DATA PROCESSING ADDENDUM

This Data Processing Addendum (“DPA”) forms part of the Profitic Terms of Service or “Agreement” (the “Agreement”), entered into by and between Profitic (“Profitic” or “Processor” or “Service Provider”) and the entity identified in the Agreement (“Customer” or “Controller”). This DPA is effective as of the date you accept or otherwise agree to the Agreement and remains effective while Profitic Processes Personal Data on behalf of Customer.

1. DEFINITIONS
1.1 “Applicable Data Protection Laws” means all data protection and privacy laws applicable to the respective party in its role in the Processing of Personal Data under the Agreement, which may include, without limitation, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”), the GDPR (and U.K. GDPR), and any other applicable U.S. state data protection or privacy laws.
1.2 “Controller” means the entity which determines the purposes and means of the Processing of Personal Data, sometimes also called a “Business” under the CCPA.
1.3 “Customer Personal Data” means Personal Data provided or made available by Customer or its Users to Profitic, or collected by Profitic on Customer’s behalf, for the provision of the Services.
1.4 “Data Subject” means the identified or identifiable natural person to whom Customer Personal Data relates.
1.5 “Personal Data” means any information relating to an identified or identifiable natural person (“consumer,” “data subject,” or similar term) that is subject to protection under Applicable Data Protection Laws.
1.6 “Processing” means any operation or set of operations which is performed on Personal Data, whether or not by automated means (such as collection, use, storage, disclosure, analysis, or deletion).
1.7 “Processor” (or “Service Provider”) means the entity which Processes Personal Data on behalf of the Controller (or “Business”).
1.8 “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data under Profitic’s custody or control.
1.9 “Standard Contractual Clauses” or “SCCs” means the applicable EU Commission-approved contract clauses for the transfer of Personal Data from the EEA to third countries, including any U.K. Addendum if required for U.K. Personal Data.
1.10 “Sub-Processor” means any third party engaged by Profitic (or by one of its sub-processors) to Process Customer Personal Data.

2. SCOPE AND RELATIONSHIP OF THE PARTIES
2.1 Roles. Customer is the Controller (or “Business”) of Customer Personal Data, and Profitic is the Processor (or “Service Provider”) that Processes Customer Personal Data on behalf of Customer for the limited and specified purposes set out in the Agreement and this DPA.
2.2 Instructions. Profitic shall Process Customer Personal Data only in accordance with Customer’s documented instructions under the Agreement and this DPA, or as otherwise required by applicable law. Profitic will not “sell” or “share” (as defined under the CCPA/CPRA) Personal Data to third parties, nor retain, use, or disclose Personal Data outside of the direct business relationship with Customer, except as permitted by Applicable Data Protection Laws.
2.3 Purposes. Profitic shall Process Customer Personal Data only as necessary to provide the Services, including operating, maintaining, and improving features. Customer also consents to Profitic using de-identified or aggregated data for AI model improvements, but not personal data that directly identifies any individual.
2.4 Scope. This DPA applies only to the extent that Profitic Processes Customer Personal Data subject to Applicable Data Protection Laws. It does not apply where Profitic acts as a controller with respect to any data.
2.5 Prohibited Data. Customer must not provide (or cause to be provided) any sensitive or special categories of data (e.g., personal health information, biometric info, payment card data, data of minors) unless otherwise agreed in writing. Profitic disclaims liability for any such data uploaded without its knowledge or consent.

3. TRANSFERS OF PERSONAL DATA
3.1 Location of Processing. Profitic is a U.S.-based provider. Customer Personal Data may be Processed in the United States. If Customer Personal Data is subject to EU or U.K. data protection laws, the parties agree to abide by the Standard Contractual Clauses as needed for cross-border transfers.
3.2 Standard Contractual Clauses. Where required by GDPR or U.K. GDPR:

  • The parties incorporate the EU SCCs (Module Two or Three) by reference, including the U.K. Addendum if applicable.
  • Annexes to the DPA (Appendix A, B, C) shall serve as Annexes to the SCCs.
  • If the SCCs conflict with any provision of this DPA, the SCCs will prevail with respect to EU/U.K. Personal Data transfers.
    3.3 Additional Measures. If changes in law invalidate or alter the legal basis for data transfers, the parties will cooperate in good faith to promptly address compliance gaps (e.g., implementing additional security measures or updated transfer mechanisms).

