Scope and roles
This addendum applies when a customer subject to data-protection law uses Proofway to process personal data for which the customer is controller or business and Proofway acts as processor or service provider. The service agreement and documented product instructions form the controller's instructions.
Processing details
Processing includes hosting, organizing, retrieving, analyzing, securing, exporting, deleting, and supporting account, project, public-evidence, usage, and integration data. Duration is the subscription plus the configured deletion and backup period.
Processor commitments
- Process customer personal data only on documented instructions unless law requires otherwise.
- Require confidentiality for authorized personnel.
- Maintain proportionate technical and organizational security measures.
- Assist with data-subject requests, impact assessments, regulator consultations, and breach response.
- Delete or return customer personal data at the end of service, subject to lawful retention.
Subprocessors and transfers
Customer authorizes subprocessors needed to provide Proofway, including Cloudflare, OxyBlink, Stripe, and approved AI or ecosystem providers. Proofway remains responsible for required downstream protections and will provide notice of material new subprocessors. Restricted transfers use an available lawful mechanism such as the EU Standard Contractual Clauses or UK Addendum.
California service-provider terms
Proofway will not sell or share customer personal information, retain, use, or disclose it outside the business purposes specified in the agreement, or combine it with personal information received from another source except as permitted by applicable California law.
Security incidents
Proofway will notify the customer without undue delay after confirming a breach of customer personal data and will provide information reasonably available for the customer's legal obligations.