Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the agreement between the customer ("Controller") and Offerframe ("Processor"), operated at offerframe.io. This DPA governs the processing of personal data by the Processor on behalf of the Controller in connection with the Offerframe platform. This DPA is effective as of the date the Controller accepts the Offerframe Terms of Service or begins using the Service.

2. Definitions

The following terms have the meanings set out below. Where not defined here, terms have the meanings given in the EU General Data Protection Regulation (GDPR) or applicable data protection law.

• Controller — the customer organization that determines the purposes and means of processing personal data via the Offerframe platform.
• Processor — Offerframe, which processes personal data on behalf of the Controller to provide the Service.
• Data Subject — an identified or identifiable natural person whose personal data is processed.
• Personal Data — any information relating to a Data Subject, including names, email addresses, business contact details, and any other data uploaded to the platform.
• Processing — any operation performed on personal data, including collection, storage, retrieval, use, disclosure, erasure, or destruction.
• Sub-processor — a third-party service provider engaged by the Processor to assist in processing personal data.
• Supervisory Authority — an independent public authority responsible for monitoring the application of data protection law.

3. Scope and Purpose of Processing

The Processor processes personal data solely for the purpose of providing the Offerframe platform and related services to the Controller. This includes storing and managing quotes, catalogs, customer contact information, e-signatures, and related business data. The categories of data subjects include the Controller's employees, customers, and business contacts. The types of personal data processed include names, email addresses, phone numbers, business addresses, job titles, and any additional data the Controller chooses to include in quotes or templates.

4. Obligations of the Processor

The Processor shall:

• Process personal data only on documented instructions from the Controller, unless required by law.
• Ensure that persons authorized to process personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement and maintain appropriate technical and organizational security measures as described in Section 8.
• Assist the Controller in responding to requests from Data Subjects exercising their rights under GDPR.
• Assist the Controller in ensuring compliance with obligations related to security, breach notification, data protection impact assessments, and prior consultation with supervisory authorities.
• At the Controller's choice, delete or return all personal data upon termination of the Service, and delete existing copies unless retention is required by law.
• Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for audits and inspections.

5. Obligations of the Controller

The Controller shall:

• Ensure that there is a lawful basis for processing personal data through the Offerframe platform, including obtaining any necessary consents from Data Subjects.
• Provide documented instructions to the Processor regarding the processing of personal data.
• Ensure that the personal data provided to the Processor is accurate and up to date.
• Comply with all applicable data protection laws in connection with its use of the Service.
• Notify the Processor promptly if any processing instruction infringes applicable data protection law.

6. Sub-processors

The Controller provides general authorization for the Processor to engage the following sub-processors. The Processor will notify the Controller at least 30 days before adding or replacing a sub-processor, giving the Controller an opportunity to object.

• Supabase (AWS) — database hosting, authentication, and storage. Data location: United States.
• Vercel — application hosting and edge network. Data location: Global (primary: United States).
• Resend — transactional email delivery. Data location: United States.
• Stripe — payment processing and subscription management. Data location: United States.

Each sub-processor is bound by data protection obligations no less protective than those set out in this DPA. The Processor remains fully liable for the acts and omissions of its sub-processors.

7. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to Data Subject requests under GDPR, including the right of access, rectification, erasure, restriction, data portability, and objection. If the Processor receives a request directly from a Data Subject, the Processor will promptly notify the Controller and will not respond to the request without the Controller's instructions, unless required by law.

8. Security Measures

• Encryption at rest — AES-256 encryption for all stored data.
• Encryption in transit — TLS 1.2+ for all data transmitted between clients and servers.
• Row-level security (RLS) — database-level tenant isolation ensuring each Controller can only access their own data.
• Audit logging — comprehensive logging of all sensitive actions, including administrative access.
• Access controls — role-based access with least-privilege principles for all platform personnel.
• Infrastructure security — hosted on SOC 2 compliant cloud infrastructure with automated monitoring.
• Regular security reviews — periodic assessment of security measures and prompt remediation of identified risks.

9. Data Breach Notification

10. Data Deletion and Return

Upon termination of the Service or upon the Controller's written request, the Processor shall, at the Controller's election, return a complete copy of all personal data in a structured, commonly used, and machine-readable format, or securely delete all personal data and certify such deletion. Deletion will be completed within 30 days of the request. The Processor may retain personal data to the extent required by applicable law, in which case the Processor shall isolate and protect such data from further processing and delete it when the retention requirement expires.

11. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), the United Kingdom, or Switzerland, the Processor shall ensure that appropriate safeguards are in place in accordance with GDPR Chapter V. These safeguards include the European Commission's Standard Contractual Clauses (SCCs), which are incorporated by reference into this DPA. The Processor will provide copies of the relevant SCCs upon request. Where a sub-processor is located outside the EEA, the Processor ensures that equivalent protections are contractually applied.

12. Term and Termination

This DPA shall remain in effect for the duration of the Controller's use of the Offerframe platform. The obligations of the Processor regarding data protection shall survive termination of this DPA for as long as the Processor retains any personal data processed on behalf of the Controller. Either party may request amendments to this DPA to reflect changes in applicable data protection law, provided such amendments are agreed in writing.

13. Contact

For questions about this Data Processing Agreement or to exercise any rights under this DPA, please contact us at privacy@offerframe.io.