4. CONFIDENTIALITY AND SECURITY
4.1 Confidentiality. Profitic shall ensure that its personnel authorized to Process Customer Personal Data are subject to an appropriate duty of confidentiality.
4.2 Security Measures. Profitic shall implement and maintain commercially reasonable technical and organizational security measures designed to protect Personal Data against unauthorized or unlawful Processing and against accidental loss, destruction, damage, theft, alteration, or disclosure. A summary is attached in Appendix B. Profitic may update its security measures from time to time, provided such updates do not materially decrease protection for Customer Personal Data.
4.3 Security Incidents. Upon becoming aware of a confirmed Security Incident, Profitic shall promptly (and without undue delay) notify Customer and provide reasonable information to assist Customer in fulfilling its data breach notification obligations under Applicable Data Protection Laws. Profitic shall investigate and take reasonable steps to mitigate the effects of the Security Incident. Profitic’s notification is not an admission of fault or liability.

5. SUB-PROCESSORS
5.1 Authorized Sub-Processors. Customer generally authorizes Profitic to engage Sub-Processors to help it provide the Services. A current list of Sub-Processors is available upon request or at Subprocessors.
5.2 New Sub-Processors. Profitic will provide at least 30 days notice (e.g., via email or website posting) of any new Sub-Processor. If Customer has a reasonable, good-faith objection, Customer must notify Profitic within that timeframe. If the parties cannot resolve the objection, Customer’s sole remedy is to terminate the affected Service in writing.
5.3 Sub-Processor Obligations. Profitic shall enter into a written agreement with each Sub-Processor imposing data protection obligations substantially similar to those in this DPA. Profitic remains liable to Customer for any Sub-Processor’s performance of obligations.

6. DATA SUBJECT REQUESTS
6.1 Requests to Customer. Customer is responsible for responding to Data Subject Requests under Applicable Data Protection Laws. Profitic shall, to the extent legally permitted and commercially reasonable, notify Customer if it receives a request from a Data Subject relating to Personal Data Processed by Profitic on Customer’s behalf.
6.2 Profitic Assistance. Profitic shall provide reasonable assistance to Customer to fulfill Customer’s obligation to respond to Data Subject Requests (e.g., by making relevant Customer Personal Data available), to the extent Customer is unable to access such data on its own. Any additional assistance beyond the standard features of the Service may be subject to additional fees.

7. COOPERATION AND AUDITS
7.1 Regulatory Compliance. Profitic shall provide reasonable assistance to Customer to comply with Customer’s obligations under Applicable Data Protection Laws (e.g., data protection impact assessments, prior consultations with regulators) taking into account the nature of the Processing and information available to Profitic.
7.2 Audit Rights. Profitic undergoes periodic audits for security controls (e.g., SOC 2). Upon written request, Profitic shall provide relevant documentation or certifications to demonstrate compliance. If further information is needed, Customer may conduct an on-site audit of Profitic’s relevant systems and processes once per year (or more frequently if required by law or following a confirmed Security Incident), subject to:

  • 30 days’ prior written notice
  • Conducted during normal business hours
  • Execution of appropriate confidentiality agreements
  • Customer bearing any associated costs
    Profitic may object to any third-party auditor that is not mutually agreed upon or is a direct competitor.
    7.3 Confidentiality of Audit Findings. Any information disclosed during an audit, including reports, shall be treated as Profitic’s Confidential Information.

8. RETURN OR DELETION OF DATA
8.1 Data Retention. Unless otherwise provided in the Agreement, upon termination or expiration of the Agreement, Profitic shall, at Customer’s election, either return or securely delete Customer Personal Data from its (and its Sub-Processors’) systems within 30 days, except as required by law or for legitimate business interests (e.g., final billing).
8.2 Retention by Law. If Profitic is legally required to retain some or all of the data, Profitic will maintain the data securely and shall not Process it for any purpose other than compliance with legal requirements.

9. CROSS-INDUSTRY / STATE-SPECIFIC OBLIGATIONS
9.1 CCPA/CPRA. Profitic certifies that it will not “sell” or “share” Customer Personal Data, will not retain, use, or disclose Customer Personal Data for any purpose other than providing and improving the Services, and will not combine Customer Personal Data with personal data from other sources except as permitted by law or this DPA.
9.2 No High Risk Use. Customer acknowledges Profitic’s Services are not designed for data subject to specialized regulatory regimes (e.g., HIPAA, ITAR, PCI DSS) unless explicitly agreed in writing.
9.3 De-Identified / Aggregated Data. Profitic may use aggregated or de-identified data related to Customer’s usage of the Services for legitimate internal business purposes, including analytics and improvements, provided such data does not identify Customer or Data Subjects.

10. LIABILITY
The liability provisions of the Agreement apply to this DPA. Nothing in this DPA expands or modifies either party’s liability under the Agreement. The cumulative liability of each party under this DPA and the Agreement collectively shall be subject to any limitations or exclusions set forth in the Agreement.

