Draft: this addendum has not yet been reviewed by a licensed attorney [COUNSEL TO REVIEW]. Text in square brackets is still to be decided. Questions: legal@bids2bank.com.
About this addendum
This Data Processing Addendum ("DPA") forms part of the agreement between Bids2Bank, a Fundamentals Holdings entity ("Bids2Bank") [COUNSEL TO CONFIRM: the contracting entity’s full legal name and form], and the customer that accepted the Terms of Service or signed an order form with Bids2Bank ("Customer"). That agreement is the "Agreement". Capitalized terms not defined here have the meanings given in the Agreement.
[COUNSEL TO CONFIRM: whether this DPA applies automatically to every account under the Terms of Service, or only when the parties sign it.]
This DPA governs Bids2Bank’s processing of personal data on Customer’s behalf. Where Customer’s use of the Service involves no personal data under any privacy law, the obligations here still apply to the data processed under the Agreement.
1. Definitions
1.1 "Applicable Privacy Law" means the data protection and privacy laws that apply to the processing of Personal Data under the Agreement, including, as applicable, the EU General Data Protection Regulation (Regulation (EU) 2016/679) ("GDPR"); the UK GDPR; the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act ("CCPA"); and other U.S. state privacy laws.
1.2 "Controller", "Processor", "Data Subject", "Personal Data", "Processing" and "Subprocessor" have the meanings given in the GDPR. Equivalent concepts under U.S. state privacy laws (such as "Business" and "Service Provider" under the CCPA) are addressed in Schedule 3.
1.3 "Customer Data" means the documents, content and other material Customer and its users upload to or create in the Service. "Customer Personal Data" means Personal Data in Customer Data that Bids2Bank processes on Customer’s behalf.
1.4 "Restricted Transfer" means a transfer of Customer Personal Data from a jurisdiction that restricts cross-border transfers (such as the EEA, the UK or Switzerland) to a jurisdiction that does not provide an adequate level of protection under Applicable Privacy Law.
1.5 "Standard Contractual Clauses" or "SCCs" means (a) for transfers from the EEA, the clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021 ("EU SCCs"); (b) for transfers from the UK, the International Data Transfer Addendum to the EU SCCs issued by the Information Commissioner ("UK Addendum"); and (c) for transfers from Switzerland, the EU SCCs as adapted for the Swiss Federal Act on Data Protection.
2. Roles and scope
2.1 For Customer Personal Data, Customer is the Controller (or, where Customer is itself a Processor for a third-party Controller, Customer engages Bids2Bank as its Subprocessor) and Bids2Bank is the Processor.
2.2 The subject matter, duration, nature and purpose of the processing, and the categories of Data Subjects and Personal Data, are set out in Schedule 1.
3. Bids2Bank’s obligations
3.1 Instructions. Bids2Bank processes Customer Personal Data only on Customer’s documented instructions, including with regard to Restricted Transfers, unless the law requires otherwise. The Agreement, this DPA and Customer’s use and configuration of the Service are Customer’s instructions.
3.2 Compliance. Bids2Bank will comply with Applicable Privacy Law in its role as Processor.
3.3 Confidentiality. Bids2Bank ensures that people authorized to process Customer Personal Data are bound by confidentiality obligations.
3.4 No sale or sharing. Bids2Bank does not sell or share Customer Personal Data (as the CCPA defines those terms) and does not retain, use or disclose it for any purpose other than providing the Service, except as the CCPA permits. Bids2Bank understands and will comply with these restrictions.
3.5 No combining. Bids2Bank does not combine Customer Personal Data with personal data it receives from or on behalf of anyone else, or collects from its own interactions with Data Subjects, except as Applicable Privacy Law permits.
3.6 No model training. Bids2Bank does not use Customer Data to train or fine-tune any machine-learning model. To run the steps Customer starts, Bids2Bank sends the text a step needs to the AI providers listed as Subprocessors, through their business APIs.
