprocessor to protect Customer Data under written obligations appropriate to the processing. Proclify remains responsible for a subprocessor's performance of those obligations to the extent required by Data Protection Law and the customer agreement.

Proclify does not represent that a planned or described vendor is currently configured for a service. The disclosure and change-notice process for the applicable service appears in Annex 3.

7. Data-subject requests and assistance

Customer is responsible for responding to data-subject requests concerning Customer Data. If Proclify receives a request that appears to relate to Customer Data, Proclify will direct the requester to Customer where legally permitted and will notify Customer unless prohibited.

Taking account of the processing and information available, Proclify will provide reasonable assistance with access, correction, deletion, portability, restriction, objection, consent withdrawal, impact assessments, and regulator consultation when Customer cannot reasonably complete the task without Proclify's help. Customer will reimburse reasonable, documented costs for assistance beyond ordinary service functionality where the customer agreement permits those costs.

8. Return and deletion

At the end of the applicable service or on Customer's written request, Proclify will, at Customer's choice, return or delete Customer Data within a reasonable period, unless retention is required by law or the customer agreement. Proclify may retain a protected archival copy for a limited period where needed for legal, security, backup, or dispute purposes, after which it will be deleted or isolated from further processing.

9. Audits and information

Proclify will make available information reasonably necessary to demonstrate compliance with this DPA, subject to confidentiality, security, and protection of other customers. Customer may request a written questionnaire, relevant policies, or an independent assessment or report if one exists and is appropriate to the processing.

If that information is not reasonably sufficient, Customer may request an audit on reasonable written notice, during normal business hours, no more than once in a twelve-month period unless a confirmed incident or law requires otherwise. Audits must avoid disruption, protect other customers, and not expose security-sensitive details. Customer pays its audit costs unless the customer agreement says otherwise.

10. International transfers

Proclify will process or transfer Customer Data outside the place where Customer collected it only as needed for the applicable service and as permitted by Data Protection Law. If a law requires a transfer safeguard, the parties will select and document the safeguard in the customer agreement, an order, or another applicable data protection addendum. This DPA does not assert that a particular adequacy decision, standard contractual clause, certification, or other mechanism has been completed or applies to every customer.

11. Liability, priority, and changes

Liability for this DPA follows the liability allocation in the applicable customer agreement. This DPA does not expand a party's liability beyond that agreement unless the agreement expressly says so. If this DPA conflicts with the customer agreement on data protection, this DPA controls only for that conflict; if the conflict concerns commercial terms, the customer agreement controls.

Proclify may update this DPA to reflect changes in the service, law, or subprocessors. For a customer with an active agreement, a material change will apply only as allowed by that agreement, and Proclify will provide reasonable notice where required.

Annex 1 — Processing details

Subject matter and purpose

Proclify processes Customer Data to provide the service, host or transmit customer-configured content, authenticate authorized users where applicable, provide support, maintain security and availability, troubleshoot, and follow documented Customer instructions.

Duration

Processing continues for the term of the applicable customer agreement and the limited deletion or retention period described in Section 8.

Data subjects

Depending on the service, data subjects may include Customer's personnel, users, customers, prospective customers, business contacts, and other people whose data Customer submits.

Data categories

Categories may include names, contact details, organization and account information, identifiers, authentication and permission data, communications, support information, usage and technical data, and other Customer Content. Depending on Customer's configuration and instructions, Customer Content may also include customer names, email addresses, phone numbers, staff records, services, appointments, sales, customer documents, treatment charts, or tenant audit events. Customer should not submit special-category or highly sensitive data unless the customer agreement expressly permits it and the required safeguards are documented.

Processing operations

Operations may include collection from Customer, organization, storage, hosting, retrieval, access, transmission, support, security monitoring, export, return, and deletion, as configured for the applicable service.

Annex 2 — Security measures

Measures are selected for the service and risks actually in scope. They may include:

• access based on role and need, with administrative controls for credentials and permissions;
• authentication and secrets handling appropriate to the service configuration;
• encryption in transit and, where available and appropriate, at rest;
• logging and monitoring designed to identify operational or security events;
• backups, recovery, and continuity practices appropriate to the service;
• secure development, change review, vulnerability response, and dependency management appropriate to the service;
• confidentiality commitments and security awareness for personnel with access; and
• incident response, access review, retention, and secure deletion procedures.

These descriptions are not a certification, warranty, or promise that every listed measure is active for every Proclify offering. The applicable customer agreement may document service-specific measures.

Annex 3 — Subprocessor disclosure process

For a customer that requests it, Proclify will identify the subprocessors authorized for the applicable service, their processing function, and their relevant location information to the extent reasonably available. Contact hello@proclify.com for the current service-specific disclosure.

Before adding a subprocessor that materially changes the processing risk, Proclify will provide notice where required by the customer agreement. Customer may raise a documented, reasonable objection based on data protection risk. The parties will work in good faith on a commercially reasonable alternative; if no alternative is available, the customer agreement governs the available remedy.

Contact

For DPA execution, service-specific processing details, or privacy questions, contact:

Proclify LLC
5900 Balcones Drive, STE 100
Austin, TX 78731
hello@proclify.com