Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Terms of Servicebetween you (“Customer”) and Outmove LLC (“Outmove”) and applies whenever Outmove processes Client Personal Data on your behalf. Terms not defined here have the meaning given in the Terms. “Data Protection Law” means every privacy and data protection law applicable to the processing, including the EU and UK GDPR, the California Consumer Privacy Act as amended, and comparable state and national law.

1. Roles

Client Personal Data means personal data relating to your clients, prospects, and their personnel that you or they submit to the Service: the details entered into your forms, agreements, funnels, and deals.

For Client Personal Data you are the controller (under the CCPA, the business) and Outmove is the processor (the service provider). You determine the purposes and means of the processing. We process it only to provide the Service, and only on your documented instructions.

For your own account data, the information about you and your team that we need in order to run and bill the Service, Outmove is the controller and the Privacy Policy describes that processing. This DPA does not apply to it.

Outmove does not sell or share Client Personal Data, does not retain, use, or disclose it for any purpose other than providing the Service, and does not combine it with personal data received from anyone else except as Data Protection Law permits. We do not train machine learning models on Client Personal Data.

2. Your instructions, and what they must be

Your use of the Service, including every workflow, form, agreement, follow-up, and integration you configure, constitutes your documented instructions for the processing. Further instructions must be agreed in writing, and we may charge for any that require work outside the Service.

You warrant that: you have a lawful basis for every processing operation you instruct; you have given your clients the notices, and obtained any consents, that Data Protection Law requires; your instructions will not cause us to breach any law; the data you submit is accurate and lawfully obtained; and you have the authority to contact every person you enter into the Service. We are under no obligation to verify any of this and are entitled to rely on it.

We will tell you if, in our opinion, an instruction infringes Data Protection Law, and may suspend that instruction until the question is resolved. Nothing in this paragraph makes us responsible for assessing the lawfulness of your processing, which is yours to determine.

3. Prohibited data

Section 5 of the Terms lists categories of data that may not be submitted to the Service, including protected health information and other specially regulated data. That prohibition forms part of this DPA. We have not designed the Service for those categories, make no representation that it is adequate for them, and will not enter into a Business Associate Agreement or any equivalent instrument. If you submit prohibited data you do so in breach of the Terms and of this DPA, and you bear the consequences of having done so.

4. Confidentiality and security

We keep Client Personal Data confidential and ensure that personnel authorised to process it are bound by confidentiality obligations. We maintain technical and organisational measures appropriate to the risk, currently including: encryption in transit and at rest; envelope encryption of stored third-party credentials, with a master key held in a managed key service and never in the database; row-level isolation of every tenant’s data; least-privilege access to production; audit logging of every credential use; and documented backup and restore procedures. These are described further on our security page and may be improved over time, provided the level of protection is not reduced.

5. Sub-processors

You give general authorisation for Outmove to engage sub-processors. We impose data protection obligations on each of them no less protective than those in this DPA, and we remain responsible to you for their performance. Our current sub-processors are:

Infrastructure Outmove runs on. Your tenants never see or connect these; they are how the Service exists.

• Supabase — database, authentication, and file storage (United States)
• Vercel — application hosting and compute (United States)
• Amazon Web Services — managed key service that wraps our encryption keys (United States)
• Resend — delivery of transactional and follow-up email (United States)
• Stripe — our own subscription billing, and creation of checkouts on your connected account (United States)
• Upstash — rate limiting and abuse protection (United States)
• Anthropic — AI-assisted features you choose to use, such as importing an agreement or drafting a workflow; content you submit to them is processed to return a result and is not used to train models (United States)

We will give at least 30 days’ notice before adding or replacing a sub-processor, by updating this page and emailing the account owner. If you object on reasonable data protection grounds within that period, tell us and we will work in good faith to offer an alternative; if we cannot, you may terminate the affected part of the Service and receive a pro-rata refund of fees paid for the unused term. That is your sole remedy for an objection.

Providers you connect are not our sub-processors. These are the ones you choose and contract with yourself, such as GoHighLevel; Discord, Slack; Dropbox; Airtable, Attio, ClickUp, HubSpot, Monday, Notion, Pipedrive, Trello. When you connect your own account at a third-party provider, such as a CRM, payment provider, chat platform, or file store, and configure the Service to send data to it, you are instructing a transfer to a separate controller or to a processor of your own. Those providers act under your relationship with them, not ours. We do not control them, do not endorse them, and do not depend on any of them: the Service runs without any of them connected. What they do with the data, where they store it, and whether they meet obligations you owe your clients are matters between you and them.

6. International transfers

Outmove and its sub-processors process data in the United States. Where you transfer Client Personal Data subject to the EU or UK GDPR, the European Commission’s Standard Contractual Clauses (module two, controller to processor) are incorporated into this DPA by reference, with you as data exporter and Outmove as data importer, together with the UK International Data Transfer Addendum where the UK GDPR applies. In those Clauses the optional docking clause applies; the supervisory authority is that of your main establishment; and Annexes I, II, and III are populated by sections 1, 4, 5, and 7 of this DPA.

7. The processing, described

• Subject matter and duration. Provision of the Service, for the term of the Terms and the retention period in section 9.
• Nature and purpose. Collecting form submissions; generating, delivering, and storing agreements and signature records; initiating payment requests through your own payment provider; provisioning accounts and channels in providers you connect; sending transactional and follow-up email on your behalf; and tracking deals.
• Types of personal data. Name, email address, telephone number, business and billing details, the contents of your forms and agreements, signature images, and signing audit records including IP address, user agent, and timestamps.
• Categories of data subjects. Your clients and prospects, and their personnel and signatories.
• Special categories. None. Submitting them is prohibited by section 3.

8. Data subject requests, and assistance

The Service gives you the means to access, correct, export, and delete Client Personal Data yourself, and responding to your clients’ requests is your responsibility. If one of your clients contacts us directly we will not respond on your behalf: we will refer them to you and, where we can identify you, tell you that they did.

Taking into account the nature of the processing, we will give reasonable assistance with data protection impact assessments, prior consultations, and any request you cannot fulfil through the Service, at your expense where the work is more than trivial.

Personal data breach. We will notify you without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting Client Personal Data, with the information then available, and will update you as more is established. Notifying your clients or any regulator is your responsibility as controller. Our notice is not an acknowledgement of fault or liability.

9. Retention, deletion, and return

You may export or delete Client Personal Data at any time through the Service. On termination you may export it for 30 days, after which we delete it in accordance with section 14 of the Terms, save for records we are required by law to keep and for backups, which are overwritten on their ordinary cycle and remain protected by this DPA until they are.

10. Audit

On written request, no more than once in any twelve months and subject to reasonable confidentiality terms, we will provide the information reasonably necessary to demonstrate compliance with this DPA, including any current third-party audit report or certification we hold. Those materials are how we satisfy audit and inspection rights. An on-site inspection will be considered only where Data Protection Law requires one and a report would not suffice: at your cost, on 30 days’ notice, during business hours, and without access to other customers’ data or to our production systems.

11. Liability and precedence

Each party’s liability under this DPA is subject to the limitations and exclusions in the Terms, and that limit is a single aggregate limit across the Terms and this DPA rather than a separate one for each. Nothing in this DPA limits liability that cannot be limited by law.

In the event of a conflict, this DPA prevails over the Terms and the Privacy Policy as to the processing of Client Personal Data, and the Standard Contractual Clauses prevail over this DPA as to transfers governed by them. In every other respect the Terms continue in full force.

12. Contact

Questions about this DPA, or a request for a countersigned copy, go to help@outmove.app. By using the Service you accept this DPA; no signature is needed for it to apply.