ProPortalBusiness Data Processing Agreement

This Data Processing Agreement (the "DPA") governs the processing of personal data by ProPortalBusiness on behalf of a customer ("you", "Customer") in connection with your use of the ProPortalBusiness platform (the "Services"). It applies to the extent that the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, or the EU General Data Protection Regulation ("EU GDPR") applies to that processing.

This DPA is incorporated into and forms part of the Terms of Service. Where this DPA conflicts with the Terms of Service in relation to the processing of personal data, this DPA prevails. Our general privacy practices, including the processing for which we act as controller, are described in our Privacy Policy.

ProPortalBusiness is operated by Kieran J. R. Martin, a sole trader based in the United Kingdom ("ProPortalBusiness", "we", "us").

• You normally act as Data Controller for the personal data you enter into the platform about your own clients, customers, tenants, employees and contacts ("Customer Personal Data"). You determine the purposes and means of that processing.
• ProPortalBusiness acts as Data Processor when it processes Customer Personal Data on your behalf in order to provide the Services.
• ProPortalBusiness acts as an independent controller for the limited data it needs to run its own business — for example your own account and billing details, security logs and support correspondence. That processing is governed by the Privacy Policy, not by this DPA.
• You retain ownership and control of your Customer Data. We claim no ownership of it and do not use it for our own purposes, and we do not use it to train AI models.

• "personal data", "processing", "controller", "processor", "data subject" and "supervisory authority" have the meanings given in the UK GDPR.
• "Customer Personal Data" means personal data contained in Customer Data that we process on your behalf under this DPA.
• "Subprocessor" means a third party engaged by us to process Customer Personal Data in connection with the Services.
• "Data Protection Laws" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and, where applicable, the EU GDPR.

The subject matter of the processing is the provision of the Services to you. Processing begins when you first submit Customer Personal Data to the platform and continues for as long as your account remains active, and thereafter only for the limited period described in section 16 or as required by law.

We process Customer Personal Data only to operate, maintain, secure and support the Services for you, including: storing and retrieving client and project records; generating, sending and tracking invoices and receipts; recording time entries, expenses and receipts; producing contracts and capturing electronic signatures; operating client portals and portal invitations; sending transactional emails and reminders you trigger; recording marketing consent and suppression preferences you capture; producing reports, exports and record-keeping outputs; and providing technical support at your request.

• Identification and contact details — names, business names, email addresses, telephone numbers, postal addresses, client reference numbers.
• Commercial and financial records — quotes, invoices, line items, payment status, expenses, receipts, time entries, project and job records.
• Contract and signature data — contract content, signatory name, signature, timestamp and IP address where captured.
• Communication and consent data — messages sent through the platform, marketing consent status, source, method and consent history.
• Technical data — portal access tokens, access timestamps and related security metadata.
• Any other personal data you choose to enter into free-text fields, notes or uploaded files. You should not submit special category data unless it is necessary and you have a lawful basis for doing so.

• Your clients and customers, and their staff or representatives.
• Your tenants, where you use the rental features.
• Your employees, staff and contractors, where you use team, rota or staff features.
• Your prospects and other business contacts recorded in the platform.

We will process Customer Personal Data only in accordance with your documented instructions, unless we are required to process it by applicable law. Your instructions consist of this DPA, the Terms of Service, your configuration and use of the Services, and any further written instruction you give us that is consistent with the Services.

If we are required by law to process Customer Personal Data otherwise than on your instructions, we will inform you of that legal requirement before processing, unless the law prohibits us from doing so. If in our reasonable opinion an instruction would infringe Data Protection Laws, we will inform you without undue delay.

We treat Customer Personal Data as confidential. Any personnel authorised to process Customer Personal Data are subject to a duty of confidentiality, are informed of the confidential nature of the data, and are granted access only where necessary to operate, support or secure the Services. That duty survives the end of their engagement.

We maintain appropriate technical and organisational measures designed to protect Customer Personal Data against unauthorised or unlawful processing and against accidental loss, destruction or damage, taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of processing. Current measures include:

• encryption in transit over HTTPS/TLS for all platform traffic, API calls, webhooks and file uploads;
• encryption at rest of the managed database and file storage by our infrastructure providers;
• additional application-layer AES-256-GCM encryption of highly sensitive integration credentials, such as bank connection and HMRC tokens;
• tenant isolation enforced in the database through row-level security policies scoped to the authenticated account, together with server-side authorisation checks on sensitive operations;
• role-based access control, optional multi-factor authentication for account holders, and least-privilege administrative access;
• an append-only audit trail for sensitive financial and administrative actions;
• automated managed backups taken and stored encrypted by our infrastructure provider;
• logical separation of preview and production environments, with credentials held in managed secret storage rather than source code.

