Data Processing Agreement

This Data Processing Agreement (the “DPA”) governs how ExitPros LLC handles personal data that an advisory firm puts into DealAtrium. It forms part of the Terms of Service and applies to the relationship between us and an advisory firm.

It does not apply to buyers or sellers in their own right. A buyer or seller using the platform is not a party to this DPA and is not agreeing to it. How we handle their personal data is described in our Privacy Policy.

Where this DPA and the Terms of Service conflict on the handling of personal data, this DPA controls.

Most agreements of this kind describe one relationship. This one describes two, because the platform genuinely has two.

We are a processor for your firm’s data. Deal records, seller records, the documents your firm uploads, your firm’s private assessments and notes about buyers, correspondence sent by your advisors, and your advisors’ own accounts. Your firm decides why and how that data is processed. We process it on your instructions, as set out in this DPA.

We are a controller for buyer accounts. A buyer account is not your firm’s record. The same buyer may deal with several firms on this platform under one account, and that account survives the end of your firm’s relationship with us. We decide how buyer identity and buyer profile data are handled, and we answer to the buyer for it. We are also the controller for our own direct communications with buyers, such as the unsubscribe page that lets a buyer stop email about a deal.

Why this matters to you: your instructions govern the first category, and Section 9’s deletion obligation applies to it. It does not extend to the second, because that data is not yours to direct us to delete.

The subject matter, duration, nature and purpose of the processing, the types of personal data, and the categories of data subject are described in Annex A.

We process your firm’s personal data only on your documented instructions. Your use of the platform’s features is itself an instruction. We will tell you if we believe an instruction requires us to break the law, and we may pause that processing until it is resolved.

We do not sell personal data, and we do not use it to train artificial intelligence models. We do not send document contents, deal information, or personal data to any third-party artificial intelligence or machine learning provider.

You confirm that you have a lawful basis for giving us personal data about buyers and sellers, that you have told those people how their data will be used, and that you have the right to upload and share the materials you upload. You are responsible for who you grant access to, and for revoking access when it should be revoked.

Advisors who connect their own mailbox are responsible for the content of the email they send through it, and for complying with applicable email and marketing law.

Access to your data is limited to people who need it to operate or support the platform, and everyone with such access is bound by confidentiality obligations. We do not access the contents of your deal documents except where necessary to provide or support the service, to keep it secure, or where you ask us to.

We maintain technical and organisational measures appropriate to the risk, described in Annex C. We may change them as the platform develops, but we will not materially reduce the overall level of protection during your subscription.

You authorise us to use the subprocessors listed in Annex B. Each is bound by written terms that impose data protection obligations comparable to those in this DPA, and we remain responsible to you for their performance.

We will give you at least 30 days’ notice before adding or replacing a subprocessor that processes your firm’s personal data. If you have a reasonable objection on data protection grounds, tell us within that period and we will work with you in good faith to find an alternative; if we cannot, you may terminate the affected part of the service without penalty.

If we become aware of a personal data breach affecting your firm’s personal data, we will notify you without undue delay, and in any event within 72 hours of becoming aware. The notification will describe what happened, the categories and approximate volume of data involved so far as known, the likely consequences, and the steps we are taking.

We will provide reasonable assistance with any notification you are required to make to a regulator or to affected individuals. An initial notification will not be delayed merely because the investigation is incomplete.

If a buyer, seller, or other individual contacts us directly with a request concerning personal data your firm controls, we will not respond substantively on your behalf. We will tell them to contact your firm, and we will tell you about the request.

Taking account of the nature of the processing, we will give you reasonable assistance in responding to such requests, including access to the data through the platform and the export described below.

Export. You may request an export of your firm’s data at any time, and on termination. We will provide it within 30 days, in two parts: a machine-readable file of your records, and an archive of documents received through the platform, including executed non-disclosure agreements and buyer submissions.

Deletion. We delete your firm’s data from active systems within 30 days of termination. This includes deal records, seller records, uploaded deal materials, correspondence, your firm’s private notes about buyers, and executed non-disclosure agreements held for your firm.

Export before you terminate. Because executed non-disclosure agreements are deleted with the rest of your firm’s data, request your export before or at termination if you want to keep them. We do not retain a copy for you afterwards. The buyer receives their own copy by email from the signature provider at the time of signing, and firms that enable the NDA webhook receive a copy into their own systems automatically as each agreement completes.

What deletion does not cover. Buyer accounts are not your firm’s data and are not deleted when your firm leaves — see Section 2. Deal marketing materials your firm uploaded originated with you and you hold the originals; we delete our copies, and you should keep yours.

Backups. Deleting a record from our active database does not immediately remove it from our hosting provider’s daily database backups, which are retained for 7 days and are not separately editable. After that window no copy remains. Documents and files are stored separately from the database and are not included in those backups, so a deleted document is removed immediately with no backup copy.

