Data Processing Addendum

This Data Processing Addendum ("DPA") is part of the agreement between Profinetic, LLC, a Florida limited liability company ("Profinetic"), and the business that subscribes to the Profinetic online service ("Customer"): the Terms of Service, or a master subscription agreement the parties have signed, together with each Order Form (the "Agreement"). It applies whenever Profinetic processes Customer Personal Information, and takes effect for Customer when Customer accepts the Agreement, by ticking the box that agrees to it or by signing an Order Form that refers to it. No separate signature is needed; a Customer that would like a countersigned copy can ask for one at the address in Section 16. Capitalized terms not defined here have the meanings the Agreement gives them.

1. Definitions

CCPA: the California Consumer Privacy Act, as amended, and its regulations.
Data Protection Laws: the United States federal and state laws on privacy, data security and breach notification that apply to a party's processing of Customer Personal Information under the Agreement, including the CCPA, the other state consumer privacy laws, the Florida Information Protection Act of 2014 (section 501.171, Florida Statutes) and, for a Customer it applies to, the FTC Safeguards Rule (16 C.F.R. Part 314).
Customer Personal Information: personal information, or personal data as Data Protection Laws define it, within the business records and other Customer Data that Profinetic processes for Customer under the Agreement.
Security Incident: a breach of security leading to the accidental or unlawful destruction, loss or alteration of, or unauthorized disclosure of or access to, Customer Data while Profinetic or its Subprocessors process it, or the misuse of credentials for a Third-Party Service that Profinetic holds. An unsuccessful attempt that does not compromise security, such as a blocked sign-in attempt, a ping or a port scan, is not a Security Incident.
Subprocessor: a third party Profinetic engages that processes Customer Personal Information to provide the Service.
Business, consumer, controller, processor, sell, share, service provider and similar terms have the meanings Data Protection Laws give them.

2. Roles and scope

Customer is the business and controller of Customer Personal Information, and Profinetic is its service provider and processor. Where Customer acts for its Affiliates, it does so as their agent and is responsible for their instructions, and each Affiliate is the controller of its own Customer Personal Information. Annex 1 describes the processing. This DPA applies for as long as Profinetic processes Customer Personal Information, including after the Agreement ends until deletion under Section 12. It covers processing under the laws of the United States only; personal data protected by the laws of another country is Prohibited Data unless an Order Form adds terms for it.

3. Business purposes and instructions

Profinetic processes Customer Personal Information only on Customer's documented instructions, and only for these business purposes:

hosting and storing Customer's business records in the Service;
retrieving data from the Third-Party Services Customer chooses, at its direction;
producing the Output Customer's account uses, including through the AI Features;
sending the account emails the Service needs, such as invitations and security notices;
providing the support Customer asks for;
securing the Service, and detecting, preventing and responding to Security Incidents, fraud and illegal activity;
maintaining the Service for Customer and fixing problems with it, as the CCPA permits a service provider, without using it to improve the Service for anyone else or building profiles for anyone else; and
complying with law.

Customer's instructions are the Agreement, Customer's configuration and use of the Service, and any other written instructions the parties agree. Profinetic will tell Customer if it believes an instruction breaks Data Protection Laws, and need not follow it.

4. Service provider commitments

Profinetic will not:

sell or share Customer Personal Information;
retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes in Section 3, or as the CCPA otherwise permits a service provider;
retain, use or disclose it outside the direct business relationship between Profinetic and Customer;
combine it with personal information that Profinetic receives from or for anyone else, or collects from its own interactions with individuals, except as the CCPA permits a service provider (for example, among Customer and its Affiliates at Customer's direction); or
process it for targeted ads.

Profinetic will:

comply with the obligations Data Protection Laws place on it as a service provider or processor, and give Customer Personal Information the same level of privacy protection the CCPA requires of businesses;
tell Customer within five business days if it decides it can no longer meet those obligations;
let Customer, after notice, take reasonable and appropriate steps to stop and remedy any unauthorized use of Customer Personal Information, including by requiring Profinetic to stop processing it or to delete it;
let Customer take reasonable and appropriate steps under Section 11 to make sure Profinetic uses Customer Personal Information consistently with Customer's obligations; and
use sensitive personal information within Customer Personal Information, such as account sign-in credentials, only for the business purposes in Section 3 and as Data Protection Laws allow.

