Data Processing Addendum

1 · Summary

When you use ProdView, you remain the Controller of personal data flowing through the Service (chiefly: your employees' workplace activity). ProdView acts as your Processor and processes that data only on your documented instructions and as needed to deliver the Service.

This DPA covers: the scope and purpose of processing; the technical and organisational measures (TOMs) we apply; how we use subprocessors; international transfer mechanisms (SCCs); breach notification SLAs; how we help you respond to data-subject requests; and how the engagement ends.

2 · Definitions

Terms used here have the meaning given in the GDPR. In particular: "Controller", "Processor", "Sub-processor", "Personal Data", "Processing", "Data Subject", and "Supervisory Authority" all carry their GDPR Article-4 meanings.

"Customer" means the organisation that has signed up for ProdView; "Customer Personal Data" means Personal Data that ProdView processes on Customer's behalf.

3 · Roles

Customer is the Controller. ProdView is the Processor. Where Customer is itself a Processor on behalf of one of its customers, ProdView acts as a Sub-processor and the obligations flow through accordingly.

4 · Scope, duration, and purpose

ProdView processes Customer Personal Data only:

• to provide the Service as described in our documentation;
• for the duration of the underlying Terms;
• on Customer's documented instructions (the configuration in the admin console is itself a documented instruction);
• as required by EU, EEA, UK, Swiss, or Member State law (we'll notify Customer before doing so, unless that notification is prohibited).

5 · Categories of data and data subjects

Data subjects are typically Customer's employees, contractors, and other authorised users of devices on which the agent is installed.

Special categories of Personal Data (Article 9 GDPR) are not within scope. Do not configure the Service to process special-category data; we do not warrant it for that purpose.

6 · Documented instructions

Customer's instructions to ProdView consist of: (a) these Terms, (b) the Service configuration set by Customer in the admin console, (c) Customer's use of the API and webhooks, and (d) any written instructions Customer issues by email to dpo@prodview.app.

If ProdView believes an instruction violates GDPR or other applicable data-protection law, ProdView will notify Customer without undue delay (unless the law forbids it).

7 · Technical and organisational measures

ProdView maintains appropriate TOMs to ensure a level of security appropriate to the risk, including but not limited to:

• Encryption — AES-256-GCM at rest with per-tenant keys; TLS 1.3 in transit.
• Access control — role-based, principle of least privilege, MFA mandatory for all employees with production access.
• Logical separation — Customer data is logically separated per-tenant. Per-tenant keys make cross-tenant access cryptographically impossible.
• Audit logging — signed, append-only, retained for 7 years on Business+ tiers.
• Vulnerability management — quarterly internal scans; annual third-party pentest; bug bounty live on HackerOne.
• Personnel — background checks for all production-access roles; annual security training; signed confidentiality agreements.
• Resilience — multi-AZ deployment per region; quarterly failover drills; RPO ≤ 5 min, RTO ≤ 30 min for the core platform.

A more detailed TOM appendix is available on request to security-sensitive customers under NDA via trust@prodview.app.

8 · Sub-processors

ProdView engages the sub-processors listed at /security to deliver the Service. Customer hereby gives general authorisation for ProdView to engage these and future sub-processors, subject to the following:

• ProdView will impose contractual obligations on each sub-processor at least as protective as this DPA.
• ProdView will give Customer 30 days' prior notice of any new sub-processor via the trust portal and an email to admin contacts.
• Customer may object to a new sub-processor on reasonable grounds. If we cannot resolve the objection, Customer's exclusive remedy is to terminate the affected portion of the Service.

9 · International data transfers

Customer chooses the data residency region at provisioning (US, EU, or APAC). For any cross-border transfers that may be needed to deliver the Service:

• For transfers from the EEA — we rely on the European Commission's Standard Contractual Clauses (Module 2, Controller-to-Processor), incorporated by reference. The relevant Annexes are populated by the operative parts of these Terms and this DPA.
• For transfers from the UK — the UK Addendum to the EU SCCs (IDTA) applies.
• For transfers from Switzerland — the FADP equivalent of the SCCs applies.

Customer may execute SCCs as a signed PDF via the trust portal if its compliance team needs that artefact.

10 · Personal-data breach notification

If ProdView becomes aware of a Personal-Data Breach affecting Customer Personal Data, ProdView will notify Customer without undue delay and in any event within 24 hours of becoming aware. The notification will include:

• The nature of the breach and the categories and approximate number of affected data subjects;
• The likely consequences;
• The measures taken or proposed to address it.

ProdView will assist Customer with its own breach-notification obligations to supervisory authorities and data subjects, where applicable.

11 · Data subject rights

The Service provides Customer with the tooling to fulfil data-subject requests directly — every data subject has a built-in "My ProdView" view, can export their data, and can request deletion of their own data (subject to Customer's retention policy).

If a data subject contacts ProdView directly, we will forward the request to Customer without undue delay and not respond to the data subject other than to acknowledge receipt and confirm the forward.

12 · Audits

ProdView demonstrates compliance with this DPA primarily through the SOC 2 Type II and ISO 27001 reports and the Security Center. Customer may request these reports under NDA at any time.

If those reports are insufficient for Customer's compliance obligation, Customer may conduct an audit with 30 days' prior written notice, no more than once per calendar year (unless required by a Supervisory Authority), during regular business hours, and subject to mutual NDA. Audit costs are borne by Customer except where the audit reveals a material breach.

13 · Term, return, and deletion

This DPA is in effect for as long as ProdView processes Customer Personal Data under the Terms. On termination:

• Customer can export all of its data via the admin console for 30 days.
• After 30 days, ProdView permanently deletes Customer Personal Data, except where retention is required by law (e.g. billing records).
• On request, ProdView will provide a written confirmation of deletion within 14 days.

14 · Contact

For DPA-related questions, the legal entity to contact is:

• ProdView, Inc., 24 Hökens Gata, 116 46 Stockholm, Sweden
• Data Protection Officer · dpo@prodview.app
• EU representative · GDPR.eu Local · Berlin · eu-rep@prodview.app