Data Processing Addendum

1. Introduction and Scope

This Data Processing Addendum (“DPA”) forms part of, and is incorporated into, the ProposalOne Terms of Service (the “Terms”) between the Customer and Next313, a registered d/b/a of Dignetix® Ltd., a Michigan corporation (“ProposalOne,” “we,” “us”). It applies where, in providing the Service, we process Personal Data on the Customer's behalf.

If there is a conflict between this DPA and the Terms with respect to the processing of Personal Data, this DPA controls. Capitalized terms not defined here have the meanings given in the Terms.

2. Definitions

This section also serves as the key to abbreviations used throughout this DPA.

• “Applicable Data Protection Laws” — all privacy and data-protection laws applicable to the processing, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA), each as amended.
• “Controller,” “Processor,” “Data Subject,” “Personal Data,” “Processing,” and “Personal Data Breach” — have the meanings in the GDPR, with the corresponding CCPA terms (“business,” “service provider,” “consumer,” “personal information”) applying where the CCPA governs.
• “Customer Personal Data” — Personal Data within Customer Content that we process on the Customer's behalf.
• “Sub-processor” — a third party engaged by us to process Customer Personal Data.
• “Standard Contractual Clauses (SCCs)” — the contractual clauses approved for transfers of Personal Data to countries without an adequacy decision.

3. Roles of the Parties

For Customer Personal Data, the Customer is the Controller (or a processor acting on behalf of another controller) and we act as Processor and, where the CCPA applies, as a Service Provider. Where the Customer is itself a processor, it warrants that it has authority to engage us as a Sub-processor on its controller's behalf. The subject matter and details of processing are described in Annex 1.

4. Processing Instructions

We process Customer Personal Data only on the Customer's documented instructions — including as set out in the Terms, this DPA, and through the Customer's configuration and use of the Service — unless required by law, in which case we will inform the Customer unless legally prohibited. We will inform the Customer if, in our reasonable opinion, an instruction infringes Applicable Data Protection Laws.

Invoking an AI-assisted feature (section extraction or answer drafting) is a processing instruction. Nothing is transmitted to our AI Sub-processor except in response to such an instruction, as described in Annex 3.

5. Confidentiality

We ensure that personnel authorized to process Customer Personal Data are bound by appropriate obligations of confidentiality.

6. Security

We implement and maintain appropriate technical and organizational measures (TOMs) designed to protect Customer Personal Data, as described in Annex 2, including encryption in transit and at rest, a dedicated database per customer, and access controls.

7. Sub-processors

The Customer provides general written authorization for us to engage Sub-processors to process Customer Personal Data. Our current Sub-processors are listed in Annex 3.

We impose data-protection obligations on each Sub-processor that are no less protective than those in this DPA, and we remain responsible for their performance. We will give the Customer notice of any intended addition or replacement of a Sub-processor (for example, through the Service or by email), and the Customer may object on reasonable data-protection grounds within ten (10) days of notice. If the parties cannot resolve the objection in good faith within a reasonable period, the Customer may terminate the affected portion of the Service and receive a pro rata refund of prepaid fees for the unused term.

8. Data Subject Requests

Taking into account the nature of the processing, we will assist the Customer by appropriate measures, insofar as reasonably possible, to respond to requests from Data Subjects exercising their rights (including Data Subject Access Requests, or “DSARs”). If we receive such a request directly, we will forward it to the Customer and will not respond except on the Customer's instructions or as legally required.

9. Personal Data Breach

We will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data and will provide information reasonably available to help the Customer meet its own notification obligations. Our notification is not an acknowledgment of fault or liability.

10. Data Protection Impact Assessments

Taking into account the nature of processing and the information available to us, we will provide reasonable assistance to the Customer with data protection impact assessments (DPIAs) and any required prior consultations with a supervisory authority.

11. International Transfers

Where the provision of the Service involves transfer of Customer Personal Data from the European Economic Area (EEA), the United Kingdom, or Switzerland to a country without an adequacy decision, the parties agree that the applicable SCCs (together with the UK Addendum and Swiss amendments, as relevant) apply and are incorporated by reference.

The parties agree that Module Two (Controller to Processor) and, where applicable, Module Three (Processor to Sub-processor) of the Standard Contractual Clauses apply.

12. CCPA Terms

To the extent the CCPA applies, we act as a Service Provider. We will not sell or share Customer Personal Data; will not retain, use, or disclose it except as necessary to perform the Service or as otherwise permitted by the CCPA; and will not combine it with other personal information except as the CCPA permits. We certify that we understand and will comply with these restrictions.

13. Audit and Compliance

We will make available to the Customer information reasonably necessary to demonstrate compliance with this DPA and, where available, relevant third-party audit reports (including those of our infrastructure providers).

