Data Processing Agreement

Last updated: October 6, 2026 · Effective October 6, 2026 for new accounts and November 5, 2026 for accounts created before October 6, 2026

1. Definitions

• "Agreement" means the Terms of Service and any order form between Customer and Prosabe.
• "Customer Personal Data" means personal data contained in Customer Content that Prosabe processes on behalf of Customer in providing the Service.
• "Data Protection Laws" means all laws applicable to the processing of Customer Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, the California Consumer Privacy Act as amended ("CCPA") and other U.S. state privacy laws, Brazil's Lei Geral de Proteção de Dados ("LGPD"), Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares, Chile's Laws 19,628 and 21,719, Argentina's Law 25,326, Colombia's Law 1581 of 2012 and Peru's Law 29733.
• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• "Subprocessor" means any third party engaged by Prosabe to process Customer Personal Data.
• "SCCs" means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, the UK International Data Transfer Addendum issued by the UK Information Commissioner, and the standard contractual clauses approved by Brazil's ANPD in Resolution CD/ANPD No. 19/2024, as applicable.

Terms such as "controller", "processor", "data subject", "processing", "business", "service provider", "sell" and "share" have the meanings given in the applicable Data Protection Laws.

2. Roles and Scope

2.1. Customer is the controller (or business) and Prosabe is the processor (or service provider) of Customer Personal Data. Where Customer is itself a processor on behalf of a third-party controller, Prosabe acts as Customer's subprocessor.

2.2. This DPA does not apply to personal data for which Prosabe is a controller, such as account administration, billing, security and communications data, which is governed by the Privacy Policy.

3. Details of Processing

Item	Description
Subject matter	Provision of the Prosabe Service: SOP repository, AI generation, editing, import and analysis, operational assistant (web and WhatsApp), team collaboration, sharing and storage.
Duration	The term of the Agreement plus the deletion period in Section 12.
Nature and purpose	Hosting, storage, retrieval, organization, transmission to AI and messaging providers, display, export, sharing as instructed by Customer, backup and deletion, solely to provide, secure and support the Service.
Data subjects	Customer's employees, contractors and other Members who use the Service; individuals named or depicted in Customer Content.
Categories of data	Names, business contact details (email, phone number for WhatsApp), job roles and areas of responsibility, questions and messages, comments, images, and any other personal data Customer chooses to include in Customer Content.
Special categories	None intended. Customer will not submit special categories of personal data unless strictly necessary and permitted by law, and is responsible for any it submits.
Frequency	Continuous, for the duration of the Agreement.

4. Customer's Instructions and Obligations

4.1. Prosabe will process Customer Personal Data only on Customer's documented instructions, which are given by the Agreement, this DPA and Customer's configuration and use of the Service, unless required otherwise by law, in which case Prosabe will inform Customer before processing unless the law prohibits it. Prosabe will inform Customer if, in its opinion, an instruction infringes Data Protection Laws.

4.2. Customer is responsible for the lawfulness of the processing it instructs, including having a valid legal basis, providing notices to and obtaining any consents from data subjects (including Members whose phone numbers are registered for the WhatsApp assistant), and the accuracy and minimization of the data it submits.

5. Processor Obligations

Prosabe will:

1. ensure that persons authorized to process Customer Personal Data are bound by confidentiality obligations;
2. implement the technical and organizational measures in Annex 1;
3. not sell or share Customer Personal Data, not retain, use or disclose it for any purpose other than performing the Service (including any commercial purpose outside the direct business relationship), not combine it with personal data from other sources except as permitted by the CCPA, and not use it to train AI models; Prosabe certifies that it understands and will comply with these restrictions;
4. notify Customer if it can no longer meet its obligations under the CCPA or other Data Protection Laws;
5. taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures in responding to data subject requests and in complying with its obligations relating to security, breach notification, data protection impact assessments and prior consultation; and
6. make available the information reasonably necessary to demonstrate compliance with this DPA, as described in Section 10.

6. Subprocessors

6.1. Customer gives general authorization for Prosabe to engage Subprocessors. The current Subprocessors are:

Subprocessor	Service	Location
Supabase, Inc.	Database, authentication, file storage and server functions	United States (and other regions where the project is hosted)
Anthropic PBC	AI language models (no training on Customer data)	United States
n8n GmbH	Workflow automation for the SOP chat and WhatsApp assistant	Germany (EU)
Twilio Inc.	WhatsApp message delivery	United States
WhatsApp LLC / Meta Platforms Ireland Ltd.	WhatsApp messaging channel (only if Customer enables the WhatsApp assistant)	United States / Ireland
Stripe, Inc.	Payment processing (account billing data only)	United States
Sendinblue SAS (Brevo)	Transactional email (invitations and notifications)	France (EU)
Hostinger International Ltd.	Web hosting and server-side scripts (exports, invitations)	EU / United States

6.2. Prosabe imposes on each Subprocessor data protection obligations that provide at least the same level of protection as this DPA, to the extent applicable to the services it provides, and remains liable to Customer for each Subprocessor's performance as required by Data Protection Laws.

