Data Processing Addendum

DATA PROCESSING ADDENDUM

RFPeasy®

A product of Gov Access Solutions, LLC

Effective Date: May 20, 2026

Last Updated: May 18, 2026

This Data Processing Addendum (this "DPA") supplements the Terms of Service (the "Agreement") between Gov Access Solutions, LLC, a Colorado limited liability company doing business as RFPeasy ("RFPeasy," "we," "us," "Processor"), and the entity identified as the Customer in the Agreement ("Customer," "you," "Controller"), governing the processing of Customer Personal Data by RFPeasy in connection with the Service.

This DPA is intended to facilitate Customer's compliance with applicable data-protection laws when RFPeasy processes Customer Personal Data on Customer's behalf. This DPA applies in addition to (and does not replace) the Terms and Privacy Policy.

1. Scope and Applicability

This DPA applies to (a) Customer subscriptions on the Team or Custom plan, and (b) any other engagement in which Customer and RFPeasy expressly incorporate this DPA. For users of the Starter, Pro, Premium, or Beta plans, RFPeasy's processing of personal data is governed by the Privacy Policy and Terms; this DPA does not apply to those plans unless expressly agreed in writing.

Where there is a conflict between this DPA and the Agreement, this DPA controls solely with respect to the processing of Customer Personal Data. Where this DPA conflicts with applicable law, applicable law controls.

2. Definitions

Capitalized terms not defined below have the meanings given in the Agreement.

"Applicable Data Protection Laws" means all federal, state, and local laws and regulations relating to data protection, privacy, or the processing of personal data that apply to Customer's use of the Service or RFPeasy's processing of Customer Personal Data, including the California Consumer Privacy Act, the California Privacy Rights Act, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, and any successor or analogous laws.

"Controller" means the entity that determines the purposes and means of processing Personal Data. For purposes of this DPA, Customer is the Controller.

"Customer Personal Data" means Personal Data submitted by or on behalf of Customer to the Service, or otherwise processed by RFPeasy on Customer's behalf under the Agreement.

"Data Subject" means an identified or identifiable natural person to whom Personal Data relates.

"Personal Data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular natural person or household, as further defined under Applicable Data Protection Laws.

"Personal Data Breach" means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise processed by RFPeasy.

"Processing" means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, alignment, combination, restriction, erasure, or destruction.

"Processor" means the entity that processes Personal Data on behalf of the Controller. For purposes of this DPA, RFPeasy is the Processor.

"Sub-processor" means a third party engaged by RFPeasy to process Customer Personal Data on RFPeasy's behalf in connection with the Service.

3. Roles and Processing Description

3.1 Roles of the Parties

The parties acknowledge and agree that, with regard to the processing of Customer Personal Data under the Agreement, Customer is the Controller, RFPeasy is the Processor, and RFPeasy will engage Sub-processors pursuant to Section 6.

3.2 Description of Processing

Annex 1 to this DPA describes the subject matter, duration, nature, purpose, types of Personal Data, and categories of Data Subjects in respect of the processing of Customer Personal Data under the Agreement.

3.3 Customer Compliance

Customer represents and warrants that (a) it has a lawful basis to provide Customer Personal Data to RFPeasy and to authorize the processing described in this DPA; (b) it has provided all necessary notices to, and where required obtained all necessary consents from, Data Subjects; (c) it will not instruct RFPeasy to process Customer Personal Data in violation of Applicable Data Protection Laws; and (d) it has the authority to enter into this DPA on behalf of itself and any affiliate Controllers whose Customer Personal Data is processed under this DPA.

3.4 Processor Instructions

RFPeasy will process Customer Personal Data only on documented instructions from Customer (which include the Agreement, this DPA, Customer's configuration of the Service, Customer's use of Service features, and any further written instructions agreed in writing). RFPeasy will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.

4. RFPeasy Obligations

4.1 Confidentiality

RFPeasy ensures that personnel authorized to process Customer Personal Data have committed to confidentiality (or are under appropriate statutory obligations of confidentiality), and that access is limited to those personnel with a need to know.

4.2 Security

RFPeasy implements appropriate technical and organizational measures designed to protect Customer Personal Data against a Personal Data Breach. The technical and organizational measures are described in Annex 2. RFPeasy may update the measures from time to time, provided that the level of security shall not materially decrease.

4.3 Personal Data Breach Notification

RFPeasy will notify Customer without undue delay, and in any event within seventy-two (72) hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notification will include (to the extent then known): (a) the nature of the Personal Data Breach; (b) the categories and approximate number of Data Subjects affected; (c) the categories and approximate volume of Customer Personal Data affected; (d) the likely consequences; and (e) the measures taken or proposed to address the Personal Data Breach. RFPeasy will provide reasonable cooperation in Customer's investigation and notification efforts.

