Data Processing Addendum

Last updated: June 10, 2026

This Data Processing Addendum (“DPA”) supplements the Terms of Service between Square Working LLC (d/b/a Proprietio, “we”, “us”) and the customer identified in the applicable order or account (“Customer”), and governs our processing of Personal Data on Customer's behalf. If this DPA conflicts with the Terms of Service on a data-protection topic, this DPA controls.

1. Roles

Customer is the controller (or “business” under the CCPA) of the Personal Data it submits to the Service — data about its residents, rental applicants, property owners, vendors, and staff. We act as Customer's processor (or “service provider”): we process that data only to provide, secure, and support the Service, and only on Customer's documented instructions, including the instructions embodied in the Service's features and settings.

2. What we process

Categories: identification and contact details (names, emails, phone numbers, unit addresses), lease and billing records, payment history (tokenized — card and bank numbers go directly to Stripe and never touch our systems), maintenance requests, messages sent through the Service, and documents Customer uploads. Duration: for the term of the agreement plus the retention window in Section 7.

3. Our commitments

• We process Personal Data only on Customer's instructions — never for our own purposes.
• We do not sell or share Personal Data within the meaning of the CCPA/CPRA, and we do not retain, use, or disclose it outside our direct business relationship with Customer.
• We do not combine Customer's Personal Data with data received from other customers, except in de-identified, aggregated form that cannot be re-associated with any person.
• All personnel with access are bound by confidentiality obligations.
• We will notify Customer promptly if we conclude we can no longer meet these obligations, and Customer may then suspend the affected processing.

4. Security

We maintain technical and organizational measures appropriate to the risk, including: TLS for data in transit; encryption at rest on our database infrastructure; passwords hashed with bcrypt; payment tokenization via Stripe (PCI-DSS); role-based access controls and organization-level data isolation; two-factor authentication; account-lockout and session-revocation controls; audit logging of sensitive admin actions; and pre-deploy database snapshots. A SOC 2 Type II attestation is in progress; the report will be made available to enterprise customers under NDA upon completion.

5. Subprocessors

Customer authorizes the subprocessors listed at proprietio.com/subprocessors. We impose data-protection obligations on each subprocessor no less protective than this DPA, and we remain responsible for their performance. We will update that page at least 30 days before adding a new subprocessor; Customer may object on reasonable data-protection grounds, in which case we will work in good faith on an alternative, failing which Customer may terminate the affected feature.

6. Incident notification

We will notify Customer without undue delay — and in any case within 72 hours — after becoming aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to Customer's Personal Data, with the information reasonably available to us about the nature, scope, and remediation of the incident. Notice goes to the account owner's email unless Customer designates a security contact.

7. Deletion & return

Customer can export its data at any time through the Service. Upon termination, we retain Customer's data for 90 days (so an accidental cancellation is recoverable), then permanently delete it, except where law requires longer retention. On written request we will delete sooner or confirm deletion in writing.

8. Assistance & audits

We will reasonably assist Customer in responding to verified requests from data subjects (access, deletion, correction) that reach us directly, and in Customer's own compliance assessments. We will respond to reasonable written security questionnaires from enterprise customers no more than once per year, and will make available our then-current security documentation (and SOC 2 report once issued, under NDA).

9. International transfers & law

The Service is hosted in the United States. For Customers subject to the GDPR/UK GDPR who submit European personal data, the parties agree that the EU Standard Contractual Clauses (Module 2, controller-to-processor) are incorporated by reference, with this DPA supplying the appendices. This DPA otherwise follows the governing-law clause of the Terms of Service.

10. Signed copies

This DPA applies automatically to every customer as part of the Terms of Service — no signature needed. Enterprise customers who require a counter-signed copy can request one at legal@proprietio.com.