Profinetic certifies that it understands these restrictions and will comply with them.

5. Personnel

Profinetic makes sure that every person it authorizes to process Customer Personal Information is bound by a duty of confidentiality, has access only to what they need, and loses that access when they no longer need it.

6. Security measures

Profinetic will maintain reasonable security procedures and practices appropriate to the nature of Customer Personal Information, designed to protect it against Security Incidents, including at least the technical and organizational measures in Annex 2. Profinetic may update those measures, but will not materially reduce the overall protection they give during a Subscription Term.

7. Customers covered by the FTC Safeguards Rule

Where Customer is a financial institution under the FTC Safeguards Rule, Profinetic acknowledges that it is Customer's service provider under that rule, and agrees to:

implement and maintain appropriate safeguards for Customer's customer information, as Annex 2 describes;
use and disclose nonpublic personal information Customer provides only to carry out the purposes for which Customer provided it;
notify Customer of a Security Incident under Section 9, with the information Customer needs to make any report the rule requires; and
give Customer the information in Section 11, including on request the records of its account's activity log, so Customer can oversee Profinetic.

Customer remains responsible for its own information security program, including its risk assessment, its oversight of Profinetic, and multi-factor authentication of its Authorized Users. The Service offers two-factor sign-in to each Authorized User, but does not currently let Customer require it of every Authorized User. Before Customer brings customer information the rule covers into the Service, Customer will tell Profinetic, and the parties will agree in an Order Form how Customer will meet the rule's multi-factor authentication requirement for the Service.

8. Subprocessors

Customer authorizes Profinetic to use the Subprocessors listed in Annex 3. Profinetic will:

engage each Subprocessor under a written contract that requires it to protect Customer Personal Information consistently with this DPA and Data Protection Laws, including the restrictions in Section 4, to the extent they apply to its service;
remain responsible for each Subprocessor's compliance; and
give Customer at least 30 days' notice, by email to its account Owners and by updating Annex 3, before a new Subprocessor begins processing Customer Personal Information.

Customer may object to a new Subprocessor on reasonable data protection grounds by notice within those 30 days, and the parties will discuss the objection in good faith. If they cannot resolve it, Customer may terminate the affected part of the Service by notice before the change, and Profinetic will refund the prepaid Fees for the rest of its Subscription Term. If a Subprocessor must be replaced urgently to keep the Service running or secure, Profinetic will give notice as soon as it can, and Customer's rights to object and to terminate still apply.

9. Security incidents

Profinetic will notify Customer without undue delay, and in any event within 72 hours, or any shorter period Data Protection Laws require of Profinetic, after becoming aware of a Security Incident affecting Customer Data. The notice goes by email to Customer's account Owners and to any security contact an Order Form names (and by telephone where the Order Form gives a number), and will describe, as far as is then known, what happened; the kinds of data affected and, where Customer Personal Information is involved, the categories and approximate number of individuals and records affected; the likely consequences; what Profinetic has done and will do to contain and remedy it; and a contact for more information. Profinetic will add to the notice as it learns more.

Profinetic will promptly take reasonable steps to contain, investigate and remedy the Security Incident, keep Customer informed, and give Customer reasonable help with any notice to individuals, regulators or others that Data Protection Laws require of Customer. Profinetic will not notify individuals or regulators about Customer Personal Information on Customer's behalf without Customer's consent, unless the law requires it.

Where a Security Incident results from Profinetic's breach of the Agreement, Profinetic will reimburse Customer's reasonable, documented costs of investigating it; of the notices to individuals, regulators and others that the law requires or that are customary; of a help line for affected individuals; and of 12 months of credit or identity monitoring where the law requires it or it is customary. These are direct damages, recoverable within the Enhanced Cap in the Agreement and not excluded as indirect or consequential damages. A notice of a Security Incident is not an admission of fault.

