Data Processing Addendum

1. Roles and scope#

For Customer Personal Data (personal data the Customer or its users submit to an organization workspace), the Customer is the controller (or a processor acting for its own controller) and TheProfitPath is the processor. For the account data of each individual user, for billing, security, abuse prevention, product analytics and the operation of the Service as a whole, TheProfitPath acts as an independent controller under the Privacy Policy. "Data Protection Law" means the GDPR, the UK GDPR and Data Protection Act 2018, the Swiss FADP, the Brazilian LGPD, the CCPA/CPRA and other US state laws, and any other law that applies to the processing.

2. Processing details#

• Subject matter and duration: providing the Service for the term of the Customer's use plus the deletion period in section 9.
• Nature and purpose: hosting, storing, displaying, analysing, synchronising, exporting and backing up journal, account, collaboration and AI data as the Customer and its users direct through the Service.
• Categories of data subjects: the Customer's members, employees, contractors, students and clients who use the workspace.
• Categories of data: identity and contact data, account credentials (hashed), trading and journal records, notes, uploads, messages, AI prompts and outputs, usage and device data. Special-category data only if a user chooses to record it in notes or enable sensitive memory.

3. Our obligations as processor#

• Process Customer Personal Data only on the Customer's documented instructions, which are the Terms, this DPA and the settings and actions taken in the Service, unless the law requires otherwise; we tell the Customer first if the law allows.
• Inform the Customer if we believe an instruction infringes Data Protection Law.
• Ensure staff and contractors with access are bound by confidentiality and trained.
• Implement the technical and organisational measures described in section 6.
• Assist the Customer with data-subject requests, data-protection impact assessments and prior consultations, taking into account the nature of the processing and the information available to us.
• Delete or return data at the end of the engagement as described in section 9.
• Make available the information needed to demonstrate compliance and allow audits as described in section 10.

4. Customer obligations#

The Customer is responsible for the lawfulness of the data it and its users submit, for having a legal basis and giving any notice its users need, for the accuracy of the data, for configuring sharing, mentor links, API keys and member roles appropriately, and for responding to its users' requests. The Customer will not instruct us to process data in a way that breaches Data Protection Law.

5. Subprocessors#

The Customer authorises the subprocessors listed at /legal/subprocessors. We impose data-protection obligations on each subprocessor that are no less protective than this DPA and remain liable for their performance. We give at least 30 days' notice of a new subprocessor to Customers who have asked to be notified; a Customer who objects on reasonable data-protection grounds may terminate the affected part of the Service and receive a pro-rata refund of prepaid fees.

6. Security#

We maintain the measures described in the Privacy Policy, including encryption in transit (TLS) and at rest, password hashing, encryption of secrets and safety evidence, role-based access control with two-factor authentication for administrators, session controls, rate limiting, tamper-evident audit logs, encrypted backups, segregation of production and development, vulnerability management and a responsible-disclosure programme. We may update these measures provided the overall level of protection is not reduced.

7. Personal data breaches#

We notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data, with the information the Customer needs to meet its own notification duties, and we cooperate in the investigation and remediation. Notification is sent to the organization owner's account email.

8. International transfers#

Customer Personal Data is stored in the European Union. Where a subprocessor processes data outside the EEA, the UK or Switzerland, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses (Decision 2021/914, Module 2 or 3 as applicable) with the UK International Data Transfer Addendum and the Swiss amendments, which are incorporated into this DPA by reference, together with supplementary measures where needed. Copies of the executed clauses are available on request.

9. Deletion and return#

Users and organization owners can export data at any time (Settings → Data & privacy, or the developer API). When the Customer's use of the Service ends, or on request, we delete Customer Personal Data within 30 days, except for copies in encrypted backups (overwritten in the ordinary course within 35 days) and records we must keep under the law or to establish, exercise or defend legal claims, which remain protected by this DPA.

10. Audits#

Once a year, or after a breach, the Customer may request written responses to a reasonable security questionnaire and copies of available third-party reports or certifications of our subprocessors. If these are insufficient to demonstrate compliance, the Customer may conduct an audit on 30 days' notice, during business hours, subject to confidentiality and at its own cost, without access to other customers' data.

11. US state privacy laws#

Where the CCPA/CPRA or another US state privacy law applies, we act as a service provider or processor: we do not sell or share Customer Personal Data, do not retain, use or disclose it outside the direct business relationship or for any purpose other than the business purposes in this DPA, do not combine it with other personal information except as permitted, and will notify the Customer if we can no longer meet these obligations. The Customer may take reasonable steps to stop and remediate unauthorised use.

12. Liability and order of precedence#

Each party's liability under this DPA is subject to the limitations in the Terms of Service, except where Data Protection Law does not allow a limitation. If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data; if it conflicts with the Standard Contractual Clauses, the Clauses prevail.