Skip to content
Tradeforce Pros

Data Processing Addendum · Version 0.1-draft (current)

Tradeforce Pros — Data Processing Addendum (DPA)

DRAFT — PENDING ATTORNEY REVIEW. NOT LEGAL ADVICE. Drafted by an AI legal researcher under founder rulings R-251 item 10 and R-252 items 3 and 6. It governs the personal information our customers put into the Service about their own customers and contacts. Bracketed items must be completed and the drafting notes removed before use. Under J7 (R-252 item 6) no commitment here may exceed what the software or a written, tested manual procedure does.

Version: 0.1-draft · Effective date: [EFFECTIVE DATE] · Last updated: 2026-10-17

This Data Processing Addendum ("DPA") forms part of the Terms of Service (the "Agreement") between [Tradeforce Pros, LLC] ("Tradeforce Pros," "Service Provider") and the Customer. Customer accepts it when it accepts the Agreement. Capitalized terms not defined here have the meanings in the Agreement. If this DPA conflicts with the Agreement on a data-protection matter, this DPA controls.

1. Definitions

  • "Data Protection Laws" means all U.S. federal and state laws on the privacy, security or processing of personal information that apply to a party's processing of Customer Personal Information, including, to the extent they apply, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.) and its regulations ("CCPA"), other state comprehensive privacy laws, and state data-breach and data-security laws (including N.C. Gen. Stat. §§ 75-60 to 75-66).
  • "Customer Personal Information" means personal information within Customer Data that Tradeforce Pros processes on Customer's behalf in providing the Service — principally End-Customer Data (names, work emails, phone numbers, site and business addresses, and related proposal content about Customer's customers, prospects and their staff).
  • "Process" means any operation on personal information, including collecting, storing, using, disclosing, transmitting and erasing it.
  • "Security Incident" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Information. It does not include unsuccessful attempts that do not compromise security (for example blocked sign-in attempts, pings or scans).
  • "Subprocessor" means a third party engaged by Tradeforce Pros that processes Customer Personal Information.
  • "Business," "Service Provider," "Sell," "Share," "Business Purpose" and "Consumer" have the meanings in the CCPA; "controller" and "processor" have the meanings in other Data Protection Laws.

2. Roles and scope

2.1 Roles. For Customer Personal Information, Customer is the business / controller and Tradeforce Pros is the service provider / processor. Customer decides what personal information is entered and why.

2.2 Our own data. This DPA does not cover personal information Tradeforce Pros processes as a business / controller for its own purposes — Users' account, sign-in, security and billing information — which is governed by the Privacy Policy.

2.3 Details of processing. Annex 1 describes the subject matter, nature, purpose, duration and categories of data and people.

3. Customer's obligations

Customer represents and warrants that: (a) it has provided all notices and obtained all consents and rights required by Data Protection Laws for Tradeforce Pros to process Customer Personal Information under the Agreement; (b) its instructions comply with Data Protection Laws; (c) it will not provide Tradeforce Pros with the sensitive categories of information excluded by Agreement §5(b) (government ID numbers, financial-account or card numbers, health, biometric or precise geolocation information, or information about children); and (d) it is responsible for responding to its own customers' and contacts' privacy requests and for any notices it owes them, including breach notices (§10.5).

4. Processing only on instructions

4.1 Tradeforce Pros will process Customer Personal Information only (a) on Customer's documented instructions, which are the Agreement, this DPA, and Customer's use and configuration of the Service, (b) for the Business Purposes listed in Annex 1 — providing, securing, supporting and maintaining the Service — and (c) as required by law, in which case we will tell Customer before processing unless the law prohibits it.

4.2 We will tell Customer if we believe an instruction violates Data Protection Laws, and may suspend the affected processing until Customer confirms or changes it.