10. Requests from individuals

If Profinetic receives a request from an individual to exercise a right under Data Protection Laws about Customer Personal Information, it will pass the request to Customer within five business days and will not answer it, except to tell the individual to contact Customer, unless the law requires otherwise. Customer will tell Profinetic about any request from an individual that Profinetic must act on, and give Profinetic the information it needs to do so.

Taking into account the nature of the processing, Profinetic will help Customer respond to requests to access, correct, delete or obtain a copy of Customer Personal Information, or to limit its use: through features of the Service where they exist, and otherwise by acting on Customer's written instructions within 15 business days. Where a request requires deletion, Profinetic will also tell its Subprocessors to delete the information. Copies in backups are kept as Annex 2 describes, and Profinetic deletes the information again if a backup is restored. Where a record comes from a Third-Party Service, Customer should also change or delete it there, or the Service may retrieve it again.

11. Information, assessments and audits

Profinetic will make available the information reasonably necessary to show that it complies with this DPA and Data Protection Laws: on request, up to once every 12 months and after any Security Incident, written answers to a reasonable security and privacy questionnaire, a description of its security measures, and its list of Subprocessors. Profinetic does not currently hold a third-party certification such as SOC 2 or ISO 27001.

If that information is not enough for Customer to meet an obligation under Data Protection Laws, or a regulator requires more, Customer, or an independent assessor it appoints that is bound by confidentiality and is not a competitor of Profinetic, may assess Profinetic's compliance once every 12 months, on at least 30 days' notice, during business hours, at Customer's expense, and in a way that does not expose other customers' data or disrupt the Service. Assessments are by document review and interviews unless a regulator requires an on-site visit.

Profinetic will also give Customer the information it reasonably requests to carry out a data protection or risk assessment, a cybersecurity audit, or an obligation about automated decision-making that Data Protection Laws place on Customer, including a description of the information the Service uses and produces, at a level of detail that does not require Profinetic to disclose its trade secrets or other customers' information.

12. Return and deletion

During the Subscription Term, Customer can export the Customer Personal Information that the Service's export features cover, and on request Profinetic will give Customer a copy of the rest within 30 days. For 30 days after the Agreement ends, Profinetic will, on request, give Customer a copy of Customer Data in a commonly used, machine-readable format such as CSV. Profinetic will then delete Customer Personal Information from the Service's active systems within a further 30 days. Copies in automatic backups are deleted as those backups expire, within 35 days. Snapshots taken before maintenance have no set end date and are kept until Profinetic removes them, as Annex 2 describes. Copies in backups are not used and are restored from only to recover the Service or lost data; after a restore, Profinetic deletes again any Customer Personal Information it had already deleted under this Section or Section 10. Profinetic will tell its Subprocessors, apart from the database provider that holds those backups, to delete what they hold, and will confirm the deletion in writing on request, saying whether copies remain in backups. Apart from copies in backups, and the record of each deletion that Profinetic keeps so that it can apply the deletion again after a restore (identifiers, counts and, where an email address was erased, a hash of that address), Profinetic may keep Customer Personal Information only where the law requires it, and this DPA continues to apply to anything it keeps, backups included.

13. Where data is processed

Profinetic hosts the Service and stores Customer Personal Information in the United States. Some Subprocessors may process it in other countries, and Annex 3 lists where each one does. Profinetic will give notice under Section 8 before moving the Service's hosting or database outside the United States.

14. Customer responsibilities

Customer will:

comply with Data Protection Laws in its use of the Service;
give the notices, and obtain the consents, that Data Protection Laws require for Profinetic's processing, including notices at collection to its customers, personnel and website visitors, and any notice and consent that laws on electronic communications, on electronic monitoring of employees or on tracking devices require, including before it connects a vehicle, equipment or a device that an individual uses;
make sure its instructions are lawful;
not provide Prohibited Data, as the Agreement defines it; and
keep its account's access settings appropriate, including having its Authorized Users use two-factor sign-in where the law requires multi-factor authentication.

15. Liability, changes and precedence

Each party's liability under this DPA is subject to the limits on liability in the Agreement, including its Enhanced Cap for Data Protection Claims. This DPA changes only as the Agreement allows it to, except that Annex 3 is updated under Section 8. If this DPA conflicts with the rest of the Agreement about Customer Personal Information, this DPA controls, unless an Order Form signed by both parties changes it.

