Data Processing Addendum

This Data Processing Addendum ("DPA") applies to personal data that Recoatly ("we", "us") processes on behalf of the business that holds a Recoatly account ("Customer", "you") in providing Recoatly ("Customer Personal Data"). It forms part of the Terms of Service (the "Terms"). Capitalized words that are not defined here have the meanings given in the Terms.

For Customer Personal Data, you are the controller, or a processor acting for your own client, and we are your processor. Where the California Consumer Privacy Act applies, you are the "business" and we are your "service provider". We are an independent controller of the account, billing and usage information described in our Privacy Policy, and this DPA does not apply to that information.

"Data Protection Laws" means all privacy and data protection laws that apply to the processing of Customer Personal Data under the Terms, including, as applicable: the EU General Data Protection Regulation 2016/679 ("GDPR") and the Irish Data Protection Acts 1988 to 2018; the UK GDPR and the UK Data Protection Act 2018; the California Consumer Privacy Act as amended ("CCPA") and other US state privacy laws; the Canadian Personal Information Protection and Electronic Documents Act and substantially similar provincial laws; the Australian Privacy Act 1988; and the New Zealand Privacy Act 2020. "Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in the GDPR, and include their equivalents under other Data Protection Laws.

If this DPA conflicts with the Terms, this DPA prevails for the processing of Customer Personal Data. If the Standard Contractual Clauses apply and conflict with this DPA, the Standard Contractual Clauses prevail. You don't need to sign this DPA for it to apply; if you need a countersigned copy for your records, contact us through the contact page at https://recoatly.com/contact.

The subject matter, nature, purpose and duration of the processing, the types of personal data and the categories of data subjects are described in Annex 1.

We process Customer Personal Data only on your documented instructions, including with regard to transfers of personal data to a third country, unless the law to which we are subject requires otherwise. In that case, we will tell you about that legal requirement before processing, unless that law prohibits it on important grounds of public interest.

Your instructions are the Terms, this DPA, your configuration and use of Recoatly — including what you and your Users choose to send, publish, connect or switch on — and any other reasonable written instructions you give us that are consistent with the Terms. We will tell you immediately if, in our opinion, an instruction infringes Data Protection Laws.

You are responsible for the lawfulness of your instructions and of the Customer Personal Data you provide, including having a lawful basis, giving any required notices and obtaining any required consents — for example, for marketing messages, call recording and crew location sharing.

We ensure that everyone we authorize to process Customer Personal Data has committed to confidentiality or is under an appropriate statutory obligation of confidentiality, and accesses it only as needed to provide Recoatly, to support you, to keep the service secure or to comply with the law.

We implement and maintain the technical and organizational measures described in Annex 2, which are designed to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. We may update these measures as technology and threats change, provided that we don't reduce the overall level of protection.

You are responsible for the security measures within your control, including choosing appropriate permissions for your Users, keeping passwords and API keys secret, removing access for people who leave, securing the systems you connect to Recoatly, and protecting data you export.

You give us general written authorization to engage subprocessors to process Customer Personal Data. Our current subprocessors are listed on our Subprocessors page (Annex 3).

• Notice of changes. We will give you at least 30 days' notice before a new or replacement subprocessor processes Customer Personal Data, by updating the Subprocessors page and notifying account owners by email.
• Your right to object. You may object on reasonable data protection grounds within that notice period. We will discuss your concerns in good faith and look for a reasonable alternative. If we cannot resolve your objection, you may terminate the affected service by notice to us, and we will refund any prepaid fees for the period after termination. This is your only remedy for the objection.
• Urgent changes. If we have to replace a subprocessor urgently — for example, because of a security issue or a provider's failure — we will notify you as soon as we can, and your right to object still applies.
• The same obligations. We impose data protection obligations on each subprocessor by written contract that are no less protective in substance than those in this DPA, in particular sufficient guarantees to implement appropriate technical and organizational measures. We remain fully liable to you for each subprocessor's performance of its obligations.

Card payments that your customers make through your own Stripe account are processed by Stripe under your agreement with Stripe. For those payments, Stripe is not our subprocessor; we pass information to Stripe at your direction.