5. Service-provider commitments (CCPA and similar laws)

To the extent the CCPA or a similar law applies to Customer's processing, Tradeforce Pros:

  1. will process Customer Personal Information only for the limited and specified Business Purposes in Annex 1;
  2. will not Sell or Share Customer Personal Information;
  3. will not retain, use or disclose it for any purpose — including any commercial purpose — other than the Business Purposes, or as otherwise permitted for service providers by Data Protection Laws;
  4. will not retain, use or disclose it outside the direct business relationship between Customer and Tradeforce Pros;
  5. will not combine it with personal information received from or on behalf of anyone else, or collected from our own interactions with consumers, except as Data Protection Laws permit for service providers (for example to detect security incidents or fraud);
  6. will comply with applicable obligations under Data Protection Laws and provide the same level of privacy protection they require of Customer;
  7. grants Customer the right to take reasonable and appropriate steps to ensure that we use Customer Personal Information consistently with Customer's obligations, as set out in §13;
  8. will notify Customer within five (5) business days if we determine that we can no longer meet our obligations under Data Protection Laws;
  9. grants Customer the right, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Information; and
  10. will help Customer respond to consumer requests as set out in §9, and will impose these same obligations on our Subprocessors (§7).

Tradeforce Pros certifies that it understands and will comply with these restrictions.

6. Personnel

Tradeforce Pros will ensure that every person it authorizes to process Customer Personal Information is bound by an appropriate duty of confidentiality and accesses it only as needed to provide the Service. Today that is limited to Tradeforce Pros' system administrator.

7. Subprocessors

7.1 Authorization. Customer gives general authorization for Tradeforce Pros to engage Subprocessors. The current Subprocessors are on the Subprocessor List.

7.2 Flow-down. We will enter into a written contract with each Subprocessor that imposes data-protection obligations no less protective than this DPA, to the extent applicable to the services it provides.

7.3 Responsibility. We remain responsible to Customer for each Subprocessor's performance of its obligations, subject to the Agreement's limitation of liability.

7.4 New Subprocessors and objection. We will give at least thirty (30) days' notice before a new Subprocessor processes Customer Personal Information, by email to the Owner(s) and by updating the list. Customer may object in writing on reasonable data-protection grounds within that period. We will then discuss the objection in good faith; if we cannot reasonably accommodate it, Customer may terminate the affected subscription by written notice and receive a pro-rata refund of prepaid fees for the unused period, which is Customer's sole remedy. In an emergency (for example to replace a failed provider to keep the Service secure or available), we may give shorter notice and will give notice as soon as practicable.

8. Security

8.1 Tradeforce Pros will implement and maintain the technical and organizational measures in Annex 2, which are designed to protect Customer Personal Information against Security Incidents and are appropriate to the risk.

8.2 We may update those measures, provided we do not materially reduce the overall protection of Customer Personal Information.

8.3 Customer is responsible for its own security choices in the Service, including roles and permissions, deactivating departing Users, requiring 2FA for all Users if it wishes, and protecting the documents it downloads.

9. Assistance with requests

9.1 Requests to Customer. Customer can view, correct and archive Customer Personal Information itself in the Service. If Customer cannot fulfil a consumer's verified request (for example a request to delete or to obtain a copy) using the Service, Tradeforce Pros will, on Customer's written request, provide reasonable assistance within fifteen (15) business days [CONFIRM achievable with the manual erasure/export procedure], so Customer can meet its legal deadline (typically 45 days under the CCPA).

9.2 Requests to us. If we receive a request from a consumer about Customer Personal Information, we will not respond to it ourselves (except to say we have forwarded it), and will forward it to Customer within ten (10) business days if we can identify Customer.

9.3 Deletion requests. Because the Service archives rather than deletes records, deletion of a person's information from Customer Data is carried out by Tradeforce Pros' system administrator on Customer's written instruction, by a logged manual procedure. We will delete or permanently de-identify the person's information in the live database, including in the edit log, and in stored generated documents as Customer directs, and confirm completion in writing. Backups roll off on their normal schedule (§12.3). [Drafting note: the procedure does not exist yet — plan slice L5 / J11. This clause must not be published until it does and has been tested on a real dev org, including S3 objects, which the app never deletes today.]

9.4 Departing Users and the Customer's own staff. When a User leaves Customer's company, the records he or she created remain Customer Data. Requests by a former User concerning his or her own account are handled under the Privacy Policy; where they concern Customer Data we will consult Customer and follow its lawful instructions.