4.4 Data Subject Requests

Taking into account the nature of the processing, RFPeasy will assist Customer, by appropriate technical and organizational measures and insofar as possible, in fulfilling Customer's obligation to respond to requests from Data Subjects to exercise their rights under Applicable Data Protection Laws. Where RFPeasy receives a Data Subject request directed at Customer Personal Data, RFPeasy will (a) not respond directly except to confirm that Customer is the relevant Controller, and (b) promptly notify Customer.

4.5 Cooperation with Customer Compliance

RFPeasy will, taking into account the nature of processing and the information available to RFPeasy, provide Customer with reasonable cooperation and information necessary for Customer to (a) conduct data-protection impact assessments where required by Applicable Data Protection Laws; (b) consult with supervisory authorities where required; and (c) respond to lawful regulatory inquiries.

5. Customer Obligations and Acknowledgments

5.1 Prohibited Categories

Customer acknowledges and agrees that, consistent with the Agreement, the Service is not authorized to process classified information, Controlled Unclassified Information ("CUI"), ITAR-controlled or EAR-controlled technical data requiring a license, Privacy Act records requiring System of Records Notice coverage, Protected Health Information ("PHI") subject to HIPAA, or other regulated information as described in the Terms. Customer represents and warrants that it will not submit such information to the Service.

5.2 Lawful Basis

Customer is solely responsible for the legality of Customer Personal Data and the lawful basis for its processing.

5.3 Authorized Users

Customer is responsible for the actions of its Authorized Users with respect to Customer Personal Data, including ensuring that Authorized Users do not provide Personal Data of third parties without appropriate notice or consent.

6. Sub-processors

6.1 General Authorization

Customer provides general written authorization for RFPeasy to engage Sub-processors to process Customer Personal Data, subject to the conditions in this Section 6.

6.2 Current Sub-processors

The current list of Sub-processors as of the Effective Date is set forth in Annex 3 and is also published at https://www.rfpeasy.app/subprocessors. The published list controls in the event of any discrepancy.

6.3 New Sub-processors

RFPeasy will use commercially reasonable efforts to provide Customer at least thirty (30) days' prior written notice (which may be by email to the address on file or by updating the published Sub-processor list with a date of effect) before authorizing any new Sub-processor to process Customer Personal Data.

6.4 Customer Objection Right

Customer may object to the engagement of a new Sub-processor on reasonable data-protection grounds by providing written notice to RFPeasy within fifteen (15) days of receipt of notice. The parties will discuss the objection in good faith. If RFPeasy is unable to provide a reasonable alternative within a reasonable period, Customer may, as its sole and exclusive remedy, terminate the Subscription affected by the objection by providing written notice to RFPeasy, with no liability to either party for such termination beyond accrued obligations and a pro-rata refund of any prepaid fees for the unused portion of the Subscription term.

6.5 Sub-processor Obligations

RFPeasy will impose contractual obligations on each Sub-processor that are substantially equivalent to, and no less protective than, the obligations imposed on RFPeasy under this DPA. RFPeasy remains liable to Customer for the performance of each Sub-processor's obligations under this DPA.

7. International Data Transfers

RFPeasy operates from the United States and processes Customer Personal Data in the United States. RFPeasy's Sub-processors are primarily located in the United States. Customer acknowledges that, by using the Service, Customer Personal Data will be transferred to, stored, and processed in the United States. To the extent any Customer Personal Data is transferred from a jurisdiction with cross-border-transfer restrictions (such as the European Union, the United Kingdom, or Switzerland), the parties will execute appropriate transfer mechanisms (such as Standard Contractual Clauses) under a separate written addendum upon Customer's reasonable request.

8. Audits

8.1 Information Rights

Upon Customer's reasonable prior written request and no more than once per calendar year (except where required by Applicable Data Protection Laws or following a Personal Data Breach), RFPeasy will make available to Customer information reasonably necessary to demonstrate compliance with this DPA, including a summary of RFPeasy's technical and organizational measures, any third-party security assessment reports (such as SOC 2 reports or equivalent), and policies governing the processing of Customer Personal Data.

8.2 On-site Audits

If the information made available under Section 8.1 is insufficient to demonstrate compliance with this DPA, Customer may request an on-site audit, subject to (a) reasonable advance written notice of at least sixty (60) days; (b) execution of confidentiality obligations no less protective than those in the Agreement; (c) limitation to working hours and a scope agreed in advance with RFPeasy; (d) Customer bearing all costs of such audit, including reasonable RFPeasy personnel time at standard rates; and (e) no access to other customers' data, RFPeasy's proprietary source code, prompts, or trade secrets. Audits may not be conducted more than once per calendar year except following a confirmed Personal Data Breach affecting Customer.