6.3. Prosabe will give at least 14 days' notice of any new or replacement Subprocessor by updating this page and, if Customer has subscribed to updates by writing to privacy@prosabe.com, by email. Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, Customer may terminate the affected Service and receive a refund of prepaid fees for the unused period as its sole remedy.

7. International Transfers

7.1. Customer acknowledges that Customer Personal Data will be processed in the United States and the other locations listed in Section 6.

7.2. To the extent a transfer of Customer Personal Data from the EEA, Switzerland or the United Kingdom to Prosabe is not covered by an adequacy decision, the parties agree that the EU SCCs, Module Two (controller to processor) or Module Three (processor to processor) as applicable, are incorporated by reference, with the following selections: Clause 7 (docking clause) applies; Clause 9 option 2 (general authorization) with the notice period in Section 6.3; the optional language in Clause 11 does not apply; Clauses 17 and 18: the law and courts of Ireland; Annex I is completed by Section 3 of this DPA and Annex II by Annex 1. For UK transfers, the UK International Data Transfer Addendum applies, with Table 4 allowing either party to end it. For Swiss transfers, references to the GDPR are to the Swiss FADP and the competent authority is the Swiss FDPIC.

7.3. For transfers subject to the LGPD, the standard contractual clauses approved by ANPD Resolution CD/ANPD No. 19/2024 are incorporated by reference and prevail in case of conflict. For transfers subject to other Latin American laws, Prosabe will provide the safeguards required by those laws, and the parties agree that transfers to Subprocessors are necessary to perform the Agreement.

7.4. Prosabe ensures that Subprocessors outside the EEA/UK that receive transfers are bound by appropriate transfer mechanisms.

8. Personal Data Breach

Prosabe will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it, and will be supplemented as more information becomes available. Prosabe will take reasonable steps to contain and remediate the breach and will cooperate with Customer in meeting its own notification obligations. Notification is not an acknowledgment of fault or liability.

9. Data Subject Requests

If Prosabe receives a request from a data subject relating to Customer Personal Data, it will promptly forward it to Customer and will not respond directly except to confirm receipt and refer the requester to Customer, unless authorized by Customer or required by law. Customer can access, correct, export and delete Customer Content through the Service; where that is not sufficient, Prosabe will provide reasonable assistance.

10. Audits

Prosabe will respond to Customer's reasonable written requests for information about its processing and security, no more than once per year (or more often following a Personal Data Breach or at the request of a competent authority), including by providing written responses to security questionnaires and relevant documentation. Where Data Protection Laws or the SCCs require it and the information provided is not sufficient, Prosabe will allow an audit by Customer or an independent auditor bound by confidentiality, on at least 30 days' notice, during business hours, at Customer's expense, and in a manner that does not compromise the security or confidentiality of other customers' data.

11. Data Protection Impact Assessments

Prosabe will provide reasonable information to help Customer carry out data protection impact assessments and prior consultations with supervisory authorities relating to the Service.

12. Return and Deletion

Customer can export Customer Content at any time during the Agreement. Within 30 days after termination of the Agreement or upon Customer's deletion of its account, Prosabe will delete Customer Personal Data from its production systems; copies in backups will be deleted on their regular rotation within 90 days. Prosabe may retain Customer Personal Data where required by law, in which case it will continue to protect it under this DPA and process it only for the purpose of that legal requirement.

13. Liability and Precedence

Each party's liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Agreement, except to the extent such limitations are prohibited by Data Protection Laws or the SCCs. In case of conflict, the SCCs prevail over this DPA, and this DPA prevails over the Agreement with respect to the processing of Customer Personal Data.

14. Term

This DPA remains in effect for as long as Prosabe processes Customer Personal Data. It is governed by the law that governs the Agreement, without prejudice to the governing law of the SCCs.

Annex 1 — Technical and Organizational Security Measures

1. Encryption: TLS for all data in transit; encryption at rest for databases and file storage provided by our infrastructure providers; passwords and API keys stored as hashes.
2. Access control: database row-level security policies restricting access to each customer's own data and to authorized team members according to their role; least-privilege administrative access; service credentials kept server-side and never exposed to browsers; multi-factor authentication on administrative accounts of infrastructure providers.
3. Application security: server-side verification of user sessions for AI and other privileged functions; exact-token lookups for public links and invitations; per-plan usage limits enforced server-side; input validation; dependency updates.
4. AI providers: data sent only as needed to fulfil the user's request; providers contractually prohibited from training on it.
5. Availability and resilience: managed infrastructure with redundancy provided by our hosting and database providers; periodic backups for disaster recovery, retained for no more than 90 days.
6. Logging and monitoring: security-relevant actions are logged and retained for up to 24 months.
7. Personnel: access to Customer Personal Data limited to personnel who need it to provide and support the Service, bound by confidentiality.
8. Vendor management: Subprocessors selected for their security practices and bound by written data protection terms.
9. Incident response: documented process to investigate, contain and notify Personal Data Breaches within the timelines in Section 8.
10. Deletion: account deletion removes Customer Content, related records and uploaded files from production systems.

Contact

ALCO GROUP LLC — Prosabe · 30 N Gould St, Sheridan, WY 82801, USA · privacy@prosabe.com