Data Processing Agreement
Version 1.0 — August 19, 2026
This Data Processing Agreement ("DPA") is entered into between ProBelt ("ProBelt," "we," or the "Processor") and the business customer that accepts the ProBelt Terms of Service ("Customer" or the "Controller") and is incorporated into those Terms by reference. It applies wherever ProBelt processes personal data contained in Customer Data on Customer's behalf through the Services.
1. Roles and Scope
Customer is the controller (or processor acting for its own controller customers) of personal data in Customer Data — for example, Customer's clients' names, phone numbers, addresses, and communication records, and Customer's crew members' account and time-tracking data. ProBelt processes that data only as a processor, only on Customer's documented instructions (providing the Services), and only for the purposes stated in the Terms and this DPA. ProBelt will not sell, share, or use Customer personal data for its own purposes, including advertising or model training.
2. Processing Details
| Subject matter | Provision of the ProBelt field-service management application |
|---|---|
| Duration | For the term of Customer's account, plus deletion periods below |
| Nature and purpose | Hosting, storing, transmitting, and processing Customer Data to deliver the Services (jobs, estimates, invoicing, time tracking, calls/SMS, media, AI-assisted parsing) |
| Categories of data subjects | Customer's clients/leads, crew members and staff, and other contacts Customer adds |
| Categories of data | Names, contact details, addresses, job/site details, communications content and metadata, timesheets and geofence events (where enabled), photos/media, and account data |
3. Subprocessors
Customer authorizes ProBelt to use the subprocessors listed in Section 5 of our Privacy Policy (currently: Supabase, OpenAI, TypeSafe, Twilio, Mapbox, Apple, RevenueCat, Hostinger). We maintain that list, require equivalent data-protection terms with each subprocessor, and will give Customer at least 30 days' notice (by app notification or email) before authorizing a new subprocessor, during which Customer may object and terminate without penalty.
4. Security Measures
Taking into account the state of the art, ProBelt implements technical and organizational measures including: TLS encryption in transit and encrypted storage at rest; row-level security enforcing per-tenant isolation; private media buckets with short-lived signed URLs; server-side custody of all third-party API keys; role-scoped access and least privilege; rate limiting and security monitoring; and an automated retention/purge system. We review these measures at least annually and after material incidents.
5. Data Subject Requests and Assistance
Unless a request relates to data ProBelt holds solely as processor, we will direct data-subject requests we receive to Customer. ProBelt will reasonably assist Customer in responding to access, correction, deletion, portability, restriction, and objection requests, and in meeting Customer's own obligations under data-protection law, including via the in-app Export My Data and Delete Account features.
6. Personal Data Breach
ProBelt will notify Customer without undue delay, and in any event within 72 hours, of becoming aware of a personal data breach affecting Customer Data, with known details of the breach, likely consequences, and remediation measures taken or planned.
7. Audits
Upon reasonable request no more than once per year (or following a breach), ProBelt will make available information reasonably necessary to demonstrate compliance with this DPA, including summaries of security controls, and will reasonably cooperate with Customer's assessment.
8. Deletion and Return
Upon account termination or Customer's verified deletion request, ProBelt will delete Customer Data within 30 days, except data we must retain under tax, accounting, or other legal obligations (retained only for that purpose and protected) and aggregated, de-identified metrics that no longer identify Customer or its users.
9. International Transfers
Where Customer data is transferred outside the EEA, Switzerland, or the UK, transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or the EU–US Data Privacy Framework, as applicable. ProBelt has entered into equivalent terms with its subprocessors.
10. California (CCPA/CPRA)
To the extent the CCPA applies, ProBelt is a "service provider" and Customer a "business": ProBelt processes personal information solely for the business purposes of providing the Services, does not sell or share it, does not retain or use it outside the direct business relationship, and certifies it understands and complies with these restrictions. ProBelt will assist Customer with consumer requests as described above.
11. General
This DPA is governed by the same law and venue as the Terms. Its liability allocation follows the Terms. If a provision conflicts with mandatory data-protection law, the mandatory law prevails for that provision. Contact: support@probelt.app. See also: Privacy Policy · Data Map.