- Product: InProQu SaaS
- Effective date: 15 October 2026
This Data Processing Addendum (“DPA”) forms part of the Terms of Service (or other agreement) between InProQu (“Processor,” “InProQu”) and the customer entity using the Service (“Controller,” “Customer”).
If Customer is subject to GDPR, UK GDPR, or similar laws and uses the Service to process personal data of Customer’s end users or clients, this DPA applies. In case of conflict on data-protection matters, this DPA controls.
1. Definitions
Terms have the meaning in GDPR / UK GDPR where applicable: Personal Data, Processing, Sub-processor, Data Subject, Personal Data Breach, etc. “Customer Personal Data” means Personal Data contained in Customer Content processed by InProQu on Customer’s behalf.
2. Roles
- Customer is Controller (or processor for its own customers; then Customer warrants it has authority to appoint InProQu as sub-processor).
- InProQu is Processor for Customer Personal Data.
- For account/billing data about Customer’s own users that InProQu needs to operate the SaaS relationship, InProQu acts as independent controller (see Privacy Policy).
3. Scope and details of processing
| Item | Description |
|---|---|
| Subject matter | Hosting and operation of proposal/document SaaS features |
| Duration | Term of the Service + deletion/return period |
| Nature | Storage, retrieval, transmission, display, backup, security logging, email delivery as configured |
| Purpose | Provide the Service per Customer’s instructions |
| Types of Personal Data | Names, emails, phones, addresses, commercial proposal content, signatures, IP-derived hashes, user agents, and other data Customer submits |
| Categories of Data Subjects | Customer’s staff; Customer’s clients/prospects; recipients of share links and emails |
| Special categories | Not intended. Customer must not submit special-category data unless a written addendum allows it |
4. Instructions
InProQu processes Customer Personal Data only on documented instructions from Customer (including configuration in the product: sharing, integrations, email sends), unless required by law. The Agreement, this DPA, and product settings constitute instructions. InProQu will inform Customer if an instruction appears to infringe applicable data-protection law (without obligation to provide legal advice).
5. Confidentiality
Personnel authorized to process Customer Personal Data are bound by confidentiality obligations.
6. Security
InProQu implements appropriate technical and organizational measures, including as summarized in the Privacy Policy (encryption of selected fields, access control, authentication controls, audit logging with hashed IPs where used). Customer is responsible for configuring sharing, passwords, SSO/MFA (where available), and integration scopes appropriately.
7. Sub-processors
Customer authorizes InProQu to engage sub-processors listed in Subprocessors (as updated). InProQu will impose data-protection obligations no less protective than this DPA.
Notice of changes: InProQu will update the subprocessor list and, for material new platform sub-processors, provide notice via [email protected] or in-product/email notice. Customer may object on reasonable data-protection grounds within 15 days; if unresolved, Customer may terminate the affected Service as its sole remedy.
Customer-initiated transfers: When Customer connects BYOK integrations (Gmail, Stripe, OpenAI, etc.), those providers process data under Customer’s relationship; they are not InProQu platform sub-processors for that purpose.
8. International transfers
Where Customer Personal Data is transferred internationally, the parties will ensure a valid transfer mechanism (for example Standard Contractual Clauses). Additional SCC modules may be attached as an annex to this DPA where required.
9. Assistance
Taking into account the nature of processing, InProQu will assist Customer with:
- Data subject requests (via tools or [email protected])
- Security and DPIA-related information reasonably available
- Breach notification: without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, with known facts
Customer remains responsible for responding to its own data subjects.
10. Return and deletion
Upon termination of the Service, Customer may export available data during any export window. Thereafter InProQu will delete Customer Personal Data from active systems within a commercially reasonable period, except data retained in backups for a limited cycle or required by law. Certificate of deletion available on written request where feasible.
11. Audits
Upon reasonable written notice (max once per 12 months unless for cause), Customer may request information reasonably necessary to demonstrate compliance (security summaries, questionnaires). On-site audits only if required by law or after a material unresolved breach, under confidentiality, during business hours, and without disrupting operations. Customer bears its own costs unless a material breach of this DPA is confirmed.
12. Liability
Liability under this DPA is subject to the limitations in the Terms, except where prohibited by applicable data-protection law regarding Processor liability to Data Subjects.
13. Contact
Annex A — Technical measures (summary)
- Encryption in transit (TLS)
- Encryption at rest for secrets and selected sensitive fields
- Logical tenant isolation
- Access control and admin logging
- Vulnerability and dependency management practices
- Backup and restore procedures