16. Contact

Questions about this DPA, requests for a countersigned copy, and security questionnaires can be sent to support@fxintelhq.com. Formal written notices also go by mail to the principal address of Profinetic, LLC shown in its public record with the Florida Division of Corporations.

Annex 1. Details of processing

Subject matter and duration: providing the Service, for the Subscription Term and until deletion under Section 12.
Nature of the processing: hosting, storing, retrieving, organizing, computing, displaying, transmitting and deleting Customer Personal Information as the Service requires.
Purposes: the business purposes in Section 3.
Individuals concerned: Customer's customers and prospective customers; Customer's personnel, such as employees and contractors; Customer's Authorized Users; and other individuals whose information appears in Customer's business records.
Kinds of personal information: identifiers and contact details, such as names, email addresses, phone numbers and postal addresses; commercial information, such as records of Customer's dealings and transactions with its customers; professional or employment-related information about Customer's personnel, including entries they make from phones and other devices; location and usage information from vehicles and equipment Customer connects; business addresses; sign-in information for Authorized Users; the identifier a Third-Party Service gives the account used to connect it; and other information Customer chooses to include in its business records, other than Prohibited Data.
Sensitive personal information: account sign-in credentials (Authorized Users' passwords, stored only as hashes, and credentials for Third-Party Services, stored encrypted), used only to sign in and to retrieve data; and precise geolocation, only where Customer connects vehicles or equipment that report their location. The Service does not ask a phone or computer for its location. Profinetic keeps the location coordinates from connected vehicles and equipment in the Service for 30 days and then removes them; copies in backups are kept as Annex 2 describes.
Frequency: continuous, for the Subscription Term.

Annex 2. Security measures

Sign-in and access

Passwords must be at least 10 characters with upper- and lower-case letters and a number, and are stored only as bcrypt hashes (cost factor 12), never in plain text.
Two-factor sign-in with an authenticator app, with single-use recovery codes, is available to every Authorized User. Its secrets are encrypted at rest. Customer cannot yet require it of every Authorized User (Section 7).
Sign-in attempts are rate-limited by email address and by IP address through a rate-limiting service and, separately from that service, an account is temporarily locked after repeated wrong passwords or two-factor codes. A signed-in session is ended after repeated wrong passwords or codes entered to confirm a change.
Each sign-in opens a session record on the server that can be ended. A session ends after 12 hours without use and no later than 14 days after sign-in. Authorized Users can see and end their own sessions, a password reset ends every session, and sensitive changes, such as transferring ownership or changing two-factor settings, require confirming identity again.
Customer gives each Authorized User a role and permissions, which the Service checks on its server rather than trusting the browser. Bulk exports require an export permission and are recorded in the account's activity log.

Separation between customers

Customers share one database. Every record carries the identifier of the customer it belongs to, and the application checks that identifier on the server when it reads or writes Customer Data; the separation is enforced by the application, not by separate databases. Automated tests check that one customer's account cannot read or change another's records.
Where Customer's account lets Authorized Users view more than one of Customer and its Affiliates, that access is granted by Profinetic at Customer's written request, or by Customer where the Service lets it, and is recorded.

Encryption

The Service is served over HTTPS, and browsers are told to use only HTTPS for it (HTTP Strict Transport Security).
Credentials for Third-Party Services and two-factor secrets are encrypted in the application with AES-256-GCM, using a key kept in the hosting environment's secret configuration, separately from the database.
The secret part of each web address the Service issues to Customer for sending it information is looked up by its hash, and kept encrypted as above so that it can be shown to Customer again. An address issued before this measure keeps its original stored form until it is next used or Profinetic moves it.
The database provider encrypts stored data at rest and accepts only encrypted (TLS) connections, as that provider represents.

Profinetic's own access

Access to production systems is limited to the personnel who need it to provide and support the Service.
Profinetic's internal administration tools have their own sign-in, with mandatory two-factor authentication and their own signing secret.
Viewing raw error text, which can contain Customer Data, requires those tools' highest role, a password confirmed within the last 15 minutes and a written reason, and each viewing is recorded.
Changes Profinetic staff make to Customer's account through those tools are recorded, in the account's activity log or in Profinetic's own administration log.

