This Data Processing Addendum ("DPA") forms part of the agreement between BW-J2 Inc., a Delaware corporation, d/b/a BuildProof ("BuildProof") and the customer identified in the applicable agreement or order ("Customer") governing Customer's use of BuildProof's platform services (the "Agreement"). This DPA applies to the extent BuildProof processes Personal Data on Customer's behalf.
1. Definitions
"Personal Data," "Processing," "Controller," "Processor," "Data Subject," and "Personal Data Breach" have the meanings given in Applicable Data Protection Law. "Applicable Data Protection Law" means all privacy and data protection laws applicable to the Processing under the Agreement, including the California Consumer Privacy Act as amended by the CPRA ("CCPA") and, if applicable, the EU/UK GDPR. "Customer Data" means Personal Data that Customer or its users submit to the services or that BuildProof processes on Customer's behalf under the Agreement.
2. Roles and Scope
For Customer Data, Customer is the Controller (or "Business" under CCPA) and BuildProof is the Processor (or "Service Provider"). Details of Processing (subject matter, duration, nature, purposes, data categories, and Data Subjects) are set out in Annex A. Where BuildProof processes personal data for its own purposes as described in its Privacy Policy — for example, data of consumers who use BuildProof's own consumer applications, or BuildProof's own client, billing, and account records — BuildProof acts as an independent Controller, and this DPA does not apply to that processing.
3. Processing Instructions
BuildProof will Process Customer Data only on Customer's documented instructions, including as set out in the Agreement and this DPA, unless required by law (in which case BuildProof will notify Customer unless legally prohibited). As a CCPA Service Provider, BuildProof will not: sell or share Customer Data; retain, use, or disclose it outside the direct business relationship or for any purpose other than performing the services (or as permitted by CCPA); or combine it with other data except as permitted for the business purposes. BuildProof will notify Customer if it determines it can no longer meet its obligations under Applicable Data Protection Law, and Customer may take reasonable steps to stop and remediate unauthorized use.
4. Confidentiality
BuildProof ensures that personnel authorized to Process Customer Data are bound by confidentiality obligations and access Customer Data only as needed to perform the services.
5. Subprocessors
Customer provides general authorization for BuildProof to engage the subprocessors listed on our Subprocessors page (also reproduced in Annex C). BuildProof will: (a) impose data protection obligations on subprocessors no less protective than this DPA; (b) remain responsible for subprocessors' performance; and (c) provide at least 90 days' notice of new subprocessors (via email to Customer's designated contact), during which Customer may object on reasonable data-protection grounds; if the parties cannot resolve the objection, Customer may terminate the affected services and receive a pro-rated refund of prepaid fees.
6. Security
BuildProof implements and maintains appropriate technical and organizational measures designed to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, as described in Annex B, and reviews them regularly. BuildProof may update the measures provided the overall security of the services is not materially diminished.
7. Personal Data Breach
BuildProof will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Data, and will provide information reasonably available to help Customer meet its legal obligations, cooperate in the investigation, and take reasonable steps to mitigate and remediate. BuildProof's notification is not an admission of fault.
8. Assistance
Taking into account the nature of the Processing, BuildProof will provide reasonable assistance to Customer, at Customer's expense where the assistance is material, with: (a) responding to Data Subject requests (access, correction, deletion, portability, objection, opt-out) received by Customer — and will forward to Customer, without responding except to direct the individual to Customer, any such request BuildProof receives directly relating to Customer Data; and (b) Customer's data protection impact assessments and regulator consultations, where required.
9. Deletion and Return
Upon termination or expiration of the Agreement, BuildProof will, at Customer's election made within 30 days, delete or return Customer Data (and delete existing copies), except where retention is required by law — including construction, licensing, tax, lien, and warranty record-keeping obligations — in which case BuildProof will protect the retained data under this DPA and delete it when the legal basis expires. Reasonable export tooling is available during the Agreement term.
10. Audits
No more than once per 12-month period (and additionally following a Personal Data Breach), Customer may audit BuildProof's compliance with this DPA by: first, reviewing BuildProof's then-current security documentation and third-party attestations; and second, if reasonably insufficient, a remote or on-site audit on at least 30 days' notice, during business hours, under confidentiality, at Customer's expense, no more intrusive than necessary, and without access to other customers' data.
11. International Transfers
Customer Data is hosted and processed in the United States. If Applicable Data Protection Law requires a transfer mechanism for data originating outside the U.S., the parties incorporate the EU Standard Contractual Clauses (Module 2: Controller→Processor) and the UK Addendum by reference, with Annexes A–C serving as the required appendices.
12. Liability and Order of Precedence
Each party's liability under this DPA is subject to the limitations and exclusions of liability in the Agreement. In case of conflict: this DPA controls over the Agreement for data-protection matters; the SCCs (if applicable) control over this DPA.
Annex A — Details of Processing
- Subject matter & nature: Provision of the BuildProof platform: construction project management, client portal, lead and prospect management, document and e-signature workflows, compliance tracking, scheduling, budgeting, and communications.
- Duration: The term of the Agreement plus the deletion/retention period in Section 9.
- Purposes: Performing the services described in the Agreement.
- Categories of Data Subjects: Customer's clients and prospects; Customer's personnel and authorized users; Customer's subcontractors, vendors, and their personnel.
- Categories of Personal Data: Contact and identification data; account credentials; project, property, and contract data; design preferences and documents; communications; scheduling and task data; financial and billing data related to projects (e.g., budgets, invoices, payment applications); compliance documentation (e.g., licenses, insurance certificates, W-9s); e-signature records and audit trails; usage logs.
- Sensitive data: Not intended to be submitted, except government identifiers appearing in tax/compliance documents (e.g., W-9s) and financial documentation where Customer chooses to collect it through the services.
Annex B — Technical and Organizational Measures
Encryption of data in transit (TLS) and at rest; logical tenant isolation and row-level security in the database layer; role-based access control and least-privilege permissioning; secret-authenticated, idempotent service-to-service integrations with full audit logging; webhook and event logging for traceability; automated compliance tracking of subcontractor documentation (COI, license, W-9 expirations); administrative access restricted to authorized personnel; personnel confidentiality obligations; vendor due diligence for subprocessors; backup and recovery via managed database infrastructure; vulnerability management and dependency updates; breach response procedures aligned to Section 7.
Annex C — Authorized Subprocessors
See the current list on our Subprocessors page. That page is the authoritative version and reflects the notification requirements in Section 5.
BUILDPROOF LLC d/b/a BuildProof · a New Hampshire limited liability company · legal@buildproof.com