Legal
Data processing addendum
Our standard approach to processing customer data, and how to put a signed addendum in place.
Last updated October 23, 2026
When an addendum applies
A data processing addendum (DPA) is a contract covering personal data that a customer places in Proposo. The signed agreement will identify its legal parties. This page explains the provisions we expect to include. It is not an executed DPA and does not amend an existing agreement on its own. To request a signed DPA, email hello@proposeo.co.
Roles and scope
For proposal content, recipient information, signatures, and related audit records, the customer generally decides why and how the data is used and Proposo processes it to provide Proposo. Processing lasts for the customer's use of the service and any agreed retention period. Data subjects may include the customer's staff, prospects, clients, and signers. Data types depend on what the customer chooses to upload or enter. Proposo handles its own account administration and business contact data as described in the Privacy notice.
Instructions, confidentiality, and security
A signed DPA will specify that we process customer personal data on documented customer instructions, unless law requires otherwise. People authorized to access that data must be bound to confidentiality. We will maintain measures appropriate to the risk, including controlled access, encrypted network connections, and operational monitoring. The precise security schedule should be agreed with the customer and reviewed against the service actually deployed.
Service providers and transfers
Hosting and transactional email providers support the service. Optional AI drafting and customer-connected integrations can involve additional providers when enabled. A signed DPA should identify the relevant subprocessors, set out how changes are communicated, and require equivalent data protection duties from them. If a cross-border transfer needs a particular legal mechanism, that mechanism must be included in the signed agreement before relying on it; this page does not itself provide standard contractual clauses.
Requests, incidents, and end of service
The signed DPA should describe how we help a customer respond to data subject requests, assess security incidents, and meet applicable privacy obligations. It should also set out a process to return or delete customer data when service ends, subject to legal retention duties, and a reasonable way for the customer to verify compliance. We will provide the final terms and any transfer schedule for review before signature.
Contact
Send DPA requests to hello@proposeo.co.