Data Processing Addendum

Last Modified Date: June 19, 2026

This Data Processing Addendum ("DPA") is attached to and incorporated into the Proof General Terms ("General Terms"). Capitalized terms not otherwise defined have the meanings given in the General Terms, the Proof Glossary, or the Order Form. This DPA replaces both the Data Processing Supplement and the Data Privacy Supplement. Any reference to the Data Processing Supplement or the Data Privacy Supplement in the Order Form or elsewhere in the Agreement shall be read to refer to this DPA.

1. Applicability

This DPA applies to all Users and Proof.

2. Definitions

Depending on the Services, the roles under this DPA may change. This DPA will use the terms Provider and Business, as defined below, to denote the obligations under this DPA.

• ​Authorized Persons: Persons or categories of persons that Business authorizes to give Provider material personal information processing instructions.
• ​Business: The corporate entity that determines the material personal information processing instructions.
• ​Business Purpose: Provision of Services or access to the Platform.
• ​Data Subject: An individual who is the subject of Personal Information.
• ​De-Identified Data: Information that has been de-identified, aggregated, and/or anonymized so that no individual, entity, or particular record can be identified, such that it is no longer Personal Information as defined by Privacy and Data Protection Requirements.
• ​Personal Information: Any information Provider processes for Business that (a) identifies or relates to an individual who can be identified directly or indirectly from that data alone or in combination with other information in Provider’s possession or control or that Provider is likely to have access to, or (b) the relevant Privacy and Data Protection Requirements otherwise defined as protected personal information.
• ​Privacy and Data Protection Requirements: All applicable federal, state, municipal, and foreign laws and regulations relating to the processing, protection, or privacy of Personal Information, including guidance and codes of practice issued by regulatory bodies in any relevant jurisdiction.
• ​Processing, processes, or process: Operation or set of operations performed on Personal Information, whether or not by automated means. Examples include collecting, receiving, recording, storing, organizing, amending, retrieving, using, disclosing, erasing, or destroying it. Processing also includes transferring Personal Information to third parties.
• ​Provider: The corporate entity that processes personal information on behalf of the Business.

3. Business Obligations and Personal Information Types

• ​Business retains control of the Personal Information and remains responsible for its compliance obligations under the Privacy and Data Protection Requirements, including providing any required notices and obtaining any required consents, and for the processing instructions it gives to Provider.
• ​Upon request, Provider will provide the general Personal Information categories and Data Subject types that Provider may process to fulfill the Business Purpose.

4. Provider Obligations

• ​Provider will Process Personal Information only to the extent, and in such a manner, as is necessary for the Business Purpose in accordance with Business’s written instructions from Authorized Persons. Provider will not Process Personal Information for any other purpose or in a way that does not comply with this DPA or the Privacy and Data Protection Requirements. Provider must promptly notify Business if, in its opinion, Business’s instruction would not comply with the Privacy and Data Protection Requirements.
• ​Provider must promptly respond to any reasonable Business request or instruction requiring Provider to stop, mitigate, or remedy any unauthorized processing.
• ​Provider will maintain the confidentiality of all Personal Information, will not sell it to anyone, and will not disclose it to third parties unless the disclosure is necessary to accomplish the Business Purpose, Business instructs Provider to make the disclosure, this DPA specifically authorizes the disclosure, or if the disclosure is required by law.
• ​Provider will reasonably assist Business with meeting Business’s compliance obligations under the Privacy and Data Protection Requirements, taking into account the nature of Provider’s processing and the information available to Provider.
• ​Provider must promptly notify Business of any changes to Privacy and Data Protection Requirements that may adversely affect Provider’s performance of the Agreement.
• ​Business acknowledges that Provider is under no duty to investigate the completeness, accuracy, or sufficiency of any specific Business instructions from Authorized Persons or the Personal Information other than as required under the Privacy and Data Protection Requirements.

5. Provider Employees

• ​Provider will limit Personal Information access to those of its employees who require Personal Information access to meet Provider’s obligations under this DPA and the Agreement.
• ​Provider will ensure that all employees:
  • ​Are informed of Personal Information’s confidential nature and use restrictions;
  • ​Have undertaken training on the Privacy and Data Protection Requirements relating to handling Personal Information and how it applies to their particular duties; and
  • ​Are aware of Provider’s duties and their personal duties and obligations under the Privacy and Data Protection Requirements and this DPA.

6. Cross-Border Transfers

Upon request, Provider will provide a list of the countries where Provider may receive, access, transfer, or store Personal Information.

7. Subcontractors

• ​Provider may authorize a subcontractor to process Personal Information only if:
  • ​Provider provides notice and Business is given an opportunity to object after Provider supplies Business with full details regarding the subcontractor;
  • ​Provider enters into a written contract with the subcontractor that contains terms substantially the same as those in this DPA and, upon Business’s written request, provides Business with a copy of the contract; and
  • ​Provider maintains control over all Personal Information it entrusts to the subcontractor.
• ​Provider must provide a list of all approved subcontractors and include any subcontractor’s name, location, and contact information for the subcontractor personnel responsible for privacy and data protection compliance.
• ​If a subcontractor fails to fulfill its obligations under a written agreement with Provider, Provider remains fully liable to Business for the subcontractor’s performance of its obligations under this DPA.
• ​Provider is deemed to control any Personal Information controlled by or in the possession of its subcontractors.

