Skip to main content
ExactPour logo
Back to ExactPour

ExactPour Data Processing Agreement

Version 2.2 · effective October 7, 2026

ExactPour Data Processing Agreement (DPA)

Last updated: October 7, 2026

This Data Processing Agreement ("DPA") forms part of the Terms of Service (the Master Subscription Agreement, or the "Agreement") between ExactPour LLC ("Processor" or "ExactPour") and the Customer ("Controller"). It applies where ExactPour processes Personal Data on Customer's behalf in connection with the Service. Capitalized terms not defined here have the meanings given in the Agreement or in applicable Data Protection Law.

1. Definitions

  • Data Protection Law, all laws applicable to the processing of Personal Data, including the EU/UK GDPR, the CCPA/CPRA, Florida and other U.S. state privacy laws, and any successor or supplementary legislation.
  • Personal Data, any information relating to an identified or identifiable natural person that ExactPour processes on Customer's behalf under the Agreement.
  • Personal Data Breach, a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.
  • Processing, Controller, Processor, Data Subject, Subprocessor, Supervisory Authority, as defined in applicable Data Protection Law.

2. Roles and Scope

Customer is the Controller (or a processor acting on behalf of a Controller). ExactPour is the Processor. ExactPour processes Personal Data only to provide and improve the Service and only on documented instructions from Customer (including as set out in the Agreement, this DPA, and Customer's configuration and use of the Service).

3. Subject Matter and Details of Processing

  • Subject matter: provision of the ExactPour inventory management, analytics, and related AI-assisted Service.
  • Duration: the Subscription Term plus the retention and deletion periods described in the Agreement and this DPA.
  • Nature and purpose: hosting, storage, processing, and analysis of Customer Data (including inventory, sales, operational, and account data) to deliver, secure, maintain, and improve the Service, including AI-powered features such as forecasting, insights, anomaly detection, and document extraction.
  • Types of Personal Data: account and contact details of Authorized Users (name, email, role), IP addresses, device and usage data, and any Personal Data that Customer chooses to include in Customer Data (for example, in notes, recipes, or uploaded documents).
  • Categories of Data Subjects: Customer's Authorized Users, personnel, and any other individuals whose Personal Data Customer inputs into the Service.

4. Processor Obligations

ExactPour will:

  1. process Personal Data only on Customer's documented instructions, unless required by law (in which case it will notify Customer where legally permitted);
  2. ensure that persons authorized to process Personal Data are subject to appropriate confidentiality obligations;
  3. implement and maintain appropriate technical and organizational security measures as described in Section 7, taking into account the state of the art, the costs of implementation, and the risks of processing;
  4. respect the conditions for engaging Subprocessors as set out in Section 5;
  5. assist Customer, taking into account the nature of the processing, in responding to Data Subject requests and in fulfilling its obligations regarding security, Personal Data Breach notification, and data protection impact assessments (including for high-risk processing such as certain AI features), where reasonably possible and at Customer's request and expense for extensive assistance;
  6. at Customer's choice and in accordance with Section 11, delete or return Personal Data at the end of the provision of services, subject to legal retention requirements and backup cycles; and
  7. make available to Customer the information reasonably necessary to demonstrate compliance with this DPA and allow for and contribute to audits as described in Section 8.

ExactPour will not use Personal Data for any purpose other than fulfilling its obligations under the Agreement, nor will it allow a model provider to train on Customer Data unless the customer authorizes that feature in writing.

5. Subprocessors

Customer provides general authorization for ExactPour to engage Subprocessors to process Personal Data. ExactPour will: (a) maintain a current, publicly available list of Subprocessors at exactpour.com/legal/subprocessors (or a successor URL), including the identity, location, and purpose of each Subprocessor; (b) impose data-protection obligations on each Subprocessor that are no less protective than those in this DPA; and (c) remain fully liable to Customer for the performance of its Subprocessors.

ExactPour will provide at least thirty (30) days' prior written notice (via the public list and email to the address on file) of any intended addition or replacement of a Subprocessor. Customer may object to such changes on reasonable data-protection grounds. If Customer objects and the parties cannot resolve the objection, Customer may terminate the affected portion of the Service without penalty.

6. Data Subject Requests

ExactPour will, to the extent legally permitted and without undue delay, notify Customer of any request from a Data Subject to exercise their rights under Data Protection Law and will provide reasonable assistance to enable Customer to respond.

7. Security Measures

Taking into account the state of the art and the risks of processing, ExactPour maintains appropriate technical and organizational measures, including: encryption of Personal Data in transit; platform encryption of Personal Data at rest; multi-tenant isolation enforced at the database layer via Row Level Security; role-based access controls and least-privilege administration; append-only audit and security logging; secure software development and change management practices; and documented incident-response procedures.

8. Audits

ExactPour will make available information reasonably necessary to demonstrate compliance with this DPA. Customer (or an independent auditor mandated by Customer and bound by confidentiality obligations) may conduct audits or inspections no more than once per calendar year, unless a Supervisory Authority requires more frequent audits or there is reasonable suspicion of material non-compliance. Audits are subject to reasonable advance notice, confidentiality, and security conditions, and will not unreasonably interfere with ExactPour's business operations.

9. Personal Data Breach

ExactPour will notify Customer without undue delay and, where feasible, within seventy-two (72) hours of confirmation, consistent with Section 5.6 of the Terms of Service and applicable law, after becoming aware of a Personal Data Breach affecting Customer's Personal Data. ExactPour will provide Customer with information reasonably available to it to assist Customer in meeting its own notification and record-keeping obligations under Data Protection Law.

10. International Transfers

Where the processing involves transferring Personal Data out of the EEA, UK, or another jurisdiction with data transfer restrictions, the parties will rely on an appropriate transfer mechanism, such as the European Commission's Standard Contractual Clauses (2021 modules, as applicable) or other approved mechanisms. These mechanisms are incorporated by reference where required. ExactPour will ensure Subprocessors involved in such transfers are also bound by appropriate safeguards.

11. Deletion and Return of Personal Data

Upon termination or expiry of the Agreement, ExactPour will, at Customer's election and within a reasonable period (generally aligned with the thirty (30) day data export window in Section 13.4 of the Terms of Service), delete or return all Personal Data and delete existing copies, except to the extent retention is required by law or the data remains in routine backups pending deletion in the ordinary course. ExactPour will confirm deletion in writing upon Customer's request.

12. Liability

Each party's liability arising under or in connection with this DPA is subject to the limitations of liability set forth in the Agreement (including any applicable carve-outs for confidentiality breaches, indemnification obligations, fraud, gross negligence, or willful misconduct).

13. Contact

Data protection inquiries: support@exactpour.com · ExactPour LLC · exactpour.com