Data Processing Addendum
How Proof of Fix processes customer data as a service provider
Effective date: August 23, 2026
This Data Processing Addendum (DPA) describes how MB Evelaina (trading as Proof of Fix) processes personal data for a business customer that uses the service to manage authorized properties, findings, remediation, and evidence.
1. Roles and scope
For account registration, billing, website analytics, fraud prevention, and service administration, MB Evelaina acts as an independent controller as described in the Privacy Policy. When a customer submits personal data in a workspace or property record and MB Evelaina processes it only to provide the contracted service, the customer acts as controller and MB Evelaina acts as processor. The customer must have a lawful basis and authority to submit the data and remains responsible for instructions and notices to its people and clients.
2. Documented instructions and duration
MB Evelaina processes customer personal data only to provide, secure, support, troubleshoot, and improve the contracted Proof of Fix service, and on the customer's documented instructions. This DPA applies while the relevant service is active and during the limited period needed for return, deletion, legal retention, dispute handling, or service security.
3. Data and affected people
Customer data may include account and workspace identifiers, names, email addresses, client and property contact details supplied by the customer, authorization records, remediation notes, and technical observations connected to an approved host. Affected people may include customer users, agency clients, and contacts named in customer records. Customers must not submit passwords, private keys, payment card data, or other secrets.
4. Security measures
Proof of Fix applies reasonable technical and organizational measures appropriate to the service, including tenant-scoped access controls and row-level security, least-privilege server access, encryption in transit and at rest through the selected infrastructure providers, authorization receipts and exact-host scope, read-only network traffic, a bounded egress path, attributed request logging, controlled evidence access, backup and recovery procedures where configured, security monitoring, and personnel access controls. No service can eliminate every risk, and the service is not a certification or penetration test.
5. Subprocessors and providers
The current provider inventory and roles are listed on the Subprocessors page. MB Evelaina remains responsible for its processor obligations when using an approved subprocessor. Payment, advertising, and optional website analytics providers may act as independent controllers for their own services rather than processors of customer workspace data.
6. International transfers
A provider may process data outside the European Economic Area. Where required, MB Evelaina uses an adequacy decision, EU Standard Contractual Clauses, or another lawful transfer mechanism and applies appropriate supplementary safeguards. The customer may contact support@remedyproof.com with questions about the current provider list.
7. Assistance and incidents
Taking account of the nature of processing, MB Evelaina will provide reasonable assistance for data-subject requests, security assessments, and legally required consultations using the information available in the service. MB Evelaina will notify the verified account or workspace contact on file without undue delay after becoming aware of a confirmed personal-data breach affecting customer data, subject to legal restrictions. Questions and inbound notices can be sent to support@remedyproof.com.
8. Return, deletion, and retention
At the customer's request or when the service ends, MB Evelaina will make customer personal data available for export where the service supports it and will delete or anonymize customer data where technically possible and legally permitted. Routine monitoring history may be purged under the applicable retention schedule. Immutable evidence ledgers and the minimum audit links needed to interpret or verify an issued ledger are not promised to be deleted merely because a property or account is removed; they may be retained for integrity, legal, accounting, dispute, or security purposes. Provider-held copies follow the relevant provider's processes.
9. Evidence and audit
The service documentation, Privacy Policy, Cookie Policy, and Subprocessors page describe the applicable processing and controls. A customer may send a specific compliance or audit question to support@remedyproof.com. Any audit must be reasonable, proportionate, confidential, and scheduled so it does not compromise another customer's data or the service's security.
10. Contact
Questions about this DPA or processor processing can be sent to support@remedyproof.com. This DPA is a product disclosure and operational baseline, not a substitute for counsel reviewing the customer's required data-processing terms.