On written request, no more than once in any 12-month period, we will provide the information reasonably necessary to demonstrate our compliance with this DPA, including a current description of our security measures and subprocessors.

We are a small organisation and do not host on-site inspections as a matter of course. Where an audit is required by law or by a regulator, we will cooperate, at your cost and on reasonable notice, in a manner that does not compromise the confidentiality of other firms’ data.

The platform and its data are hosted in the United States. Our subprocessors are listed in Annex B with their processing locations.

This DPA is written for processing governed by United States law, including the Colorado Privacy Act. Annex D is reserved for terms applicable to personal data protected by the EU or UK General Data Protection Regulation. If your firm has data subjects in those jurisdictions, contact us before putting their personal data into the platform so that Annex D can be completed and agreed.

This DPA takes effect when your firm begins using the platform and continues until the firm’s data has been deleted in accordance with Section 9. It is governed by the laws of the State of Colorado, consistent with the Terms of Service.

Subject matter and duration. Provision of the DealAtrium deal platform for the duration of the firm’s subscription, plus the deletion period in Section 9.

Nature and purpose. Hosting, storage, retrieval, transmission and deletion of deal and contact records; controlled distribution of confidential deal documents to authorised recipients; sending correspondence at an advisor’s direction; recording buyer engagement with deal materials; facilitating non-disclosure agreement signature.

Categories of data subject:

• Advisors and firm personnel — the firm’s own users of the platform
• Buyers — prospective acquirers who inquire on a deal or are recorded by an advisor (processed by us as controller for their account and identity; see Section 2)
• Sellers — business owners whose companies are marketed, and their nominated contacts

Types of personal data: name, business email address, telephone number, job title, employer or company name, business location, and, for buyers, acquisition criteria and a record of their engagement with deal materials and correspondence. Free-text notes written by advisors may contain further personal data of the advisor’s choosing. IP addresses and email addresses are recorded from the public inquiry form for abuse prevention.

Special category data: none is requested, and the platform has no field for it. Advisors should not enter it in free-text fields.

• Supabase — database and file storage (United States)
• Vercel — application hosting (United States)
• Clerk — authentication and login
• Resend — transactional email such as invitations and notifications
• Cloudflare — domain routing, bot protection on public forms, and email routing
• GoHighLevel — non-disclosure agreement delivery and electronic signature. Receives buyer name, email address, telephone number and the deal reference in order to issue and track the agreement
• Google — where an advisor connects a Google mailbox, to send that advisor’s own correspondence. Send-only; we never read mailbox contents
• Microsoft — the equivalent for a Microsoft mailbox, on the same send-only basis
• Sentry — error monitoring (United States). Receives diagnostic detail about software faults: error messages, stack traces, the route on which a fault occurred, and excerpts of our own application source code surrounding the faulting line. Request bodies, cookies, document contents, Storage paths and signed access links are stripped in our own application before transmission, not after receipt. Retention is no more than 90 days

• Authorisation checked on every request. Access to deal materials is re-checked against the permissions recorded for that specific person and deal on every request. There is no cached permission state anywhere in the platform.
• No public document links. Documents are never served by public or signed URL. They are streamed by the server only after the authorisation check passes, so a storage path never reaches a browser.
• Database access is default-deny. Row Level Security is enabled on every table with no permissive policies, so the public and authenticated database roles are denied outright. The application uses a single privileged server-side credential, and all authorisation is enforced in one centralised data-access layer rather than being spread across the application.
• Tenant isolation. Every query is scoped to the firm making it. Seller data and any field that joins to it are excluded from responses served to buyers.
• Encryption. Data is encrypted in transit. Mailbox refresh tokens are encrypted at rest with AES-256-GCM under a key held separately from the database.
• Authentication. Sign-in is by emailed magic link through a specialist provider; we never store passwords. Administrative surfaces are gated by role.
• Abuse protection. The public inquiry form is protected by a bot check and by per-address and per-network rate limiting.
• Least-privilege mailbox access. Where an advisor connects a mailbox, the permission requested is send-only. We cannot read, import, or store mailbox contents.

No system is perfectly secure, and we do not claim otherwise.

Reserved, and intentionally not in force. This DPA is written for processing governed by United States law. No terms under the EU or UK General Data Protection Regulation — including standard contractual clauses, a transfer impact assessment, or the appointment of a representative — form part of this agreement at present.

If your firm intends to put personal data of individuals in the European Economic Area or the United Kingdom into the platform, contact privacy@dealatrium.com before doing so, and this annex will be completed and agreed with you.

ExitPros LLC, a Colorado limited liability company
3123 W Union Ave, Englewood, CO 80110
privacy@dealatrium.com