01Scope and roles
This Data Processing Addendum ("DPA") forms part of the agreement between Procurable, Inc. ("Procurable") and the customer for the Service.
- The customer is the controller and Procurable is the processor for personal data in Customer Data.
- Procurable is the controller for its own account, billing, website and marketing data. That data is covered by the Privacy Policy, not this DPA.
02Processing on instructions
Procurable processes Customer Personal Data only on the customer's documented instructions, including the instructions set out in the agreement and in the customer's use of the Service.
03Confidentiality
Procurable ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations.
04Security
Procurable implements the technical and organizational measures described in Annex II.
05Subprocessors
The customer gives general authorization for Procurable to use subprocessors. The current list is in Annex III and on the Subprocessors page. Procurable gives at least 14 days' notice before a new subprocessor goes live, except for an emergency replacement for security reasons. The customer may object; if the objection cannot be resolved, the customer may terminate the affected Service.
06International transfers
For transfers of personal data from the EEA, the parties agree to the EU Standard Contractual Clauses, Module 2 (controller to processor), adopted 4 June 2021. For transfers from the UK, the parties agree to the UK International Data Transfer Addendum.
07Assistance with requests
Procurable assists the customer in responding to requests from data subjects exercising their rights.
08Personal data breach
Procurable notifies the customer of a personal data breach affecting Customer Personal Data without undue delay and no later than 72 hours after becoming aware of it. Status updates follow Procurable's incident response process until the incident is resolved.
09Deletion
When the Service ends, Procurable deletes Customer Data within 30 days and deletes it from backups within 90 days.
10Audits
Procurable makes available the information reasonably needed to show compliance with this DPA and allows for audits as described in the agreement.
11Annex I: Processing details
| Item | Detail |
|---|---|
| Parties | Customer (controller, data exporter). Procurable, Inc., 10501 Wilshire Blvd, Unit 2011, Los Angeles, CA 90024, United States (processor, data importer). Contact: privacy@procurable.ai. |
| Subject matter | Providing the Service: cost intelligence (should-cost benchmarks) and an RFQ platform |
| Nature and purpose | Hosting, storing and analyzing Customer Data; parsing supplier quotes received by email; AI drafting of RFQ, negotiation and analysis text |
| Data subjects | Customer users and the customer's supplier contacts |
| Categories of data | Names, business email addresses, phone numbers, job titles, account profiles, and any personal data the customer includes in drawings, part files or quote text |
| Special categories | None |
| Duration | The term of the agreement, then deletion as described in section 09 |
12Annex II: Security measures
- TLS encryption in transit
- Encryption at rest (AES-256 recommended, AES-128 minimum)
- Unique user accounts
- Multi-factor authentication on production and admin access
- Least-privilege access with periodic access reviews
- Logging
- Data protection terms in vendor contracts
- A documented incident response process
Procurable will make a SOC 2 or similar report available when it has one.
13Annex III: Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Bubble Group, Inc. | Application hosting, database and file storage | United States |
| Amazon Web Services, Inc. | Cloud infrastructure, object storage including drawing ingest, serverless compute, transactional email relay | United States (us-east-1) |
| Anthropic, PBC, via AWS Bedrock | AI drafting of RFQ, negotiation and analysis text | United States |
Google and LinkedIn process Procurable's website data. They do not process Customer Personal Data in the Service.