Data Processing Addendum

Effective: August 21, 2026

All legal documents

This Data Processing Addendum (“DPA”) forms part of the agreement between Proper Technologies Inc. (“Proper”, “we”, “us” or “our”) and the customer that subscribes to the Services (“Customer”, “you” or “your”) under the Subscription Terms or another written agreement governing the Services (the “Agreement”). Capitalized terms not defined here have the meaning given in the Agreement.

This DPA applies where we process Personal Information on Customer's behalf in providing the Services. It is incorporated into the Agreement by reference and takes effect without separate signature. Where Customer requires a signed copy, contact info@runproper.com.

This DPA does not govern personal information for which we act as the responsible organization in our own right — for example, information about Customer's billing contacts, or visitors to our website. That processing is described in our Privacy Policy.

1. Definitions

“Applicable Privacy Law” means all laws relating to the protection of Personal Information that apply to the processing under this DPA, including the Personal Information Protection and Electronic Documents Act (Canada), the Personal Information Protection Act (British Columbia), Québec's Act respecting the protection of personal information in the private sector as amended by Law 25, and, where applicable to Customer, the EU General Data Protection Regulation and the UK GDPR.

“Individual” means the identifiable natural person to whom Personal Information relates, including a “data subject” under the GDPR.

“Personal Information” means information about an identifiable individual that is contained in Customer Data and that we process on Customer's behalf, including “personal data” under the GDPR.

“Processing” means any operation performed on Personal Information, including collection, use, storage, disclosure, transfer, alteration and deletion.

“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Information processed by us or a Sub-processor. It does not include unsuccessful attempts or activity that does not compromise the security of Personal Information, such as pings, port scans, failed log-in attempts or denial-of-service attacks that do not result in access.

“Sub-processor” means a third party engaged by us to process Personal Information on Customer's behalf in providing the Services.

2. Roles of the Parties

1. Customer is the organization responsible for the Personal Information — the “controller” under the GDPR and the equivalent role under Canadian Applicable Privacy Law. Customer determines the purposes and means of the Processing.
2. We act as a service provider processing Personal Information on Customer's behalf — the “processor” under the GDPR and the equivalent role under Canadian Applicable Privacy Law.
3. Customer is responsible for the lawfulness of the Personal Information it provides to us, for providing any required notices to Individuals, and for obtaining and maintaining any consents required for the Processing described in this DPA.
4. Each party will comply with its own obligations under Applicable Privacy Law.

3. Scope and Instructions

1. The subject matter, duration, nature and purpose of the Processing, the types of Personal Information and the categories of Individuals are set out in Annex 1.
2. We will process Personal Information only on Customer's documented instructions, including as necessary to provide, secure, maintain and support the Services, and as otherwise set out in the Agreement. Customer's use and configuration of the Services constitute documented instructions.
3. We may process Personal Information where required by applicable law. Where lawful, we will inform Customer of that requirement before processing.
4. We will inform Customer if, in our opinion, an instruction infringes Applicable Privacy Law. We are not obliged to provide legal advice, and this does not make us responsible for determining the lawfulness of Customer's instructions.
5. We will not sell Personal Information, and will not use, retain or disclose Personal Information for any purpose other than providing the Services under the Agreement, except as permitted by this DPA or required by applicable law.
6. We will not use Personal Information to train machine learning models made available to other customers or to the public.

4. Confidentiality of Personnel

We will ensure that personnel authorized to process Personal Information are bound by written confidentiality obligations or an appropriate statutory duty of confidentiality, receive training appropriate to their role, and are granted access only to the extent necessary to perform their duties.

5. Security

1. We will implement and maintain appropriate technical and organizational measures to protect Personal Information against a Security Incident, taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the Processing, and the sensitivity of the Personal Information and the risks to Individuals.
2. Our current measures are described in Annex 2. We may update them from time to time provided that the overall level of protection is not materially reduced.
3. Customer is responsible for its own configuration and use of the security features available in the Services, including access management, role and permission assignment, and prompt removal of access for departing personnel.

6. Sub-processors

1. Customer provides general authorization for us to engage Sub-processors to process Personal Information in providing the Services.
2. We maintain a current list of Sub-processors, identifying each Sub-processor, the purpose for which it is engaged and the country in which it processes Personal Information. We will provide that list on request to info@runproper.com, and publish it at trust.runproper.com/subprocessors, where Customer may subscribe to receive notice of changes.
3. We will give Customer at least thirty (30) days' notice before a new Sub-processor begins processing Personal Information. Where a change is required urgently to maintain the security or availability of the Services, we may act on shorter notice and will inform Customer as soon as reasonably practicable.
4. Customer may object to a new Sub-processor on reasonable grounds relating to data protection by notifying us before the change takes effect. The parties will discuss the objection in good faith. If we are unable to make the affected functionality available without the Sub-processor, Customer may terminate the affected Services on notice and receive a pro-rata refund of prepaid fees for the unused portion of the Subscription Term.
5. We will impose on each Sub-processor data protection obligations that are, in substance, no less protective than those in this DPA, and we remain responsible to Customer for each Sub-processor's performance.

