Skip to content
ProxyForge

Data processing addendum

Effective · Version 1.0

This addendum applies where ProxyForge processes personal data on behalf of a customer in the course of providing the service, and that processing is subject to the EU General Data Protection Regulation, the UK GDPR, the Swiss Federal Act on Data Protection, or another data protection law that requires such terms. It forms part of the terms of service and takes effect when the customer accepts them; no separate signature is needed. If your procurement process requires a countersigned copy, write to [email protected].

1. Roles

The customer is the controller, or a processor acting for its own controller, and determines the purposes and means of the processing. ProxyForge is the processor. Where ProxyForge determines purposes itself, for billing, account security, fraud prevention, and the handling described in the privacy notice, it acts as an independent controller and this addendum does not apply to that processing.

2. Description of the processing

  • Subject matter: routing the customer’s requests through the proxy network, and the operational records that routing produces.
  • Nature and purpose: routing requests to customer-selected destinations; generating connection metadata for billing and service-level measurement; retaining it for abuse investigation and dispute resolution.
  • Categories of data: connection metadata only: source and exit IP addresses, timestamps, destination hostnames, byte counts, and the account identifiers responsible. ProxyForge does not inspect, parse, or store the content of requests or responses.
  • Data subjects: the customer’s authorised users and, where a destination or IP address is associated with an individual, potentially other individuals.
  • Special categories: none. The customer must not instruct processing that would introduce them.
  • Duration: the term of the customer’s use of the service. Connection metadata is retained for 30 days and then deleted.

3. Processor obligations

ProxyForge will:

  • process personal data only on the customer’s documented instructions, which the terms of service, this addendum, and the customer’s configuration of the service constitute, including with regard to international transfers, unless the law requires otherwise, in which case it will tell the customer first unless the law prohibits that;
  • tell the customer promptly if, in its opinion, an instruction infringes applicable data protection law;
  • ensure that everyone authorised to process the personal data is bound by confidentiality;
  • implement the security measures in section 4;
  • engage sub-processors only as set out in section 5;
  • assist the customer, taking into account the nature of the processing, in responding to data subject requests, in meeting its security and breach-notification obligations, and with data protection impact assessments and prior consultations with supervisory authorities. A request received directly from a data subject about customer data is forwarded to the customer without being answered;
  • delete or return personal data at the end of the service as set out in section 9; and
  • make available the information necessary to demonstrate compliance with Article 28 of the GDPR, and allow audits as set out in section 8.

4. Security measures

ProxyForge maintains technical and organisational measures appropriate to the risk, including:

  • encryption of data in transit;
  • multi-factor authentication for access to production systems, granted on a least-privilege basis and reviewed regularly;
  • segregation of customer credentials and isolation between customer accounts;
  • logging of administrative access and actions;
  • hosting with a cloud provider that maintains recognised security certifications for its facilities;
  • automatic deletion of connection metadata after 30 days; and
  • a documented process for detecting, investigating, and responding to security incidents.

ProxyForge may update these measures, provided the overall level of protection is not reduced.

5. Sub-processors

The customer gives general authorisation for ProxyForge to engage sub-processors. The sub-processors in use as of 1 October 2026 are:

  • Amazon Web Services: hosting of the platform, databases, and connection metadata, in the European Union (Frankfurt, Germany).
  • Upstream network operators: carriage of proxied traffic, receiving only the connection data needed to route it, located in the countries where the exit addresses the customer selects are located.

ProxyForge gives at least 30 days’ notice before adding or replacing a sub-processor, by updating this list and emailing the account owner. The customer may object on reasonable data protection grounds within that period. If the objection cannot be resolved, the customer may stop using the affected service and have its unused wallet balance refunded to where it came from. Each sub-processor is bound by written terms that impose data protection obligations no less protective than this addendum, and ProxyForge remains responsible for its sub-processors’ performance.

6. International transfers

ProxyForge is established in the United States. To the extent processing involves a transfer of personal data from the European Economic Area to a country without an adequacy decision, the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 are incorporated into this addendum by reference, with the customer as data exporter and ProxyForge as data importer, as follows:

  • Module Two (controller to processor) applies where the customer is a controller, and Module Three (processor to processor) where it is a processor;
  • Clause 7 (docking clause) does not apply;
  • in Clause 9, Option 2 (general written authorisation) applies, with the notice period in section 5 of this addendum;
  • the option in Clause 11 does not apply;
  • in Clause 17, the clauses are governed by the law of Ireland, and in Clause 18, disputes are resolved by the courts of Ireland;
  • Annex I is completed by section 2 of this addendum, with the parties’ details taken from the customer’s account and section 12, and the competent supervisory authority determined in accordance with Clause 13; Annex II by section 4; and Annex III by section 5.

For transfers from the United Kingdom, the International Data Transfer Addendum issued by the Information Commissioner applies, with the information above completing its tables and either party able to end it as its Section 19 allows. For transfers from Switzerland, the same clauses apply with the Federal Data Protection and Information Commissioner as competent authority and references to the GDPR read as references to the Swiss Federal Act on Data Protection.

7. Personal data breach

ProxyForge notifies the customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting customer personal data. The notice describes, as far as then known, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences, and the measures taken or proposed. ProxyForge provides further information as it becomes available and cooperates with the customer’s own notification obligations.

8. Audit

ProxyForge makes available on request the information necessary to demonstrate compliance with this addendum, including its sourcing attestation and, once issued, its SOC 2 Type II report, under a non-disclosure agreement. Where that information is not sufficient, the customer may audit, itself or through an independent auditor bound by confidentiality, no more than once in any twelve-month period, on 30 days’ notice, during business hours, and at its own cost, or more often where a supervisory authority requires it or following a personal data breach affecting its data.

9. Deletion and return

Connection metadata is deleted on the 30-day cycle in section 2. When the customer stops using the service, ProxyForge deletes any remaining customer personal data within 30 days, unless the law requires it to be kept. Because the data held is short-lived operational metadata, it is deleted rather than returned, unless the customer asks for a copy before the service ends. ProxyForge confirms deletion in writing on request.

10. Liability and precedence

Each party’s liability under this addendum is subject to the limitations in the terms of service, except where the standard contractual clauses or applicable law do not permit that. In the event of conflict, the standard contractual clauses prevail over this addendum, and this addendum prevails over the terms of service.

11. Changes

ProxyForge may update this addendum on the same notice as the terms of service, provided a change does not reduce the protection of personal data or conflict with the standard contractual clauses.

12. Contact

Data protection and compliance: [email protected]. Privacy: [email protected].