Logging and monitoring

An activity log records sign-ins, invitations, changes to access, exports, imports, the retrieval of data from Third-Party Services, and the creation of records and key changes to them, with who acted, where a person acted, and when, for the life of the account.
Automated checks of the health of the Service escalate problems to Profinetic's staff while the schedule that runs them is turned on.
Error monitoring, where enabled, is configured not to collect user identities, IP addresses, cookies, request headers or request bodies, and to remove credentials, secrets and email addresses from what it does collect, along with search terms in web addresses and the values held in database errors. The Service's own server logs are written to leave out much of this detail too. This removal works by matching known patterns and can miss something, so fragments of Customer Data can still appear in error reports and logs.

Browser protections

A content security policy, protection against being framed by other sites, and headers that stop content-type sniffing, limit referrer information, and deny the Service's pages access to the camera, microphone and location.

Keeping less

Files Customer uploads are not kept after they are processed, and only the information Customer chooses to bring in is stored.
The AI Features that work from Customer Data are off until one of Customer's Owners turns them on, and the AI Features receive only the information each request needs.
Location coordinates from connected vehicles and equipment are removed from the Service after 30 days; copies in backups are kept as described below.

Backups and recovery

The database provider keeps a point-in-time restore history of 30 days or less, and automatic backup snapshots for up to 35 days. Profinetic also takes a snapshot of the database before maintenance. These snapshots have no set end date and are kept until Profinetic removes them. Every backup stays in the production database account, and none is kept anywhere else. Backups are not used except to recover the Service or lost data. A restore applies to the whole database; after one, Profinetic deletes again the data it had deleted on request, when a service was disconnected, or when an agreement ended.

Changes, incidents and review

Changes to the Service are made through pull requests that run an automated test suite, and those tests run against temporary databases holding sample data, not Customer Data.
Security Incidents are handled and notified under Section 9.
Subprocessors are engaged under written terms, as Section 8 describes.
Profinetic reviews these measures at least once a year and after any Security Incident.

Annex 3. Subprocessors

Current as of version 2026-11-10. Changes follow Section 8. Third-Party Services that Customer connects, such as Google Analytics, Google Ads, Google Search Console, Meta, QuickBooks Online (Intuit) and CallRail, and any service Customer uses to send information to the Service, are Customer's own providers, not Profinetic's Subprocessors. The inbound email provider listed below is Profinetic's Subprocessor, even when one of Customer's providers is what sends the email.

Vercel: hosts and runs the Service. Processes the Customer Data the Service handles while it is processed, holds short-lived cached results derived from Customer Data, and keeps request logs with IP addresses. United States; requests reach it through Vercel's global network.
Neon: database hosting and backups. Stores all Customer Data. United States.
Upstash: rate limiting. Keyed hashes of email addresses, IP addresses and account identifiers from rate-limited requests, kept for up to a day. United States.
Resend: sends the Service's emails. Authorized Users' names and email addresses, and the content of account emails such as invitations and security notices. United States.
Postmark (AC PM LLC): receives the reports Customer has its providers email to an address the Service issues for Customer, and hands them to the Service. The content of those emails and their attachments, which can include the names and contact details of Customer's own customers. Postmark's published retention for email content is 45 days. United States.
Anthropic, PBC: AI model provider for the AI Features, and for AI tools Profinetic and its staff use to run and support the Service. The information each AI Features request needs, once Customer's Owner has turned those features on, and the information a support or maintenance task needs, which can include personal names. United States, and other countries where the provider's terms allow it to process.
Sentry (Functional Software, Inc.): error monitoring, only while Profinetic has it turned on. Technical details of errors, which can include fragments of Customer Data in error messages. United States.
Profinetic's business email provider: holds the messages Customer sends to Profinetic's support address, and anything attached to them.

Profinetic also uses providers that do not receive Customer Data, such as for hosting its source code and for starting the Service's scheduled background tasks.