9.5 Other assistance. We will provide reasonable information Customer needs for a data-protection assessment required by Data Protection Laws, to the extent Customer does not otherwise have it.

10. Security Incidents

10.1 Notice. Tradeforce Pros will notify Customer without undue delay, and in any event within seventy-two (72) hours, after confirming a Security Incident affecting Customer's Customer Personal Information, by email to the Owner(s) (and by telephone where practicable).

10.2 Content. The notice will describe, to the extent then known: the nature of the incident; the categories and approximate number of records and people affected; when it happened and was discovered; the likely consequences; the steps taken or proposed to contain and remediate it; and a contact for more information. We will provide updates as we learn more. We may provide information in phases.

10.3 Response. We will promptly take reasonable steps to contain, investigate and remediate the incident, preserve relevant evidence, and cooperate with Customer's reasonable requests.

10.4 Login credentials. Because a username or email address combined with a password can be "personal information" under some breach laws, a Security Incident involving our Users' sign-in credentials will be handled under these procedures, and we will notify affected Users directly as our Privacy Policy states. Passwords are stored only as argon2id hashes.

10.5 Customer's notifications. Customer, as owner of Customer Personal Information, is responsible for deciding whether and how to notify its own customers, contacts, regulators and credit agencies, and we will provide reasonable information to help it do so. We will not notify Customer's customers or regulators about Customer Personal Information on Customer's behalf unless Customer asks us in writing or the law requires us to.

10.6 No admission. Our notice of or response to a Security Incident is not an acknowledgment of fault or liability.

10.7 Costs. Each party bears its own costs of responding to a Security Incident, except that where the incident was caused by our breach of this DPA, we will reimburse Customer's reasonable, documented costs of legally required notices to affected individuals, subject to the Agreement's limitation of liability. [ATT-DPA-2: decide whether to keep this reimbursement or exclude all incident costs; whether to raise the cap for data-security claims; and cyber-insurance.]

If Tradeforce Pros receives a subpoena, court order, warrant or other government or third-party demand for Customer Personal Information, we will: (a) attempt to redirect the requester to Customer; (b) promptly notify Customer and provide a copy of the demand, unless the law or a court order prohibits it, or there is an emergency involving danger of death or serious physical injury; (c) where we reasonably believe the demand is invalid or overbroad, consider challenging it, and in any case disclose only the minimum required; and (d) reasonably cooperate with Customer's lawful efforts to seek a protective order, at Customer's expense. Agreement §10.4 (costs) applies.

12. Return and deletion

12.1 During the term. Customer can archive records in the Service. Erasure of a person's information is handled under §9.3.

12.2 At the end of the Agreement. On an Owner's written request made within thirty (30) days after the Agreement or subscription ends, Tradeforce Pros will provide an export of Customer Data as described in Agreement §12.7(a). After that window, Customer Data is kept in archived, inaccessible form consistent with our archive design until Customer asks us to erase it (§12.4) or we decide to erase it, and in either case it continues to be protected by this DPA for as long as we hold it.

12.3 Backups. Customer Personal Information in backups is not individually erased; backups roll off automatically after our database provider's recovery window [CONFIRM the Neon history window] and are protected by this DPA until then. If we must restore from backup, we will re-apply erasures made since the backup.

12.4 Erasure after termination. On an Owner's written request after termination, we will erase or permanently de-identify Customer Personal Information within sixty (60) days [CONFIRM achievable], except data we must keep by law, data in backups (§12.3), and records of acceptance of the Agreement, and will confirm in writing on request.

13. Audits and information

13.1 On written request, no more than once in any twelve-month period (or after a Security Incident), Tradeforce Pros will answer a reasonable written security questionnaire and provide a summary of its security measures. We do not hold third-party certifications (such as SOC 2) today and do not represent that we do.

13.2 Given our size, we do not offer on-site audits. If a regulator requires one, or if Customer reasonably shows that the information in §13.1 is insufficient to demonstrate our compliance, the parties will agree on the scope, timing and cost of a remote review, at Customer's expense, subject to confidentiality.

