Data Processing Agreement

1. Definitions

This Data Processing Agreement ("DPA") forms part of the Master Subscription Agreement ("Agreement") between ProcureLabs Pte. Ltd. ("Processor") and the entity subscribing to ProcureLabs services ("Controller"). Terms not defined herein shall have the meanings set forth in the Agreement or in Regulation (EU) 2016/679 ("GDPR").

• Personal Data means any information relating to an identified or identifiable natural person processed under this DPA.
• Processing means any operation performed on Personal Data, including collection, storage, alteration, retrieval, use, disclosure, and erasure.
• Sub-processor means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

2. Scope and Purpose of Processing

The Processor shall process Personal Data solely for the purpose of providing the ProcureLabs procurement intelligence platform services as described in the Agreement. Categories of data subjects include Controller's employees, consultants, and authorized users. Categories of Personal Data include names, email addresses, job titles, organizational roles, IP addresses, and usage analytics.

3. Processor Obligations (GDPR Article 28)

• Process Personal Data only on documented instructions from the Controller, unless required by applicable law.
• Ensure that persons authorized to process Personal Data have committed to confidentiality or are under an appropriate statutory obligation of confidentiality.
• Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption at rest (AES-256) and in transit (TLS 1.2+), and access controls with multi-factor authentication that tenant administrators can require.
• Not engage another processor without prior specific or general written authorization of the Controller. Where general authorization is given, the Processor shall inform the Controller of intended changes with 30 days' notice.
• Assist the Controller in responding to data subject requests (access, rectification, erasure, portability, restriction, and objection).
• Assist the Controller in ensuring compliance with security, breach notification, and data protection impact assessment obligations.
• At the Controller's choice, delete or return all Personal Data upon termination of services, and delete existing copies unless retention is required by applicable law.
• Make available to the Controller all information necessary to demonstrate compliance and allow for and contribute to audits.

4. Sub-processors

The Controller grants general authorization for the Processor to engage sub-processors listed below. The Processor shall notify the Controller at least 30 days before adding or replacing sub-processors.

The DocuSeal pilot entry is expressly excluded from the general authorization for listed client subprocessors above. Signing the vendor DPA, publishing this disclosure, a successful pilot or an administrator setting does not by itself authorize client processing or overseas transfers.

DocuSign production integration approval and the applicable data protection agreement have not yet been confirmed. Confirm the sending account region before enabling this signing option.

Current as of the date above. See /subprocessors for the live list.

OpenAI supports chat, analysis and bounded Decisions judgements for tool selection and procurement evidence. Subject to current customer permission and the agreed regional configuration, Decisions receives minimised, redacted context and questions for the permitted purpose. OpenAI API data is not used for model training unless explicitly opted in. Decisions can retain encrypted prompt-cache state for up to 24 hours and standard abuse-monitoring logs for up to 30 days, subject to applicable security, safety or legal exceptions.

Decisions processing requires current customer instructions and permission for the specific purpose, account, processor and US transfer. Disabling AI or withdrawing the applicable authority prevents new Decisions requests. Consequential actions remain subject to the required safeguards and independent review.

5. International Data Transfers

Where Personal Data is transferred outside the European Economic Area, the Processor shall ensure adequate safeguards are in place, including: (a) EU Standard Contractual Clauses (Module 2: Controller to Processor) as approved by Commission Implementing Decision (EU) 2021/914; (b) binding corporate rules where applicable; or (c) transfers to countries with an adequacy decision by the European Commission.

6. Data Breach Notification

The Processor shall notify the Controller without undue delay and in any event within 72 hours after becoming aware of a Personal Data breach. Notification shall include: (a) the nature of the breach including approximate number of data subjects affected; (b) the likely consequences of the breach; (c) measures taken or proposed to address the breach; (d) contact information for the Processor's data protection point of contact.

7. Security Measures

• Encryption at rest (AES-256) and in transit (TLS 1.2+)
• Multi-factor authentication available to all users; tenant administrators can require it for everyone or for administrators
• Row-level security with tenant isolation on the database tables that hold customer data
• Automated scanning of every code change for committed secrets (Gitleaks) and fixable critical dependency vulnerabilities (Trivy)
• Controls are mapped to the SOC 2 Trust Services Criteria in a control matrix available on request. SOC 2 Type II preparation programme is in progress; our own audit has not yet begun and no completed Type II report is available.
• Session timeout enforcement (30 minutes of inactivity)
• CSRF protection on state-changing requests, using a double-submit token that is reissued every hour
• Content Security Policy with per-request nonces
• Rate limiting on API requests, per IP address and per user on resource-intensive endpoints, with counters shared across servers through Redis when Redis is configured and kept per server otherwise
• Retention follows the applicable data category, customer instructions, legal holds and provider terms. Chat history, derived content, audit records and provider logs have separate retention conditions. Deletion requests are handled under the DPA and applicable law.

8. Data Subject Rights

The Processor shall assist the Controller in fulfilling its obligations to respond to data subject requests within 30 calendar days. The platform provides self-service data export and account deletion (Settings > Account), and access review capabilities.

9. Audit Rights

The Controller may audit the Processor's compliance with this DPA no more than once per calendar year, with 30 days' written notice. The Processor shall make available relevant compliance reports, certifications, and third-party audit summaries. Remote audits are preferred; on-site audits shall be conducted at the Controller's expense.

10. Term and Termination

This DPA shall remain in effect for the duration of the Agreement. Upon termination, the Processor shall, at the Controller's election, return or delete all Personal Data within 30 days. Deletion on termination is carried out by the Processor's staff on the Controller's written instruction, not by an automated process in the platform. Certification of deletion shall be provided upon request.