Taking into account the nature of the processing, we will help you, by appropriate technical and organizational measures and insofar as this is possible, to respond to requests from individuals exercising their rights under Data Protection Laws. Recoatly lets you find, view, correct, export and delete Customer Personal Data, and mark people as unsubscribed or do-not-contact.

If we receive a request directly from an individual about Customer Personal Data, we will not respond to it ourselves, except to tell them to contact you or where the law requires us to, and we will pass it to you without undue delay where we can identify you.

Taking into account the nature of the processing and the information available to us, we will give you reasonable help to meet your obligations under Articles 32 to 36 of the GDPR and their equivalents under other Data Protection Laws: security of processing, notification of personal data breaches, data protection impact assessments and prior consultation with supervisory authorities. If you need help that goes beyond the information and features we make available to all customers, we may charge a reasonable fee, which we will agree with you in advance.

We will notify you without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting Customer Personal Data. We will send the notice to your account owners by email and, where possible, show it in Recoatly.

The notice will describe, as far as we know at the time: the nature of the breach, including the categories and approximate number of individuals and records concerned; its likely consequences; the measures we have taken or propose to take to address it and to mitigate its effects; and a contact point for more information. Where we cannot provide all of this at once, we will provide it in phases, without undue further delay.

We will promptly take reasonable steps to contain, investigate and mitigate the breach, and we will cooperate with you. As controller, you are responsible for any notifications you must make to supervisory authorities and individuals, and we will give you the information we have to help. A notice of a breach is not an admission of fault or liability. Unsuccessful attempts that do not compromise the security of Customer Personal Data — such as blocked sign-in attempts, pings or port scans — are not breaches.

Recoatly is hosted in the United States. You authorize us and our subprocessors to transfer Customer Personal Data to, and process it in, the United States and the other locations listed on the Subprocessors page, subject to this section.

European Union, including Ireland

Where Customer Personal Data subject to the GDPR is transferred to us in a country that the European Commission has not recognized as providing adequate protection, the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (the "EU SCCs") are incorporated into this DPA by reference and apply as follows:

• Module 2 (controller to processor) applies where you are a controller, and Module 3 (processor to processor) applies where you are a processor;
• you are the data exporter and Recoatly is the data importer;
• Clause 7 (docking clause) applies;
• in Clause 9(a), Option 2 (general written authorization) applies, with the notice period set out in section 6 of this DPA;
• the optional wording in Clause 11(a) does not apply;
• in Clause 13, the competent supervisory authority is the one determined under that Clause — for a data exporter established in Ireland, the Data Protection Commission;
• in Clause 17, Option 1 applies, and the EU SCCs are governed by the law of Ireland;
• in Clause 18(b), disputes are resolved by the courts of Ireland; and
• Annex I of the EU SCCs is completed with the information in Annex 1 of this DPA, Annex II with Annex 2, and Annex III with Annex 3.

United Kingdom

Where Customer Personal Data subject to the UK GDPR is transferred to us, the International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018 (the "UK Addendum"), is incorporated into this DPA by reference. Table 1 is completed with the parties' details in Annex 1; Table 2 with the modules and options set out above; Table 3 with Annexes 1, 2 and 3 of this DPA; and, for Table 4, both the importer and the exporter may end the UK Addendum as set out in its Section 19.

Canada, Australia and New Zealand

For Customer Personal Data protected by the laws of Canada, Australia or New Zealand, we provide a comparable level of protection through this DPA and our contracts with subprocessors, as those laws require.

Requests from public authorities and onward transfers

If we receive a legally binding request from a public authority for Customer Personal Data, we will notify you promptly unless the law prohibits it, assess whether the request is lawful, and disclose only the minimum information required. We protect onward transfers to subprocessors with appropriate safeguards, such as the EU SCCs. We will give you the information you reasonably need for any transfer impact assessment, and if a transfer mechanism we rely on is invalidated, we will work with you to put an alternative in place.