4. Security and Subprocessors
4.1 Security measures. Bids2Bank maintains the technical and organizational measures in Schedule 2. Bids2Bank may change them if the change does not materially reduce the overall protection of Customer Personal Data.
4.2 Subprocessors. Customer authorizes Bids2Bank to use the Subprocessors listed at bids2bank.com/subprocessors (updated October 14, 2026), which states for each one what it does, the data it receives, whether it is always used or only when Customer uses a particular feature, and where it processes data where Bids2Bank has checked. Bids2Bank imposes data-protection obligations on each Subprocessor that are no less protective than this DPA [FOUNDER TO CONFIRM: the vendor policy records collecting each provider’s data-processing terms as not yet done] and remains responsible for its Subprocessors’ performance.
4.3 New Subprocessors. Before a new Subprocessor begins processing Customer Personal Data, Bids2Bank will add it to the list and notify Customer [FOUNDER/COUNSEL TO CONFIRM: how notice is given (for example email to the workspace owner) and how far in advance; the draft proposed 30 days].
4.4 Objections. If Customer reasonably objects to a new Subprocessor on data-protection grounds, Customer may notify Bids2Bank in writing and the parties will work in good faith to resolve the objection. If they cannot, Customer may stop using the feature that relies on that Subprocessor or close its account [FOUNDER/COUNSEL TO CONFIRM: any refund; the draft offered a pro rata refund of prepaid fees, which the Terms of Service otherwise do not give].
5. Data Subject rights
5.1 Taking into account the nature of the processing, Bids2Bank will assist Customer by appropriate technical and organizational measures, as far as possible, to respond to Data Subjects exercising their rights under Applicable Privacy Law. In the Service, users can view and correct their account details in Settings, the workspace owner or an admin can download the workspace’s data, and the owner can delete the workspace.
5.2 If Bids2Bank receives a request from a Data Subject about Customer Personal Data, it will forward the request to Customer without undue delay and will not answer it directly except to acknowledge it and refer the Data Subject to Customer. Requests to Bids2Bank go to privacy@bids2bank.com.
6. Personal Data Breach
6.1 Bids2Bank will notify Customer without undue delay, and in any event within [72] hours [FOUNDER/COUNSEL TO CONFIRM this period], after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will include the information Applicable Privacy Law requires, to the extent then known.
6.2 Bids2Bank will give reasonable cooperation and information to help Customer meet its own breach-notification obligations, and will take reasonable steps to investigate, contain and mitigate the breach.
6.3 Notifying or responding to a Personal Data Breach is not an admission of fault or liability.
7. Audits and information
7.1 Bids2Bank does not hold a SOC 2 report, an ISO/IEC 27001 certificate or a FedRAMP authorization today, and no independent penetration test is on record. The current status of each is on the Trust & Security page.
7.2 On request, Bids2Bank will make available the information reasonably necessary to show compliance with this DPA, including written answers to reasonable security questionnaires and its current security policies. Customer can download a signed export of a pursuit’s tamper-evident activity record from the Service.
7.3 If Applicable Privacy Law requires Customer to carry out an audit that the information in 7.2 does not satisfy, the parties will agree its scope, timing and cost in good faith. Audits may not take place more than once a year, require at least 30 days’ notice, must be held during business hours without unreasonably interfering with Bids2Bank’s operations, and the auditor must sign a confidentiality agreement.
8. Where data is processed and international transfers
8.1 Bids2Bank stores the Customer workspace database and uploaded files in the United States. Subprocessors may process data in other locations; bids2bank.com/subprocessors states where each processes data where Bids2Bank has checked.
8.2 To the extent processing involves a Restricted Transfer, the SCCs are incorporated into this DPA with the elections in Schedule 4: Module Two (Controller to Processor) where Customer is the Controller and Module Three (Processor to Processor) where Customer is itself a Processor. For transfers from the UK the UK Addendum applies, and for transfers from Switzerland references to the GDPR include the Swiss Federal Act on Data Protection and the Swiss Federal Data Protection and Information Commissioner is a competent supervisory authority.
