Folio Folio
Join Waitlist

Data Processing Addendum

Effective date: May 9, 2026

Last updated: May 9, 2026

This Data Processing Addendum ("DPA") forms part of the Terms of Service or other written or electronic agreement (the "Agreement") between Folio Solutions, an assumed name of Captain RevOps LLC, a Michigan limited liability company (assumed name filed with the Michigan Department of Licensing and Regulatory Affairs) ("Folio," "we," "us," or "our"), and the customer identified in the Agreement ("Customer," "you," or "your") for the provision of the Folio managed packages and related services (the "Services").

This DPA is automatically incorporated into the Agreement when Customer accepts the Folio Terms of Service. A signed copy is available upon request from privacy@foliosolutions.net.

In the event of any conflict between this DPA and the Agreement, this DPA controls with respect to the processing of Customer Personal Data.

Scope and Architecture Overview

Folio is a Salesforce ISV partner. The Services consist of native AppExchange managed packages (Folio Jot and Folio Docs) that are installed in, and run entirely within, the Customer's own Salesforce organization. As a result:

This DPA applies to that limited Folio-side processing. It does not purport to govern the Customer's underlying relationship with Salesforce, Inc. or the data inside the Customer's Salesforce org as such.

1. Definitions

Capitalized terms not defined in this DPA have the meanings given to them in the Agreement or in applicable Data Protection Laws.

2. Roles and Scope

2.1 Roles

The parties acknowledge and agree that with regard to the processing of Customer Personal Data:

For purposes of CCPA/CPRA, Folio acts as a Service Provider to Customer.

2.2 Scope of Processing

Consistent with the Scope and Architecture Overview above, Folio will process Customer Personal Data only:

Folio will inform Customer if, in its opinion, an instruction infringes Applicable Data Protection Laws.

2.3 Details of Processing

The details of processing are set out in Annex A of this DPA.

3. Folio's Obligations

3.1 Confidentiality

Folio will ensure that all personnel authorized to process Customer Personal Data are bound by appropriate confidentiality obligations and have received appropriate data protection training.

3.2 Security

Folio will implement and maintain appropriate technical and organizational measures designed to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures are described in Annex B.

3.3 Sub-processors

(a) General authorization. Customer provides Folio with general authorization to engage Sub-processors to process Customer Personal Data, subject to the requirements of this Section 3.3.

(b) Current Sub-processors. A current list of Sub-processors is maintained at foliosolutions.net/sub-processors.

(c) New Sub-processors. Folio will provide notice (by updating the Sub-processor list and, for active Customers, by email) at least 30 days before authorizing any new Sub-processor. Customer may object in writing within 30 days of such notice on reasonable grounds related to data protection. The parties will work in good faith to resolve the objection. If they cannot, Customer may terminate the Agreement with respect to the Services that cannot be provided without the new Sub-processor, with a pro-rata refund of any prepaid fees for the unused portion.

(d) Sub-processor obligations. Folio will impose data protection obligations on each Sub-processor that are no less protective than those in this DPA. Folio remains liable for the acts and omissions of its Sub-processors.

3.4 Data Subject Requests

(a) Folio will, taking into account the nature of the processing, assist Customer by appropriate technical and organizational measures, insofar as possible, in fulfilling Customer's obligations to respond to requests from Data Subjects exercising their rights.

(b) If Folio receives a request directly from a Data Subject relating to Customer Personal Data, Folio will, without undue delay, forward the request to Customer and not respond to the Data Subject directly except to confirm receipt and direct them to Customer.

3.5 Assistance with Compliance

Folio will provide reasonable assistance to Customer in complying with Customer's obligations under Applicable Data Protection Laws, including obligations relating to security of processing, breach notification, data protection impact assessments, and prior consultation with supervisory authorities, taking into account the nature of the processing and the information available to Folio.

3.6 Personal Data Breach Notification

(a) Folio will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data. Folio will use reasonable efforts to provide initial notification within 72 hours of becoming aware of the breach, recognizing that initial notification may need to be supplemented as additional information becomes known.

(b) The notification will include, to the extent then known:

(c) Folio will provide ongoing updates as additional information becomes available and will reasonably cooperate with Customer's investigation and breach response activities.

3.7 Audits

(a) Folio will make available to Customer all information reasonably necessary to demonstrate compliance with this DPA. This includes responding to reasonable security questionnaires and providing summaries of any independent audits or certifications Folio has obtained (such as SOC 2 reports, when available), subject to confidentiality obligations.

(b) On reasonable prior written notice (at least 30 days), and not more than once per twelve-month period, Customer (or an independent third-party auditor mandated by Customer and reasonably acceptable to Folio) may conduct an audit of Folio's compliance with this DPA. Audits must be conducted during business hours, must not unreasonably interfere with Folio's operations, and the auditor must be subject to confidentiality obligations.

(c) Customer bears the cost of any audit it requests, except where the audit reveals material non-compliance by Folio, in which case Folio will bear reasonable audit costs.