11. MISCELLANEOUS
11.1 Conflict. In the event of a conflict between this DPA and the Agreement, the DPA prevails solely with respect to the subject matter herein (i.e., data protection).
11.2 Governing Law. This DPA shall be governed by the governing law specified in the Agreement unless otherwise required by the SCCs or other mandatory law.
11.3 Termination. This DPA terminates automatically upon deletion of all Personal Data by Profitic or upon the termination of the Agreement if no data remains in Profitic’s custody.
11.4 Amendment. Profitic may update this DPA to reflect changes in data protection laws, after notifying Customer in accordance with the Agreement.
11.5 Entire Agreement. This DPA, together with the Agreement (and attachments hereto), constitute the parties’ entire understanding regarding the Processing of Personal Data.
11.6 Signatures. By executing the Agreement, the parties are deemed to have executed this DPA.

APPENDIX A

DESCRIPTION OF PROCESSING

A. Parties

  • Data Importer (Profitic): Profitic, with principal place of business at 3420 W. Lake Sammamish Pkwy SE Bellevue, WA 98008 Email: privacy@profitic.com

B. Nature and Purpose of Processing
Profitic Processes Customer Personal Data to provide the Services, including hosting, analytics, AI functionalities, user support, and optional integrations. Data Processing is continuous and on-demand based on Customer’s instructions within the scope of the Agreement.

C. Categories of Data Subjects

  • Customer’s employees or authorized Users
  • Customer’s clients or prospects (if integrated or uploaded)
  • Other individuals as Customer may determine

D. Categories of Personal Data

  • Basic contact info (name, email, phone)
  • Employment details (job title, company)
  • Usage data (IP addresses, device info, usage logs)

E. Special Categories of Data (Sensitive Data)

  • Not collected or processed unless explicitly agreed. If inadvertently provided, Customer is responsible for obtaining necessary consents or complying with applicable law.

F. Retention
Data is retained for the duration of the Agreement. Upon termination, data is deleted as described in Section 8 of the DPA, except as required by law.

APPENDIX B

TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

Profitic implements commercially reasonable security measures, including:

  1. Access Controls:
    • Role-based access for employees
    • Multi-factor authentication for administrative privileges
    • Unique user IDs and strong password policies
  2. Encryption:
    • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
    • Encrypted backups
  3. Hosting & Infrastructure:
    • Hosted on reputable cloud providers (e.g., AWS, Azure, GCP) with SOC 2 or ISO 27001 certifications
    • Physical security is the responsibility of the data center providers
  4. Network Security:
    • Firewalls and intrusion detection systems
    • Regular vulnerability scanning and patching
  5. Monitoring & Logging:
    • System event logs maintained and reviewed for anomalies
    • Security incident response procedures
  6. Employee Policies:
    • Background checks for employees with access to production systems
    • Mandatory security training and NDA/confidentiality agreements
  7. Incident Management:
    • Formalized incident response plan
    • Designated security team to coordinate triage and response
  8. Business Continuity:
    • Regular backups and tested disaster recovery procedures
    • Redundancy in infrastructure
  9. Penetration Testing:
    • Periodic third-party penetration tests
    • Prompt remediation of identified vulnerabilities

Profitic may periodically update these measures, provided such updates do not diminish the overall security provided.

APPENDIX C

SUB-PROCESSORS

Profitic engages the following Sub-Processors (as of the last update):

NameAddress / HQPurpose (Processing Activities)Data Location
GCP2325 Lakeview Parkway, Suite 450, Alpharetta, GA 30009, USAInfrastructure hosting / data storage[USA]
Google Workspace1600 Amphitheatre Parkway, Mountain View, CA 94043, USATransactional emails, notifications[USA]
PostHog2261 Market Street, Suite 4008, San Francisco, CA 94114, USALogs, metrics, performance monitoring[USA]
OpenAI3180 18th Street, Ste 100, San Francisco, CA 94110, USAAI model services or API calls (if any)[USA]
Hubspot2 Canal Park, Cambridge, MA 02141, USACRM Tool[USA]
Linear1950 Camino Vida Roble, Suite 150, Carlsbad, CA 92008, USADevOps tracking Tool[USA]
Github88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USASource code repository hosting, version control[USA]

Profitic will update or replace this list as necessary, providing advance notice per Section 5 of the DPA.

BY ENTERING INTO THE AGREEMENT, THE PARTIES ACKNOWLEDGE HAVING READ, UNDERSTOOD, AND AGREED TO THIS DATA PROCESSING ADDENDUM.