Where the CCPA or another US state privacy law applies to Customer Personal Data, we process it as your service provider or processor, and we will not:

• sell it or share it, as those terms are defined in the CCPA;
• retain, use or disclose it for any purpose, including any commercial purpose, other than the business purposes specified in the Terms and this DPA, or as the law otherwise permits;
• retain, use or disclose it outside our direct business relationship with you; or
• combine it with personal information that we receive from others or collect from our own interactions with individuals, except as the CCPA permits.

We will comply with the obligations that apply to us under those laws and provide the level of privacy protection they require, and we will notify you if we determine that we can no longer meet our obligations. You may take reasonable and appropriate steps to ensure that we use Customer Personal Data consistently with your obligations, and to stop and remediate any unauthorized use. We certify that we understand these restrictions and will comply with them.

We will make available to you the information necessary to demonstrate our compliance with this DPA and Article 28 of the GDPR, including written answers to reasonable security questionnaires, a description of our security measures and our list of subprocessors. We don't currently hold third-party certifications such as SOC 2 or ISO 27001.

If that information is not enough to demonstrate our compliance, if a supervisory authority requires it, or after a personal data breach, you — or an independent auditor you appoint who is bound by confidentiality and is not our competitor — may audit our compliance, including by inspection. Audits may take place no more than once in any 12 months unless a supervisory authority requires it or after a breach; need at least 30 days' written notice; take place during normal business hours with as little disruption as possible; are limited to the systems and records relevant to Customer Personal Data; must not compromise the security or confidentiality of other customers' data; and are at your expense. We will agree a reasonable scope with you in advance.

You can export Customer Personal Data from Recoatly at any time while you have access, including while your account is read-only. Exporting is how we return Customer Personal Data to you.

When a company account is deleted — by an owner, or by us when the Terms end — we will delete its Customer Personal Data from our live systems within 30 days and from our backups within 90 days, unless the law requires us to keep it. Anything we must keep remains protected by this DPA and is processed only for the purpose that requires it. On request, we will confirm the deletion in writing.

We don't delete an account just because it is read-only. An account that has had no active subscription for 12 months may be deleted after at least 30 days' notice to its owners, as described in the Terms.

Each party's liability arising out of or related to this DPA is subject to the limitations of liability in the Terms, to the extent the law allows. Nothing in this DPA limits the rights of data subjects under the Standard Contractual Clauses.

This DPA lasts for as long as we process Customer Personal Data. We may update it to reflect changes in the law or in Recoatly, but we will not reduce the overall protection it gives Customer Personal Data unless the law requires it, and we will notify account owners of significant changes at least 30 days in advance. Except where the Standard Contractual Clauses require otherwise, this DPA is governed by the same law as the Terms.

The parties

• Data exporter: the Customer — the business that holds the Recoatly account — contactable through its account owners' email addresses. Role: controller, or processor on behalf of its own client. Activities: using Recoatly to manage its customers, work, team and payments.
• Data importer: Recoatly, contactable through the contact page at https://recoatly.com/contact. Role: processor. Activities: providing Recoatly to the Customer.

Categories of data subjects

• the Customer's customers and prospective customers (leads), such as homeowners, tenants, property managers and business contacts;
• people who send inquiries, quote requests, forms, reviews, messages or signatures through the Customer's hosted website, customer portal or shared links;
• the Customer's employees and contractors, including its Users; and
• other people whose details appear in Customer Data, such as contacts at a property.

Categories of personal data

• contact details: names, email addresses, phone numbers, and mailing, service and billing addresses;
• property and access information: gate codes, access notes, measurements, map coordinates, and photos and videos;
• commercial information: estimates, contracts, e-signatures (typed name, drawn signature, time and IP address), jobs, appointments, invoices and payment records (amounts, methods and payment references, not full card numbers);
• communications: email, text and portal messages, call logs and, if used, call recordings and transcripts, reviews, and answers to forms and inspections;
• workforce information: names, contact details, roles, schedules, availability, time entries, pay rates, commissions, expenses and receipts, and precise location while a technician has location sharing switched on; and
• technical information: IP addresses, browser details and activity records in the audit log.

