Data processing agreement

1. Parties and scope

AcuityRFP is operated by AcuityRFP, Inc., with its registered office at 69 Columbia Road, Wrangle Hill, DE 19720 (“AcuityRFP”, “we”, “us”, “our”).

This DPA applies solely where and to the extent that AcuityRFP processes Customer Personal Data on behalf of Customer as a data processor (or service provider) in the course of providing the Service pursuant to the Agreement, and to the extent such data is subject to Data Protection Laws. This DPA does not apply to personal data for which AcuityRFP acts as an independent data controller (such as account registration details, billing records, and direct support or marketing contacts), which is governed by our Privacy Policy.

2. Definitions

Capitalized terms not defined in this DPA have the meanings given in the Agreement.

• Customer Personal Data: any personal data (or “personal information” as defined under applicable Data Protection Laws) contained within Customer Content, or collected from visitors to Customer’s Trust Center, that AcuityRFP processes on behalf of Customer in providing the Service.
• Data Protection Laws: all privacy and data protection laws and regulations applicable to the processing of Customer Personal Data under the Agreement, including, where applicable: (a) Regulation (EU) 2016/679 (the “EU GDPR”); (b) the EU GDPR as incorporated into United Kingdom law by the Data Protection Act 2018 (the “UK GDPR”); (c) the Swiss Federal Act on Data Protection (“FADP”); and (d) U.S. federal and state privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq., the “CCPA”).
• Personal Data Breach: a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by AcuityRFP or its Subprocessors.
• Standard Contractual Clauses (or “SCCs”): the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021, as supplemented where applicable by the UK International Data Transfer Addendum issued by the UK Information Commissioner’s Office (the “UK Addendum”) and the requirements of the Swiss Federal Data Protection and Information Commissioner.
• The terms “controller”, “processor”, “data subject”, “processing”, “special categories of personal data”, and “supervisory authority” have the meanings given in the EU GDPR (and include equivalent concepts such as “business”, “service provider”, and “consumer” under the CCPA).

3. Roles, instructions, and CCPA terms

• Roles of the Parties. As between the parties, Customer is the controller (or a processor acting on behalf of a third-party controller) of Customer Personal Data, and AcuityRFP is the processor (or subprocessor) acting on Customer’s behalf.
• Documented Instructions. AcuityRFP will process Customer Personal Data solely on and in accordance with Customer’s documented instructions, unless required to do otherwise by applicable law (in which case AcuityRFP will inform Customer of that legal requirement before processing, unless the law prohibits such notice on important grounds of public interest). The Agreement (including this DPA) and Customer’s and its Users’ configuration and use of the Service constitute Customer’s complete and final instructions to AcuityRFP. AcuityRFP will promptly inform Customer if, in its opinion, an instruction infringes Data Protection Laws, without being obligated to provide legal advice.
• Customer Obligations. Customer is solely responsible for the accuracy, quality, and legality of Customer Personal Data, for establishing a valid lawful basis for its processing and transfer to AcuityRFP, and for providing all required privacy notices and obtaining any necessary consents from data subjects (including Users and Trust Center visitors).
• U.S. State Privacy Laws (CCPA). To the extent Customer Personal Data is subject to the CCPA, AcuityRFP acts as a “service provider” to Customer. AcuityRFP certifies that it will not: (a) “sell” or “share” (for cross-context behavioral advertising) Customer Personal Data; (b) retain, use, or disclose Customer Personal Data for any purpose other than the specific business purpose of performing the Service specified in the Agreement, or as otherwise permitted by the CCPA; (c) retain, use, or disclose Customer Personal Data outside of the direct business relationship between AcuityRFP and Customer; or (d) combine Customer Personal Data with personal information received from, or on behalf of, any other source, except to the extent expressly permitted of service providers under the CCPA. AcuityRFP will notify Customer if it determines it can no longer meet its obligations under the CCPA, and Customer has the right, upon notice, to take reasonable and appropriate steps to stop and remediate unauthorized use of Customer Personal Data.
• No AI Model Training. AcuityRFP will never process or permit the processing of Customer Personal Data to train, fine-tune, or improve any artificial intelligence or machine learning models.

