Suppled

Data Processing Addendum

Effective October 2026

1. Purpose and scope

This Data Processing Addendum (“DPA”) supplements the Suppled Terms of Service and applies to the processing of personal data by Suppled on behalf of the customer (“Customer”) in the course of providing the Suppled software platform.

This DPA satisfies the requirements of Article 28 of Regulation (EU) 2016/679 (the EU GDPR), the UK Data Protection Act 2018 / UK GDPR, and applicable United States state privacy laws (including the California Consumer Privacy Act, “CCPA”, as amended by the CPRA).

2. Roles and classification

The parties agree that with respect to the Customer Data processed within Suppled (such as personal data belonging to the Customer’s clients, leads, and contacts that are stored in quotes, jobs, or customer lists):

  • Customer is the Data Controller (or “Business” under US state privacy laws).
  • Suppled is the Data Processor (or “Service Provider” under US state privacy laws) acting on the Customer’s instructions.

3. Details of processing

  • Subject matter: The provision of the Suppled tool platform, quoter, CRM, and workflow engine as described in the Terms of Service.
  • Duration: The term of the Customer’s subscription plus the period until all Customer Data is deleted in accordance with Section 9.
  • Nature and purpose: Storing, calculating, organizing, tailoring, and issuing records, quotes, and communications as directed by Customer users.
  • Categories of data subjects: The Customer’s customers, prospective clients, suppliers, contractors, and authorized team members.
  • Types of personal data: Contact details (names, email addresses, phone numbers, postal and job site delivery addresses), billing/invoicing details, job specifications, and communications.

4. Processor obligations

Suppled undertakes to:

  • Process on instructions only: Process Customer Personal Data only on documented instructions from the Customer, including regarding transfers of personal data to a third country or international organization, unless required to do so by applicable UK, EU, or Member State law.
  • Confidentiality: Ensure that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
  • Security of processing: Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including encryption in transit (TLS 1.3), encryption at rest, tenant data isolation, and regular security assessments.
  • Sub-processors: Maintain a published list of authorized sub-processors and notify the Customer of any intended changes.
  • Data subject rights assistance: Taking into account the nature of processing, assist the Customer by providing built-in self-service features (such as data export and instant erasure tools) to fulfill the Customer’s obligation to respond to data subjects exercising their privacy rights.
  • Breach notification: Notify the Customer without undue delay (and in any case within 48 hours) upon becoming aware of a confirmed personal data breach affecting Customer Personal Data.

5. Authorized sub-processors

The Customer grants general written authorization to Suppled to engage the following sub-processors to support the delivery of Suppled:

  • Anthropic, PBC (United States) — AI tailoring model execution (protected under Standard Contractual Clauses).
  • Stripe, Inc. (United States / Ireland) — Payment processing and invoicing.
  • Neon Inc. (Frankfurt, Germany / AWS EU) — PostgreSQL database hosting and managed backups.
  • Cloudflare, Inc. (United States / Global) — Encrypted file storage (R2) and content delivery.
  • Resend, Inc. (United States) — Transactional email delivery for quote dispatches and sign-in codes (protected under Standard Contractual Clauses).

Where Suppled engages a new sub-processor, we will update our published documentation. The Customer may object to a new sub-processor on reasonable data protection grounds by giving written notice within 14 days.

6. International data transfers

Where personal data is transferred outside the European Economic Area (“EEA”) or the United Kingdom to a country not recognized as providing an adequate level of protection:

  • EEA transfers: The European Commission’s Standard Contractual Clauses (“SCCs”) (Commission Implementing Decision (EU) 2021/914, Module 2: Controller-to-Processor) are hereby incorporated by reference and form part of this DPA.
  • UK transfers: The UK International Data Transfer Addendum to the EU Commission Standard Contractual Clauses is hereby incorporated by reference.

7. United States privacy law terms (CCPA / CPRA)

To the extent the processing of Customer Personal Data is subject to the California Consumer Privacy Act (“CCPA”) or other applicable US state privacy laws, Suppled certifies that it acts as a Service Provider and:

  • Shall not “sell” or “share” Customer Personal Data (as those terms are defined under the CCPA).
  • Shall not retain, use, or disclose Customer Personal Data for any purpose other than for the business purposes specified in the Terms of Service.
  • Shall not retain, use, or disclose Customer Personal Data outside of the direct business relationship between the parties.
  • Shall not combine Customer Personal Data with personal information received from or on behalf of any other person, except as permitted by applicable law.

8. Audits and compliance

Suppled shall make available to the Customer all information reasonably necessary to demonstrate compliance with data protection laws and allow for and contribute to audits or inspections conducted by the Customer or an independent auditor mandated by the Customer, subject to reasonable advance notice, confidentiality undertakings, and frequency limitations.

9. Deletion and return of personal data

The Customer can export all Customer Personal Data at any time in open, structured formats (.csv, .json) via the Export feature in Settings.

Upon termination of the service or upon the Customer’s request via Settings → Your data → Delete your account, Suppled will immediately and irreversibly delete all Customer Personal Data from its database and file storage systems, unless applicable law requires continued storage of statutory accounting records.

10. Governing law and contact

This DPA shall be governed by the laws of England and Wales, matching the jurisdiction of the Terms of Service.

For inquiries regarding data processing terms, please contact privacy@suppled.app.