8.3 If Bids2Bank receives a legally binding request from a public authority for Customer Personal Data, it will notify Customer without undue delay unless the law prohibits it, and will challenge a request it reasonably believes is unlawful.
9. Deletion and return
9.1 Return. While its account is open, the workspace owner or an admin can download the workspace’s data from Settings.
9.2 Deletion. The workspace owner can delete the workspace from Settings at any time after any paid plan has ended. Deletion removes uploaded files and workspace content at once. At Customer’s written request after the Agreement ends, Bids2Bank will delete Customer Personal Data within [30] days [FOUNDER TO CONFIRM this period].
9.3 Records kept. Bids2Bank keeps the signed approval and activity records, the team audit log, review decisions, training records and billing records after deletion, for its audit-record period (target 7 years) or longer where the law requires. The signed activity record holds identifiers, hashes and counts rather than the proposal text, and the uploaded files are not kept.
9.4 Backups. Deleted data can remain in database backups until those backups expire under the database provider’s backup window [FOUNDER TO CONFIRM the window; the data-retention policy records it as not yet confirmed].
10. Liability
Each party’s liability under this DPA is subject to the limitation of liability in the Agreement (Section 9 of the Terms of Service, or the corresponding section of a signed order form), except where Applicable Privacy Law requires otherwise.
11. Order of precedence
If there is a conflict, the following order applies: (1) the SCCs, where they apply; (2) this DPA; (3) the Agreement.
12. Signature
Customers who need a signed copy can email legal@bids2bank.com. Bids2Bank signatory: [FOUNDER TO FILL: name and title].
Schedule 1 — Processing details
Subject matter: providing the Bids2Bank software service.
Duration: the term of the Agreement, plus the periods in Section 9.
Nature and purpose: hosting, storing, transmitting, indexing, searching and analysing Customer Data to support Customer’s federal contracting and grants work, including (a) reading solicitation documents, (b) building compliance matrices, (c) drafting proposal text with a source, rule and evidence link for each sentence, (d) checking that text through the retrieval, citation and support checks, (e) recording Customer’s approval before Customer submits (Bids2Bank does not submit anything to a government system), and (f) where Customer uses them, supplier research and supplier quote requests.
Categories of Data Subjects: Customer’s users of the Service; Customer’s personnel and contractors; people named in documents Customer uploads (such as key personnel, past-performance references and teaming partners); and suppliers’ contacts that Customer adds or emails through the Service.
Categories of Personal Data: names and business contact details (email, phone, address); professional details (employer, title, role, qualifications, résumé content); sign-in data (email, a password hash held by the sign-in provider, and two-factor authenticator enrolment); activity and audit records; supplier contact details, quote requests, replies and opt-outs; and any other Personal Data in content Customer uploads.
Special categories of Personal Data: none expected. Customer will not upload special categories of Personal Data except where Applicable Privacy Law permits.
Frequency of transfer: continuous, for the term of the Agreement.
Schedule 2 — Security measures
1. Policies. Written policies for access control, change management, contingency, data retention, incident response, risk assessment, security awareness and vendor management. Each marks the controls that are not yet operating.
2. Access control. Every data request is authenticated (a signed-in session or a workspace API key, stored only as a hash) and checked against the workspace that owns the data. Workspace roles are owner, admin, editor and viewer. Authenticator-app two-factor authentication is available to every user, and the owner can require it for the whole workspace. Dashboard sessions sign out after 30 minutes idle, and an owner or admin can end a teammate’s sessions. Single sign-on (SAML or OIDC) is not offered. Two-factor authentication on Bids2Bank’s own operator accounts and periodic access reviews are recorded as not yet operating.
3. Workspace isolation. Row-level security is enabled on every Bids2Bank database table, and stored files are read and written only by the server under a per-workspace prefix. All customers share one multi-tenant deployment; single-tenant deployment is not offered.
