This article is about the Proxi admin app at app.proxi.co.
A Data Processing Agreement (you'll also see it called a DPA, a Data Processing Addendum, or a data protection agreement) is a short contract that spells out how a vendor handles personal information on your behalf. If your city attorney, your university's procurement office, your board, or a grant funder has asked whether Proxi "has a DPA," the answer is yes.
Who Usually Needs One
Municipalities, counties, and other public bodies, whose purchasing rules often require it.
Universities, hospitals, and larger nonprofits with a formal vendor review.
Any organization in the UK, the European Union, Canada, or Brazil, where the law expects one.
Anyone whose own privacy policy promises that their vendors sign one.
Most Main Street and event organizers never need it. If nobody has asked, you can skip this.
What Proxi's DPA Covers
Roles. You're the controller of your visitors' data; Proxi is the processor, acting only on your instructions.
What we promise. Not to sell your visitors' data or use it for our own purposes, to keep it confidential, to keep it secure, to tell you without undue delay if there's a breach, and to delete it when your subscription ends.
Who else is involved. Our subprocessor list, advance notice before we add one, and your right to object.
Help with requests. If one of your visitors asks us to delete or export their data, we pass it to you and help you respond.
International transfers. The standard contractual clauses that EU and UK organizations need, built in by reference.
U.S. state privacy laws. The service-provider commitments California and other states require.
How to Get One
Email [email protected] with the subject "DPA request."
Include your organization's legal name, your Proxi workspace name, and the name and email of the person who will sign for you.
We'll send the DPA for signature and countersign it. If your organization has its own form it needs us to sign instead, attach it and we'll review it.
Because the DPA is part of our Terms of Service, it already applies to every customer. The signed copy is for your records and your reviewers.
Good to Know
Want notice when our vendors change? Say so in your request and we'll add you to the notice list.
Security questionnaires can come to the same address. Most reviewers ask for the DPA and a questionnaire together.
Where the data lives: the United States, on a major cloud provider. The DPA states this, which is usually the first thing a reviewer looks for.