(d) Where Folio has provided a recent (within the prior twelve months) independent third-party audit report or certification covering the relevant subject matter, that report or certification will satisfy this Section 3.7 unless Customer has a reasonable, documented basis for further inquiry.

3.8 Return or Deletion of Customer Personal Data

Because document content and other Customer Data created with the Folio managed packages is stored in the Customer's own Salesforce organization, return or deletion of that data is controlled by the Customer within its Salesforce org and not by Folio. Folio cannot return or delete data residing in the Customer's Salesforce org.

With respect to Customer Personal Data that Folio actually holds on its own systems — for example, business contact data, billing records, support correspondence, and LMA license metadata — upon termination or expiration of the Agreement, Folio will, at Customer's choice, delete or return such Customer Personal Data within 30 days, except to the extent retention is required by applicable law (including for tax, accounting, or legal-defense purposes). Backup copies may persist in routine backups for up to 90 days before automatic deletion. Folio will certify deletion in writing upon Customer's request.

4. International Transfers

4.1 Cross-Border Transfers

To the extent that Folio processes Customer Personal Data originating from the European Economic Area, the United Kingdom, or Switzerland in a country that has not received an adequacy decision, the transfer will be governed by the applicable Standard Contractual Clauses, which are hereby incorporated by reference, with Customer as data exporter and Folio as data importer.

4.2 Module Selection

For transfers from Controllers to Processors, Module Two of the SCCs applies. For transfers from Processors to Sub-processors (where Customer is a Processor), Module Three applies. Optional clauses are included or omitted as set out in Annex C.

4.3 UK Transfers

For transfers subject to UK data protection law, the UK International Data Transfer Addendum to the SCCs (issued by the Information Commissioner's Office) applies in addition to the SCCs.

5. CCPA/CPRA Specific Provisions

For Personal Data subject to CCPA/CPRA:

6. Liability

Each party's liability arising out of or related to this DPA is subject to the limitations of liability set out in the Agreement.

7. Term and Termination

This DPA is effective for the term of the Agreement and will continue thereafter for as long as Folio processes Customer Personal Data. Sections that by their nature should survive termination will survive.

8. Miscellaneous

8.1 Order of Precedence

In the event of any conflict between this DPA and the Agreement, this DPA will prevail. In the event of any conflict between the Standard Contractual Clauses and this DPA, the Standard Contractual Clauses will prevail.

8.2 Governing Law

This DPA is governed by the laws of the State of Michigan, except that the Standard Contractual Clauses are governed by the law specified in those clauses.

8.3 Updates

Folio may update this DPA from time to time to reflect changes in law, sub-processors, or operational practices. Material changes will be notified to Customer at least 30 days in advance. Continued use of the Services constitutes acceptance.

8.4 Signed Copies

A signed copy of this DPA is available upon request to privacy@foliosolutions.net. The DPA in effect at the time of acceptance applies regardless of whether a separate signed copy is executed.

Annex A — Details of Processing

Subject matter of the processing: Provision of the Folio managed packages (Folio Jot and Folio Docs) and related services as described in the Agreement.

Duration of the processing: For the term of the Agreement and any post-termination retention period set out in this DPA.

Nature and purpose of the processing: To license, distribute, sell, invoice, support, and communicate about the Folio managed packages, and (in aggregated and de-identified form) to improve them. The managed packages themselves run inside the Customer's Salesforce organization; document content and other Customer Data created using the packages is stored in the Customer's Salesforce org and is not transmitted to or processed by Folio in the ordinary course.

Types of Personal Data processed by Folio:

Types of Personal Data not processed by Folio in the ordinary course: Document content and other Customer Data stored within the Folio managed-package custom objects in the Customer's Salesforce organization. That data resides solely in the Customer's Salesforce org and is governed by the Customer's own agreement with Salesforce, Inc.

Categories of Data Subjects:

Frequency of the transfer: Ongoing for billing, license-management, and support data for the duration of the Agreement; ad hoc for support correspondence; only as initiated by Customer for support login access.

Retention period: As set out in Section 3.8 of this DPA and the Folio Privacy Policy.

Annex B — Technical and Organizational Measures

The technical and organizational measures below cover the systems Folio operates — for example, Folio's CRM, email, billing, support, and source-control systems used to license, support, and communicate about the Services. Customer Data created with the Folio managed packages is stored in the Customer's own Salesforce organization and is protected by the Salesforce platform's native security model and the Customer's configuration of that platform; that environment is not operated or controlled by Folio.

Within the systems Folio operates, Folio implements and maintains the following measures:

Access controls:

Encryption:

Operational security:

Personnel security:

Incident response:

Business continuity:

Compliance:

These measures are subject to continuous improvement. Folio may update them, provided that the updates do not materially diminish the level of protection.

Annex C — Standard Contractual Clauses Configurations

For the purposes of the Standard Contractual Clauses (Module Two and Module Three, as applicable):

For questions or to request a signed copy of this DPA: privacy@foliosolutions.net