8. Data Subject Requests

• ​Provider may notify Business if it receives a request from a Data Subject for access to or deletion of their Personal Information. On receiving notice from Provider, Business must process the request in accordance with Privacy and Data Protection Requirements.
• ​If Provider or Business receives a request from a Data Subject for deletion of their Personal Information, Provider, Business, or the Notary (if relevant) may be required to retain Personal Information pursuant to legal obligations, including but not limited to, notarial legal requirements to retain Electronic Notarial Records.
• ​Provider will reasonably cooperate with Business in responding to any complaint, notice, or Data Subject request.

9. Aggregate and De-identified Data

Notwithstanding anything in this DPA to the contrary, Provider retains the right to Process De-Identified Data for its own purposes, provided the processing is consistent with applicable law.

10. Term and Termination

• ​This DPA will remain in full force and effect so long as the Agreement remains in effect, and thereafter so long as Provider possesses or controls Personal Information related to the Agreement.
• ​Any provision of this DPA that expressly or by implication should come into or continue in force on or after termination of the Agreement in order to protect Personal Information will remain in full force and effect.
• ​If a change in Privacy and Data Protection Requirements prevents either party from fulfilling any of its obligations under the Agreement, the parties will suspend active Processing of Personal Information until that processing complies with the new requirements. If the parties are unable to bring Personal Information Processing into compliance, either party may terminate the Agreement on written notice to the other party.

11. Data Return and Destruction

• ​At Business’s request, Provider will give Business a copy of, or access to, all or part of the Business Personal Information in its possession or control.
• ​On termination of the Agreement for any reason and receipt of a written request, Provider will securely destroy or return all or any Personal Information related to the Agreement in its possession or control, excluding Personal Information Provider is permitted to retain under the Agreement or required to retain to comply with legal obligations or industry standards.

12. Records

Provider will keep detailed, accurate, and up-to-date records regarding any Processing of Personal Information it carries out for Business, including but not limited to, the access, control, and security of the Personal Information, approved subcontractors and affiliates, the processing purposes, and any other records required by the Privacy and Data Protection Requirements ("Records"). Provider will ensure that Records are sufficient to enable Business to verify Provider’s compliance with its obligations under this DPA.

13. Audit

At Business’s reasonable request, Provider will provide information relevant to Provider’s handling of Personal Information and Provider’s compliance with this DPA.

14. Warranties

• ​Provider represents and warrants that:
  • ​Its employees, subcontractors, agents, and any other person or persons accessing Personal Information on its behalf have received the required training on the Privacy and Data Protection Requirements relating to the Personal Information; and
  • ​It and anyone operating on its behalf will process Personal Information in compliance with the terms of this DPA, the Privacy and Data Protection Requirements, and other applicable laws, enactments, regulations, orders, standards, and other similar instruments; and
  • ​It understands this DPA’s restrictions and prohibitions on selling Personal Information and retaining, using, or disclosing Personal Information outside of the parties’ direct business relationship, and it will comply with them.
• ​Business represents and warrants that Provider’s use of the Personal Information for the Business Purpose and as specifically instructed by Business will comply with all Privacy and Data Protection Requirements.

15. Indemnification

Provider agrees to indemnify and defend, at its own expense, Business against all costs, claims, damages, or expenses incurred by Business or for which Business may become liable due to any failure by Provider or its employees, subcontractors, or agents to comply with its obligations under this DPA or the Privacy and Data Protection Requirements. Any limitation of liability in the Agreement applies to the foregoing indemnity and reimbursement obligations.

---

Incident Priority Levels and Resolution

Priority Level Conditions

• ​Level 1 (Critical Business Impact): The Incident seriously affects the functionality of the Services (or component thereof) and cannot be circumvented such that most of the significant functionality of the Services (or component thereof) is available.
• ​Level 2 (Significant Business Impact): The Incident partially affects the functionality of the Services (or component thereof), but can be circumvented so that most of the significant functionality of the Services (or component thereof) is available.
• ​Level 3 (Minimal Business Impact): The Incident can be circumvented such that the Services (or component thereof) can be used with only slight inconvenience. The problem can be considered insignificant and has no significant effect on the usability of the Services (or component thereof).

Conditions for Closure of Help-Desk Ticket

• ​Level 1: The Incident is considered resolved and closed when an Incident Resolution has been fully implemented.
• ​Level 2: The Incident is considered resolved and closed when an Incident Resolution has been fully implemented.
• ​Level 3: The Incident is considered resolved and closed when one of the following occurs: (i) an Incident Resolution has been fully implemented, or (ii) 10 business days have elapsed since Proof’s communication of the information that Proof reasonably believes will resolve the Incident (communicated by email to Subscriber’s designated contact for such Incident), and Subscriber has not responded to Proof. The Incident can be reopened later if it has not been resolved.