9. Return and Deletion of Customer Personal Data

Upon termination or expiration of the Agreement, RFPeasy will, at Customer's election, return or delete Customer Personal Data in accordance with the Terms (Section 21.4). Customer may, for a period of thirty (30) days following termination (unless RFPeasy terminated for cause), request export of Customer Personal Data using in-product tools or by request to support. After such period, RFPeasy will delete Customer Personal Data from production systems, subject to retention in encrypted backups for up to ninety (90) days and to retention required by law (such as billing and tax records).

10. Liability

Each party's liability under or in connection with this DPA is subject to the limitations of liability set forth in the Agreement. To the extent permitted by Applicable Data Protection Laws, the cap on liability in the Agreement applies in the aggregate to all claims arising out of or relating to both the Agreement and this DPA combined.

11. Order of Precedence

In the event of a conflict between this DPA and the Agreement, this DPA controls solely with respect to the processing of Customer Personal Data. All other provisions of the Agreement remain unchanged.

12. Effective Date and Term

This DPA takes effect on the Effective Date of the Agreement (or, if executed later, on the date Customer accepts a Subscription to the Team or Custom plan), and continues for so long as RFPeasy processes Customer Personal Data under the Agreement. Sections that by their nature should survive (including Sections 4, 9, 10, and 11) survive termination.

13. Signature

This DPA is automatically incorporated into the Agreement for Customers on the Team or Custom plan upon Subscription acceptance, without requiring separate signature. For Custom-plan customers, a counter-signed copy may be requested by contacting dakota@govaccesssolutions.com.

Annex 1: Description of Processing

A. Subject Matter

Processing of Customer Personal Data submitted by Customer or its Authorized Users to the Service to receive the Service.

B. Duration

The duration of Customer's active Subscription, plus retention periods described in the Privacy Policy and Section 9 of this DPA.

C. Nature and Purpose of Processing

Hosting, storage, retrieval, transmission, AI-based generation of outputs, analytics, security monitoring, and ancillary activities reasonably necessary to provide the Service.

D. Types of Personal Data

  • Account identifiers (name, email, hashed credentials);

  • Professional and employment information (company name, role, federal-contractor identifiers such as CAGE/UEI, NAICS/PSC codes);

  • Communications (messages, feedback);

  • Usage data (clicks, sessions, feature interactions);

  • Technical data (IP address, browser, OS, device identifiers);

  • Billing metadata received from Stripe (last four digits of payment card, billing ZIP);

  • Content of documents and queries submitted to the Service by Customer.

E. Categories of Data Subjects

  • Customer's employees, contractors, and Authorized Users;

  • Customer's collaborators invited to Customer's Organization;

  • Individuals referenced in Customer Content (such as personnel listed in capability statements, past performance, or proposals);

  • Federal contracting officers, agency personnel, or other individuals whose information appears in public federal data sources retrieved through the Service.

Annex 2: Technical and Organizational Measures

RFPeasy implements the following technical and organizational measures designed to protect Customer Personal Data:

  • Encryption in transit: TLS for all client-server connections to the Service.

  • Encryption at rest: data stored in RFPeasy's primary database and object storage is encrypted at rest using industry-standard encryption.

  • Database access controls: Row-Level Security ("RLS") policies enforce isolation between users and organizations at the database layer; the principle of least privilege is applied to all production database access.

  • Authentication and access management: passwords are hashed using industry-standard algorithms; magic-link tokens are cryptographically random; administrative accounts require multi-factor authentication.

  • Network security: production systems are deployed behind a CDN and DDoS protection; web-application firewall rules are configured at the hosting and CDN layer.

  • Personnel security: personnel with production access are bound by confidentiality obligations; access is granted on a need-to-know basis.

  • Subprocessor due diligence: each Sub-processor is selected with reasonable care and is bound by contractual obligations consistent with this DPA.

  • Logging and monitoring: production systems generate audit logs of access and material events; error monitoring is in place via Sentry; usage analytics via PostHog.

  • Backups: encrypted backups are retained on a rolling basis (typically up to ninety (90) days) to support disaster recovery.

  • Incident response: RFPeasy maintains an internal incident-response process aligned with the Personal Data Breach notification obligations in Section 4.3.

  • Secure software development: code changes are version-controlled, peer-reviewed in many cases, and deployed through automated pipelines.

  • Database row-level isolation is supplemented by SECURITY DEFINER helper functions to prevent cross-tenant data leakage.

Annex 3: Sub-processors (as of Effective Date)

  • Anthropic, PBC (United States): generative-AI model provider (Claude API).

  • Supabase, Inc. (United States): managed PostgreSQL, authentication, object storage.

  • Vercel, Inc. (United States): application hosting, CDN, serverless functions.

  • Stripe, Inc. (United States): payment processing.

  • Resend, Inc. (United States): transactional email delivery.

  • Functional Software, Inc. d/b/a Sentry (United States): error monitoring.

  • PostHog Inc. (United States): product analytics.

  • GoDaddy.com, LLC (United States): DNS services.

END OF DATA PROCESSING ADDENDUM