7. Assistance with Individual Rights

1. The Services provide functionality enabling Customer to access, correct, export and delete Personal Information. Customer will use that functionality in the first instance to respond to requests from Individuals.
2. Where Customer cannot respond using the Services, we will provide reasonable assistance, at Customer's cost where the assistance is substantial or repeated, to enable Customer to respond within the timeframes set by Applicable Privacy Law.
3. If we receive a request directly from an Individual relating to Personal Information processed on Customer's behalf, we will not respond substantively other than to direct the Individual to Customer, and will promptly forward the request to Customer unless prohibited by law.
4. Where the Services produce a decision based exclusively on automated processing of Personal Information that produces legal or similarly significant effects for an Individual, we will provide Customer, on request, with information reasonably necessary for Customer to inform the Individual of the decision, the principal factors involved, and the Individual's right to make submissions or seek review.

8. Security Incident Notification

1. We will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Security Incident affecting Personal Information processed on Customer's behalf.
2. The notification will describe, to the extent then known, the nature of the incident, the categories and approximate volume of Personal Information and Individuals affected, the likely consequences, the measures taken or proposed, and a contact point for further information. Where the full picture is not available, we will provide information in phases as it becomes available.
3. We will take reasonable steps to contain and remediate the incident and will provide Customer with reasonable cooperation in Customer's own assessment, notification and record-keeping obligations, including any obligation to report to a regulator or to affected Individuals.
4. Our notification is not an acknowledgement of fault or liability.

9. Privacy Impact Assessments

We will provide Customer with reasonable assistance, at Customer's cost where the assistance is substantial, in carrying out any privacy impact assessment or data protection impact assessment, and any related consultation with a supervisory authority or regulator, that Customer is required to conduct under Applicable Privacy Law in relation to the Services. This includes information reasonably necessary for an assessment of a transfer of Personal Information outside Québec where Customer is subject to Law 25.

10. Return and Deletion

1. For thirty (30) days after expiry or termination of the Agreement, we will make Personal Information available for export through the Services or another reasonable means.
2. After that period we will delete Personal Information within ninety (90) days, except to the extent retention is required by applicable law or is held in routine backups, which are deleted in accordance with our backup retention cycle. Personal Information retained in backups remains subject to this DPA until deleted.
3. On written request, we will confirm deletion.

11. Audit and Records

1. We will maintain records of our Processing of Personal Information on Customer's behalf sufficient to demonstrate compliance with this DPA.
2. On reasonable written request, and no more than once in any twelve (12) month period unless required by a regulator or following a Security Incident, we will make available information reasonably necessary to demonstrate compliance with this DPA, including any then-current third-party security assessment or certification we hold and responses to a reasonable security questionnaire.
3. Where the information provided under paragraph (b) is not sufficient for Customer to demonstrate compliance under Applicable Privacy Law, Customer may request an audit. Any audit will be conducted on at least thirty (30) days' notice, during business hours, subject to confidentiality obligations, in a manner that does not unreasonably disrupt our operations, and at Customer's cost.

12. International Transfers

1. Personal Information may be processed in Canada, the United States and other jurisdictions where we or our Sub-processors operate. The locations applicable to each Sub-processor are identified in the list referenced in Section 6(b).
2. Personal Information processed in a jurisdiction outside Canada may be accessible to law enforcement and national security authorities of that jurisdiction under its laws.
3. Where Personal Information subject to the GDPR is transferred to a jurisdiction that has not received an adequacy decision, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Two (controller to processor), are incorporated into this DPA by reference and apply to that transfer. Customer is the data exporter and we are the data importer. Annex 1 and Annex 2 of this DPA populate the corresponding annexes of those clauses. The governing law and forum are those of Ireland, and the supervisory authority is that of the data exporter's establishment.
4. Where Personal Information subject to the UK GDPR is transferred, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses applies, with the Information Commissioner's Office as the relevant supervisory authority.
5. We will provide Customer, on request, with information reasonably necessary to complete a transfer impact assessment.

13. General

1. This DPA forms part of the Agreement. In the event of a conflict between this DPA and the rest of the Agreement in relation to the Processing of Personal Information, this DPA prevails. In the event of a conflict between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses prevail.
2. Each party's liability under this DPA is subject to the limitations and exclusions of liability set out in the Agreement.
3. We may update this DPA by posting an amended version at this page and updating the effective date, provided the amendment does not materially reduce the protections afforded to Personal Information. We will give at least thirty (30) days' notice of any material change.
4. This DPA is governed by the law and subject to the jurisdiction stated in the Agreement, except where the Standard Contractual Clauses require otherwise.

A1. Annex 1 — Details of Processing

A2. Annex 2 — Security Measures

We maintain the following technical and organizational measures. These are reviewed periodically and may be updated provided the overall level of protection is not materially reduced.

14. Contact

Questions about this DPA, or requests for a signed copy, may be sent to info@runproper.com, or to Proper Technologies Inc., British Columbia, Canada.