Sensitive data

Recoatly is not designed for special categories of personal data or other sensitive information, and the Customer should not enter it. If any is processed incidentally — for example, an access note that mentions a health condition — it is protected by the measures in Annex 2, including access restricted by role.

Frequency and nature of the processing

Continuous, for as long as the Customer uses Recoatly. Processing includes collection, storage, organization, retrieval, display, transmission (including email and text-message delivery), address geocoding, document generation, AI-assisted drafting and summarizing when a User chooses to use those features, backup and deletion.

Purpose

To provide Recoatly to the Customer under the Terms: managing customers and leads, estimates, scheduling and dispatch, jobs, invoicing and payments, communications, hosted websites and customer portals, and the related support and security.

Duration and retention

For the term of the Terms, and then until deletion as described in section 13. Location history is kept for no more than 14 days. Other records are kept for as long as the Customer keeps them in Recoatly.

Transfers to subprocessors

To the subprocessors in Annex 3, for the subject matter, nature and duration described in this Annex.

Competent supervisory authority

As determined under Clause 13 of the EU SCCs (see section 10). For the UK Addendum, the UK Information Commissioner.

These measures describe how Recoatly works today. Our Security page explains them in more detail.

• Encryption in transit. HTTPS is required in production, with HTTP Strict Transport Security. Insecure requests are upgraded, and cookies are marked Secure.
• Hosting, storage and backups. Recoatly runs on a virtual machine with persistent disk storage in a single United States region of our hosting provider. Whether data at rest is encrypted depends on the disk and storage encryption offered by our hosting provider. Database backups are encrypted and kept in object storage separate from the server, and a consistent snapshot of the database is taken automatically before every database upgrade.
• Authentication. Passwords are hashed with scrypt and a unique random salt; short and very common passwords are refused; and sign-in takes about the same time whether or not an account exists. Session and one-time tokens are random and stored only as hashes. Session cookies are HttpOnly, SameSite=Lax and Secure, and expire after 30 days. Changing or resetting a password, or changing the sign-in email, signs the person out of their other sessions.
• Access control. Role-based permissions — Owner, Administrator, Operations manager, Dispatcher, Sales rep, Field technician, Bookkeeper and Read only — adjustable per person; technicians see only the work assigned to them. API keys are stored only as hashes, limited to read or write access, can never manage billing, the team, settings or integrations, and can be revoked at any time.
• Separation of customers. Every query that reads or changes a company's records is limited to that company's organization ID, and automated end-to-end checks test these boundaries.
• Application security. A strict Content-Security-Policy that allows scripts only from our own origin (and our analytics provider, when enabled); protection against framing and content-type sniffing; no referrer on customer links; request size limits; input validation; bot traps on the sign-up and contact forms; and rate limits on sign-in, sign-up, password resets, customer links and public forms.
• Uploaded files. Only allowed file types are accepted, and formats that can carry scripts, such as SVG and HTML, are refused. Files are stored under random names in a separate folder for each company and served with a restrictive sandboxing policy; files that browsers cannot safely display are downloaded rather than opened.
• Logging and monitoring. An audit log records significant actions with the person, time, IP address and browser. Server logs and error alerts help us detect and investigate problems. Webhooks we receive from Stripe and Twilio are verified by their signatures, and webhooks we send are signed.
• Secrets. Credentials for payment, email, text-message and AI providers are kept in the server environment, not in the database, so they never appear in backups or exports.
• Data minimization. Crew location sharing is opt-in, records only while on the clock, and is deleted after 14 days or as soon as it is switched off. AI features send information to the AI provider only when a User uses them. Card details are entered on Stripe's payment pages and never reach our servers.
• People and suppliers. Access to production systems is limited to the people who operate Recoatly, who are bound by confidentiality. Subprocessors are bound by written data protection terms. Personal data breaches are handled and notified as described in section 9.
• Deletion. Customer Personal Data is deleted as described in section 13.

The subprocessors authorized under section 6 are those listed on our Subprocessors page, as updated in accordance with that section. That list is incorporated into this DPA by reference.