4. Confidentiality of personnel

AcuityRFP ensures that all employees, contractors, and personnel authorized by AcuityRFP to process Customer Personal Data have committed themselves to written confidentiality obligations (or are under an appropriate statutory obligation of confidentiality). Authorized personnel access Customer Personal Data strictly on a least-privilege, need-to-know basis as necessary to maintain, secure, troubleshoot, or support the Service, or as required by applicable law, with administrative access logged and audited.

5. Security of processing

Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, AcuityRFP implements and maintains the technical and organizational security measures set forth in Annex 2 of this DPA and in the Security Addendum to protect Customer Personal Data against a Personal Data Breach. AcuityRFP may update or modify these measures from time to time provided that such updates do not materially decrease the overall security of the Service during a subscription term.

6. Subprocessors

• General Written Authorization. Customer grants AcuityRFP general written authorization to engage Subprocessors to process Customer Personal Data within the functional categories listed in Annex 3. AcuityRFP will provide the specific, current list of named Subprocessors (including their locations and processing activities) upon written request to privacy@example.com.
• Notice of New Subprocessors and Right to Object. Customers may subscribe to receive email notifications of new Subprocessors by contacting privacy@example.com. AcuityRFP will provide subscribed Customers with at least 30 days’ advance written notice before authorizing any new Subprocessor to process Customer Personal Data (except where an emergency replacement is required for urgent security or continuity reasons, in which case notice will be given as soon as practicable). Customer may object in writing to the appointment of a new Subprocessor strictly on reasonable, documented data protection grounds within 15 days of receiving the notice. In the event of a timely and reasonable objection, the parties will discuss Customer’s concerns in good faith, and AcuityRFP may choose to: (a) not use the proposed Subprocessor for Customer’s data; (b) take corrective steps requested by Customer; or (c) if neither (a) nor (b) is commercially or technically feasible, permit Customer to terminate the affected portion of the Service upon written notice within 30 days and receive a pro-rata refund of any prepaid, unused subscription fees for the remainder of the current billing period.
• Subprocessor Obligations and Liability. AcuityRFP enters into a written agreement with each Subprocessor imposing data protection and security obligations substantially equivalent to (and no less protective than) those set out in this DPA, and AcuityRFP remains liable to Customer for the performance of each Subprocessor’s data protection obligations to the same extent AcuityRFP would be liable if performing the services itself under the Agreement.

7. Data subject rights and assistance

• Data Subject Requests. The Service provides Customer with self-service controls to access, rectify, export, and delete Customer Content directly. If AcuityRFP receives a request directly from a data subject seeking to exercise rights under Data Protection Laws (such as access, rectification, erasure, restriction, or portability) in relation to Customer Personal Data, AcuityRFP will promptly forward the request to Customer and will not respond directly to the data subject except to instruct them to contact Customer, unless legally compelled to respond directly.
• Cooperation with Assessments and Regulators. Taking into account the nature of the processing and the information available to AcuityRFP, AcuityRFP will provide reasonable assistance to Customer (at Customer’s reasonable expense if requiring material custom work beyond standard product documentation) in fulfilling Customer’s obligations to respond to data subject requests and to conduct data protection impact assessments (DPIAs) and prior consultations with supervisory authorities under Data Protection Laws.

8. Personal Data Breaches

AcuityRFP will notify Customer without undue delay—and in any event within seventy-two (72) hours—after AcuityRFP confirms a Personal Data Breach affecting Customer Personal Data. Such notification will be sent to the owner email address(es) on Customer’s account and will describe, to the extent known at the time: (a) the nature of the Personal Data Breach, including where possible the categories and approximate number of data subjects and personal data records concerned; (b) the likely consequences of the breach; and (c) the measures taken or proposed to be taken by AcuityRFP to contain, remediate, and mitigate the breach. Where all details cannot be provided simultaneously, AcuityRFP will provide updates in phases without undue further delay. Notification of or response to a Personal Data Breach under this section will not be construed as an acknowledgment by AcuityRFP of any fault or liability.