Customer audit rights will be satisfied primarily through documentation, including this DPA, security summaries, and available third-party audit reports (such as SOC 2 or equivalent reports of our infrastructure providers).

On-site audits may be conducted only where legally required or where such documentation is insufficient, subject to reasonable advance notice, confidentiality obligations, limits on frequency (no more than once annually), and reimbursement of our reasonable costs.

14. Return and Deletion of Customer Personal Data

Upon termination of the Service and at the Customer's choice, we will delete or return Customer Personal Data and delete existing copies, except where retention is required by law. Consistent with our Privacy Policy, the Customer may export its Customer Content during a 30-day window after termination; we delete workspace content within 90 days of account closure; and backups containing deleted data are purged within 30 days.

Where the Customer's workspace was provisioned for a free trial and the Customer does not convert, the workspace and its dedicated database are deleted after the export offer described in the Terms.

15. Liability

Each party's liability under this DPA is subject to the exclusions and limitations of liability set out in the Terms.

16. Term, Precedence, and Governing Law

This DPA takes effect when the Customer accepts the Terms and remains in effect while we process Customer Personal Data. This DPA is governed by the laws of the State of Michigan, USA, except that the SCCs are governed by the law they specify. As between this DPA and the Terms, this DPA prevails on matters of Personal Data processing. This DPA assigns together with the Terms; any permitted assignment or transfer of the Terms includes this DPA.

17. Contact

Privacy and data-protection inquiries: privacy@next313.com. The Customer should provide a data-protection contact as described in Annex 1.

Annex 1 — Details of Processing

Subject matter. Provision of the ProposalOne RFP response management Service.

Duration. The subscription term, plus the export, deletion, and backup-purge periods described in Section 14.

Nature and purpose. Hosting, storage, processing, transmission, display, backup, and support of Customer Content in order to provide the Service and as instructed by the Customer — including extracting sections from documents the Customer uploads and drafting responses from the Customer's own approved answers.

Categories of Data Subjects. The Customer's personnel and Users, in every role the Service provides (administrators, response leads, subject-matter experts, requestors, reviewers, and approvers); and any individuals referenced within Customer Content, including named contacts in issuer documents and personnel named in a response.

Categories of Personal Data. Account data such as names, email addresses, Microsoft Entra ID identifiers, organization, operating-entity and role or permission assignments, and preferences. Within workspace content: RFP and section records, drafted and approved answers, the answer repository, cover sheets, comments, assignments, review and approval decisions, the audit trail of user actions, and uploaded issuer documents and generated response packages, any of which may contain Personal Data the Customer chooses to include.

Special category data. None intended. The Customer should not submit special-category Personal Data except where expressly agreed in writing. Note that RFP responses sometimes call for personnel details such as qualifications or certifications — the Customer is responsible for deciding what to include.

Customer data-protection contact. privacy@next313.com

Annex 2 — Technical and Organizational Measures

• Encryption of Customer Personal Data in transit (TLS) and at rest.
• A dedicated PostgreSQL database provisioned per customer — isolation is architectural rather than a policy applied to a shared table.
• Role- and tenant-based access controls with least-privilege enforcement.
• Staff authentication via Microsoft Entra ID single sign-on (SSO), with multi-factor authentication for administrative access.
• Access-controlled storage buckets for uploaded files.
• Session tokens bound to the tenant they were issued for, so a session cannot be replayed against another workspace.
• Logging, monitoring, and incident-response procedures.
• Backups with defined retention and purge schedules.
• Vendor risk management and reliance on audited infrastructure providers.
• Business continuity and disaster recovery procedures.

Annex 3 — Sub-processors

As of the effective date, we engage the following Sub-processors to process Customer Personal Data:

• Supabase — database, authentication, and file storage — United States.
• Microsoft Azure — application hosting — United States.
• Microsoft Entra ID — single sign-on — United States.
• Anthropic — AI processing for section extraction and answer drafting — United States. Receives the document sections being processed and the candidate answers drawn from the Customer's repository, only when a User invokes such a feature. Engaged under commercial terms that contractually restrict the use of Customer Content for training foundation models, except as otherwise disclosed to the Customer or required by law. We do not use Customer Content to train any model of our own.
• Resend — delivery of transactional email such as sign-in links, notifications, and deadline reminders; receives recipient email addresses and message content — United States.
• Stripe — payment processing, when card billing is enabled — United States. Receives billing contact and payment details, and no workspace content. Not engaged as at the effective date of this DPA; listed here so that enabling card payment does not require a separate Sub-processor notice under Section 7.

Paid plans are invoiced directly as at the effective date. Stripe is listed above as an authorized Sub-processor for card payment, which is not yet enabled; every other Sub-processor listed is engaged today.