Further detail is published on our Security & Compliance page. Measures may be updated over time provided the overall level of protection is not reduced.

You give general authorisation for us to engage Subprocessors where necessary to provide the Services. Each Subprocessor is engaged under a written agreement imposing data-protection obligations appropriate to the services it provides, and is permitted to process Customer Personal Data only as needed to perform those services.

We will inform you of material changes to our Subprocessors — including the addition or replacement of a Subprocessor that processes Customer Personal Data — by updating this page and, where the change is significant, by email or in-app notice, giving you a reasonable opportunity to object. If you reasonably object on data-protection grounds, we will work with you in good faith to find a solution; if none is available, you may terminate the affected Services.

We remain responsible for the performance of our Subprocessors' data-protection obligations.

The following providers are currently used by the live ProPortalBusiness platform:

Plaid and the AI features are only engaged where you choose to use the corresponding functionality. Regions are stated only where they are known to us; where a provider operates a global edge network, request data may be handled in the location nearest to the end user.

The primary application database and file storage for the platform are hosted in the United Kingdom (AWS London, eu-west-2). Some Subprocessors operate global infrastructure, so limited processing may take place outside the UK and EEA.

Where Customer Personal Data is transferred outside the UK or EEA, we rely on an appropriate transfer mechanism under Data Protection Laws — such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses — together with any additional safeguards required in the circumstances.

You are responsible for responding to requests from your own data subjects. The platform provides self-service tools that let you access, correct, export and delete Customer Personal Data directly.

Where a data subject contacts us directly about Customer Personal Data, we will not respond to the substance of the request ourselves; we will refer the individual to you and notify you where we can identify the relevant account. We will provide reasonable assistance, taking into account the nature of the processing, to help you meet your obligations under Chapter III of the UK GDPR.

We will notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. Our notification will describe, to the extent then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it and mitigate its effects.

We will provide reasonable assistance to help you meet your own notification obligations to a supervisory authority or to affected data subjects. As controller, you remain responsible for making those notifications where required.

Taking into account the nature of the processing and the information available to us, we will provide reasonable assistance with data protection impact assessments, prior consultations with a supervisory authority, and enquiries or investigations by a regulator, to the extent they relate to our processing of Customer Personal Data under this DPA.

During your subscription you can export your data in a machine-readable format and delete records at any time from within the platform.

On termination or expiry of your account, and at your choice, we will return or delete Customer Personal Data in accordance with the retention periods set out in our Privacy Policy. Deletion is completed within the applicable retention window, after which residual copies in encrypted backups expire automatically on our provider's rolling schedule. We may retain Customer Personal Data where retention is required by law — for example to meet statutory tax and accounting record-keeping obligations — in which case it remains subject to the protections in this DPA for as long as it is held.

We will make available information reasonably necessary to demonstrate our compliance with this DPA, and will contribute to audits and inspections carried out by you or an independent auditor mandated by you, in accordance with Article 28(3)(h) of the UK GDPR.

Audits must be requested in writing with reasonable notice, must be limited in scope to our processing of Customer Personal Data, must not compromise the confidentiality or security of other customers, and must be conducted no more than once in any twelve-month period unless required by a supervisory authority or following a personal data breach. We may satisfy an audit request by providing our published security documentation and written responses where these reasonably address the request.

Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability set out in the Terms of Service. Nothing in this DPA limits any liability that cannot lawfully be limited, or affects the rights of data subjects under Data Protection Laws.

This DPA takes effect when you begin using the Services and continues for as long as we process Customer Personal Data on your behalf. It terminates automatically once that processing has ceased and the data has been returned or deleted in accordance with section 17. Provisions that by their nature should survive — including confidentiality, security, liability and deletion obligations — continue to apply.

This DPA is governed by the laws of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales, subject to any non-excludable rights of data subjects or supervisory authorities.

ProPortalBusiness — operated by Kieran J. R. Martin, sole trader, United Kingdom
Data protection enquiries: Support@ProPortalBusiness.com

UK data subjects may also contact the Information Commissioner's Office (ICO); EU data subjects may contact their local supervisory authority.