9. International data transfers

• Storage Region. Customer Content is stored at rest in the primary cloud region designated for Customer’s workspace (with alternative regional hosting, such as in the European Union, available upon agreement).
• Transfer Mechanisms. Where the processing of Customer Personal Data involves a restricted transfer of personal data from the European Economic Area (“EEA”), the United Kingdom, or Switzerland to a country not recognized as providing an adequate level of data protection by the applicable supervisory authority, such transfer is governed by:
  1. An applicable adequacy decision (including the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework, where the recipient is certified); or
  2. In the absence of an adequacy decision, the Standard Contractual Clauses (SCCs), which are hereby incorporated into and form an integral part of this DPA by reference as follows:
     • Module Two (Controller-to-Processor) applies where Customer is a controller, and Module Three (Processor-to-Processor) applies where Customer is a processor;
     • In Clause 7, the optional docking clause does not apply;
     • In Clause 9(a), Option 2 (General written authorization) applies with a 30-day advance notice period;
     • In Clause 11, the optional independent dispute resolution language does not apply;
     • In Clause 17, Option 1 applies, and the SCCs are governed by the laws of Ireland;
     • In Clause 18(b), disputes shall be resolved before the courts of Ireland;
     • Annex I, Annex II, and Annex III of the SCCs are populated with the information set out in Annex 1, Annex 2, and Annex 3 of this DPA, respectively;
     • For transfers subject to the UK GDPR, the UK Addendum is incorporated by reference, with Tables 1–3 completed by Annexes 1–3 of this DPA and Table 4 allowing either party to end the UK Addendum as set out in Section 19 thereof;
     • For transfers subject to the Swiss FADP, references to the GDPR, EU, and Member State law/supervisory authorities in the SCCs are interpreted to include the Swiss FADP, Switzerland, and the Swiss Federal Data Protection and Information Commissioner (FDPIC).

10. Deletion and return of data

Customer may export Customer Content at any time during the term of the Agreement using the Service’s export functionality. Upon termination of the Agreement or deletion of Customer’s organization in the Service, Customer Personal Data is locked immediately and permanently deleted from active production systems after a 7-day grace period, and from database backups as those backups automatically expire on our infrastructure provider’s lifecycle schedule. Error reports held by our error monitoring provider expire automatically within 90 days. Alternatively, upon Customer’s written request to privacy@example.com, AcuityRFP will complete the deletion of Customer Personal Data within 30 days and provide written confirmation of deletion, except to the extent applicable law requires retention of specific records (in which case AcuityRFP will isolate and continue to protect such records in accordance with this DPA until deletion is legally permitted).

11. Audits and compliance verification

• Documentation and Third-Party Reports. AcuityRFP will make available to Customer, upon written request and subject to the confidentiality obligations of the Agreement, information reasonably necessary to demonstrate compliance with this DPA, including our security architecture documentation, completed security questionnaires, and (once issued) our independent third-party SOC 2 audit report.
• Customer Audits. If the documentation provided above is insufficient to satisfy a mandatory audit requirement under Data Protection Laws or a direct request from a competent supervisory authority, Customer (or an independent, accredited third-party auditor appointed by Customer who is not a competitor of AcuityRFP and is bound by written confidentiality obligations) may conduct an audit of AcuityRFP’s relevant data processing controls no more than once in any 12-month period (unless triggered by a confirmed Personal Data Breach affecting Customer’s data). Any such audit must be: (a) preceded by at least 30 days’ prior written notice specifying the scope; (b) conducted during normal business hours at Customer’s sole expense; and (c) scoped so as not to disrupt AcuityRFP’s operations or compromise the security, confidentiality, or tenant isolation of any other customer’s data.

12. Liability and term

Each party’s and all of its affiliates’ liability taken together in the aggregate arising out of or related to this DPA (and the SCCs, where applicable) is subject to the exclusions and limitations of liability set forth in Section 18 of the Terms of Service, except to the extent Data Protection Laws or the SCCs expressly prohibit such limitation with respect to claims by data subjects. This DPA remains in effect for as long as AcuityRFP processes Customer Personal Data on behalf of Customer.

Annex 1: Details of processing (Annex I to the SCCs)

A. List of Parties

• Data Exporter: Customer (as identified in Customer’s account or Order Form). Role: Controller (or Processor on behalf of its own controller).
• Data Importer: AcuityRFP, Inc., 69 Columbia Road, Wrangle Hill, DE 19720. Contact: privacy@example.com. Role: Processor (or Subprocessor).