4. Encryption. Traffic is encrypted in transit (HTTPS). Data is encrypted at rest by the hosting providers. Gmail refresh tokens are additionally encrypted by Bids2Bank (AES-256-GCM).
5. Audit logging. Hand-offs between processing steps and each approval are hashed (SHA-256) and signed (HMAC-SHA256) into a chained record; records sealed before 25 September 2026 bind only their top-level fields. The activity record, review decisions and training records are append-only in the database. A daily signed copy to separate storage is built but not yet configured.
6. Application security. Per-caller request rate limits; schema validation of every request body; uploaded PDF and Word files screened for scripts, macros and embedded content before they are stored, with optional antivirus scanning; outbound webhooks only to public addresses; error reports scrubbed of request bodies, cookies, secrets and email addresses.
7. Vulnerability management. Dependency vulnerability checks on every change, failing on high or critical advisories, and weekly automated dependency updates. No infrastructure scanning or penetration test is on record [FOUNDER TO CONFIRM: any patching timelines to commit to].
8. Change management. Automated type checks, tests and builds run on every change, and production is deployed from a branch that is moved only to a commit that passed them.
9. Personnel. Confidentiality obligations for people with access. Background checks and yearly security-awareness training are recorded as not yet operating.
10. Incident response. A written incident-response plan [FOUNDER TO FILL: incident lead, deputy and customer contact, which the plan leaves open]; breach notice under Section 6.
11. Backups and continuity. The database provider’s managed daily backups [FOUNDER TO CONFIRM the plan’s retention window and whether point-in-time recovery is enabled]. A nightly encrypted backup with an automatic restore check is built but not yet running against production. A written contingency plan exists but has not been exercised. Bids2Bank makes no recovery-time or recovery-point commitment.
12. Subprocessor oversight. An inventory of Subprocessors, published at bids2bank.com/subprocessors. Collecting each provider’s security reports and data-processing terms, and a yearly re-review, are recorded as not yet operating.
Schedule 3 — CCPA and U.S. state privacy terms
Where Customer is a "Business" under the CCPA, or a "Controller" under another U.S. state privacy law, and Bids2Bank is its "Service Provider" or "Processor":
1. Bids2Bank processes Customer Personal Data only for the limited and specified business purposes described in the Agreement and this DPA.
2. Bids2Bank will not (a) sell or share Customer Personal Data; (b) retain, use or disclose it for any purpose other than those business purposes, including any other commercial purpose; (c) retain, use or disclose it outside the direct business relationship with Customer; or (d) combine it with personal information it receives from or on behalf of anyone else, or collects from its own interactions with consumers, except as Applicable Privacy Law permits.
3. Bids2Bank will notify Customer in writing if it determines it can no longer meet its obligations under Applicable Privacy Law.
4. Customer may take reasonable and appropriate steps to stop and remediate any unauthorized use of Customer Personal Data by Bids2Bank.
Schedule 4 — Standard Contractual Clauses elections
[COUNSEL TO CONFIRM every election in this schedule.]
Module: Module Two (Controller to Processor) or Module Three (Processor to Processor), as applicable.
Clause 7 (docking clause): included.
Clause 9 (use of sub-processors): Option 2, general written authorization, with notice as in Section 4.3 of this DPA.
Clause 11 (redress): the optional language is not used.
Clause 17 (governing law): the law of Ireland.
Clause 18 (choice of forum): the courts of Ireland.
Annex I.A (parties): Customer and Bids2Bank as identified in the Agreement.
Annex I.B (description of transfer): Schedule 1 of this DPA.
Annex I.C (competent supervisory authority): the authority of the EU member state where Customer’s lead establishment is, otherwise the Irish Data Protection Commission.
Annex II (technical and organizational measures): Schedule 2 of this DPA.
See also the Terms of Service, the Privacy Policy, Subprocessors and Trust & Security.