On-Demand Notary Availability Downtime Credits

• ​Up to 240 minutes: No On-Demand Notary Downtime Credit
• ​241-360 minutes: 1%
• ​361-480 minutes: 3%
• ​481-600 minutes: 5%
• ​601 minutes or greater: 7%

Platform Availability Percentage and Downtime Credits

• ​99.9% or higher: No Platform Downtime Credit
• ​97% - 99.9%: 1%
• ​95% - 97%: 3%
• ​93% - 95%: 5%
• ​Below 93%: 7%

Incident Priority Response Times

---

Personal Information Categories (California)

Personal Identifiers

• ​Sources: Directly from you; indirectly from you as you navigate or use our Services; notaries; data analytics providers; social networks; advertising networks; internet or mobile service providers; counterparties in a transaction; credential analysis companies; identity verification services. For job applicants: directly from you; background check providers; recruiters; recruiting software providers.
• ​Purpose: Provide you with our Services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market to you. For job applicants: assess your application; satisfy legal obligations.
• ​Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; notaries; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties in a transaction; single sign-on providers; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; background screening companies; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

California Customer Records Personal Information

• ​Sources: Directly from you; counterparties in a transaction; credential analysis companies; identity verification services. For job applicants: directly from you; background check providers; recruiters; recruiting software providers.
• ​Purpose: Provide you with our Services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market to you. For job applicants: process your application; satisfy legal obligations.
• ​Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties in a transaction; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; background screening companies; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

Characteristics of Protected Classifications

• ​Sources: Directly from you; indirectly from you as you navigate or use our Services; notaries; data analytics providers; social networks; advertising networks; internet or mobile service providers; counterparties in a transaction; credential analysis companies; identity verification services. For job applicants: directly from you; background check providers; recruiters; recruiting software providers.
• ​Purpose: Provide you with our Services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market to you; meet our legal obligations.
• ​Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; notaries; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties in a transaction; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; background screening companies; mortgage process digitization providers; electronic signature and digital transaction management providers.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

Commercial Information

• ​Sources: Directly from you; indirectly from you as you navigate or use our Services; notaries; data analytics providers; social networks; advertising networks; internet or mobile service providers; counterparties in a transaction.
• ​Purpose: Provide you with our Services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market to you; meet our legal obligations; maintain transaction records.
• ​Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; notaries; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; counterparties in a transaction; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

Biometric Information

• ​Sources: Directly from you; indirectly from you as you navigate or use our Services; internet or mobile service providers; credential analysis companies; identity verification services.
• ​Purpose: Provide you with our Services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; meet our legal obligations; maintain transaction records.
• ​Recipients: Affiliates; technology service providers.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

Internet and Other Electronic Network Activity Information

• ​Sources: Indirectly from you as you navigate or use our Services; data analytics providers; social networks; advertising networks; internet or mobile service providers.
• ​Purpose: Provide you with our Services; detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; verify, maintain, improve, upgrade, or enhance a service or device that is owned or controlled by us; identify and repair errors; advertise or marketing to you; perform analytics.
• ​Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; payment processors; mobile application platforms; tag management platforms; video sharing platforms; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; single sign-on providers; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; mortgage process digitization providers; electronic signature and digital transaction management providers; financial services companies; web mapping platforms.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

Geolocation Data

• ​Sources: Indirectly from you; devices you use to access our Services; data analytics providers; social networks; advertising networks; internet or mobile service providers.
• ​Purpose: Provide you with our Services; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market to you.
• ​Recipients: Advertising networks; social networks; technology service providers; customer relationship management providers; mobile application platforms; tag management platforms; video sharing platforms; customer support platforms; data analytics providers; marketing platforms; mobile linking platforms; collaboration software providers; customer engagement and communication platforms; identity verification and anti-fraud solution providers; web mapping platforms.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

Sensory Data

• ​Sources: Directly from you; indirectly from you as you navigate or use our Services; internet or mobile service providers; credential analysis companies; identity verification services.
• ​Purpose: Provide you with our Services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; meet our legal obligations; maintain transaction records.
• ​Recipients: Affiliates; technology service providers; counterparties in a transaction.
• ​Retention: The length of your business relationship with us plus any legally required additional retention period for this category of Personal Information following conclusion of your business relationship with us or as long as business needs require, whichever is longer.

Professional or Employment-Related Information

• ​Sources: Directly from you; notaries; data analytics providers; social networks; advertising networks; counterparties in a transaction; credential analysis companies; identity verification services. For job applicants: directly from you; background check providers; recruiters; recruiting software providers.
• ​Purpose: Provide you with our Services; communicate with you; protect and secure our environment; verify, maintain, improve, upgrade, or enhance a product or service; identify and repair errors; advertise or market to you. For job applicants: process your application.
• ​Recipients: Affiliates; advertising networks; social networks; technology service providers; customer relationship management providers; ...

(Note: The content may be truncated. For the full list of categories and details, refer to the original document.)