B. Description of Transfer and Processing

• Categories of Data Subjects: Customer’s authorized Users; employees, contractors, or business contacts referenced within Customer Content (e.g., in policies, historical RFPs, or questionnaires); and external visitors who access Customer’s Trust Center.
• Categories of Personal Data Processed: User account details (names, business email addresses, assigned roles, authentication identifiers, sign-in and session records, audit logs); incidental personal data uploaded by Customer within documents, questionnaires, answers, and comments; and Trust Center visitor records (name, business email address, company name, NDA acceptance timestamps, access request notes, and download logs); and technical data in error reports (an organization identifier, page address, and browser and device type, plus any personal data that remains in an error message after automated removal).
• Special Categories of Personal Data (Sensitive Data): None intended. The Service is not designed for the processing of special categories of personal data (as defined in Article 9 of the GDPR), HIPAA Protected Health Information, or payment card industry (PCI) data, and Customer agrees not to upload such data unless strictly necessary and lawful under the Acceptable Use Policy.
• Frequency of the Transfer: Continuous and on-demand throughout Customer’s use of the Service.
• Nature and Purpose of Processing: Automated hosting, indexing, semantic search, AI-assisted drafting, machine translation, collaboration, audit logging, Trust Center publication, and export of Customer Content strictly to provide, secure, and support the Service in accordance with the Agreement.
• Duration of Processing and Retention: For the duration of the Agreement until deletion in accordance with Section 10 of this DPA.

C. Competent Supervisory Authority

• For the EU GDPR: The Irish Data Protection Commission (or, where Customer is established in an EU Member State, the supervisory authority of that Member State).
• For the UK GDPR: The UK Information Commissioner’s Office (ICO).
• For the Swiss FADP: The Swiss Federal Data Protection and Information Commissioner (FDPIC).

Annex 2: Technical and organizational security measures (Annex II to the SCCs)

AcuityRFP implements and maintains the following technical and organizational security measures:

• Database-Enforced Tenant Isolation: Every database table containing customer records includes an organization identifier enforced via PostgreSQL Row-Level Security (RLS) policies at the database layer. Automated cross-tenant isolation testing is integrated into our database migration workflow.
• Encryption in Transit and at Rest: All network traffic is encrypted in transit using TLS 1.2+. All database records and stored files are encrypted at rest using AES-256 encryption. Third-party OAuth/integration tokens are additionally encrypted at the application layer (AES-256-GCM) with a cryptographic key stored outside the database.
• Access Control and Authentication: Role-Based Access Control (RBAC) enforcing four distinct User roles (owner, admin, editor, viewer) at the database level; optional SAML 2.0 Single Sign-On enforcement; verified email before use, optional two-factor sign-in that owners can require, and breached-password checks for User accounts; and mandatory Multi-Factor Authentication (MFA), named individual accounts, and least-privilege access controls for AcuityRFP production systems.
• Storage and Secret Isolation: Customer files are stored in private cloud storage buckets accessible solely via short-lived, cryptographically signed URLs. Privileged database service keys and application secrets are stored exclusively in server-side environment variables and never exposed to client browsers or source code repositories.
• Audit Logging and Data Minimization in Logs: Comprehensive audit logging of answer approvals, exports, file downloads, deletions, User role changes, integration connections, and Trust Center NDA acceptances. Production application logs exclude full document contents and raw AI prompts. Error reports are automatically stripped of request data, email addresses, tokens and quoted text before they reach our error monitoring provider, though an error message may still contain a short fragment of text.
• Secure Software Development Lifecycle (SDLC): Strict boundary input validation, SSRF network filtering on external URL imports, automated static analysis and type checking prior to deployment, review and approval of code changes before release, and version-controlled database migrations.
• AI Data Safeguards: Technical configuration checks verifying that AI Subprocessor endpoints operate under no-training terms or settings before customer data is sent to them; prompt isolation boundaries designed to separate document data from system instructions.
• Incident Response Management: A documented incident response plan defining severity classifications, escalation paths, containment procedures, post-incident reviews, and customer notification within 72 hours of confirming a Personal Data Breach.

Annex 3: Authorized Subprocessor categories (Annex III to the SCCs)

Customer authorizes AcuityRFP to engage Subprocessors in the following functional categories:

The processing location of each named Subprocessor is provided with the list of named Subprocessors upon request to privacy@example.com.

Note on Customer-Connected Integrations: Third-party platforms that Customer affirmatively chooses to connect to the Service (such as Slack, Microsoft Teams, Google Drive, Microsoft SharePoint, OneDrive, or a SAML Identity Provider) are independent third-party services governed by Customer’s own agreements with those providers and are not Subprocessors of AcuityRFP. The current list of named Subprocessors is available at any time upon request to privacy@example.com.