14. Location and transfers

Tradeforce Pros and its Subprocessors process Customer Personal Information in the United States. We will not transfer it outside the United States without giving notice under §7.4.

15. De-identified and aggregated data

If Tradeforce Pros creates de-identified or aggregated information from Customer Personal Information (Agreement §7.4), it will take reasonable measures to ensure the information cannot be associated with a person, publicly commit not to re-identify it, and contractually require any recipient to do the same.

16. Liability

Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement.

17. Term

This DPA lasts for as long as Tradeforce Pros processes Customer Personal Information.

Annex 1 — Details of processing

Item Description
Subject matter Hosting and processing of Customer Data to provide the Tradeforce Pros CRM and proposal-generation Service
Nature of processing Storage, organization, retrieval, display, calculation, document generation (Word and PDF), transmission, backup, archiving and, on instruction, erasure
Business Purposes (1) Providing the Service as configured by Customer; (2) security, integrity and fraud/abuse prevention; (3) debugging and repairing errors; (4) customer support, including data imports Customer requests; (5) maintaining and improving the Service (without building profiles of individuals); (6) complying with law
Categories of individuals Customer's customers, prospects and their personnel; contacts at customer sites; Customer's Users and staff named in proposals
Categories of personal information Names; work email addresses; phone numbers; business and site addresses; job roles; proposal and scope content that may mention individuals; approval comments and loss notes entered by Users; values recorded in the edit log
Sensitive information None intended. Excluded by Agreement §5(b) and DPA §3(c)
Frequency Continuous, for the term of the Agreement
Duration and retention The term of the Agreement plus the periods in §12
Subprocessors See the Subprocessor List

Annex 2 — Security measures

These are the measures in place on 2026-10-17. [Drafting note: each item below is verified in code or STACK.md except where marked CONFIRM. Never add an item that is not yet true.]

  1. Tenant isolation at the database. Each customer's data is separated by PostgreSQL row-level security enforced by the database role the application connects as, with an additional explicit organization check in every query. [CONFIRM before publication: production must run on the NOBYPASSRLS application role — CF-5 / CF-12 / Security Gate item 9. Do not publish this sentence until it is true in production.]
  2. Encryption in transit. All connections to the Service and between the Service and its database and providers use TLS (HTTPS).
  3. Encryption at rest. Database and file storage are encrypted at rest by our providers [CONFIRM Neon and S3 default encryption]; 2FA secrets are additionally encrypted at the application level.
  4. Authentication. Passwords hashed with argon2id; breached-password screening using k-anonymity; mandatory TOTP two-factor authentication for administrators, optionally required company-wide; replay protection on 2FA codes; hashed recovery codes.
  5. Sessions. 15-minute access tokens; opaque refresh tokens rotated on every use, with reuse of a spent token treated as compromise and the session revoked; configurable inactivity sign-out (5–60 minutes); a limit of three concurrent sessions per user; Users can view and end their own sessions.
  6. Abuse protection. Sign-in lockout after repeated failures per account and per IP address; rate limits on sensitive actions and address lookups.
  7. Access control. Role-based permissions configured by Customer; Tradeforce Pros staff access limited to the system administrator, who uses a separate login with mandatory 2FA and a sign-in alert.
  8. Audit trail. An append-only, field-level edit log of changes to Customer records, retained for the life of the account.
  9. Document storage. Generated documents and templates are stored privately with all public access blocked and are reachable only through short-lived signed links.
  10. Error monitoring with data minimization. Error reports are scrubbed by an allow-list before leaving our servers; no session replay, no browser tracking.
  11. Secrets management. Credentials are kept in environment configuration, never in source code.
  12. Backups and recovery. Point-in-time recovery provided by our database host [CONFIRM window].
  13. Change control. Code changes are reviewed, including an automated review, and tested before release; changes affecting authentication, payments, tenant isolation or uploads pass a dedicated security review.
  14. Incident response. A written incident-response procedure [NOT YET WRITTEN — owed before launch; plan slice L5 / J10. Remove this item or write the procedure before publication.]