Data Processing Addendum

“Applicable Data Protection Law” means privacy and data-protection law applicable to the processing covered by this DPA. “Customer Personal Data” means personal information contained in Customer Data that AssociationOps360 processes for the customer. “Process,” “controller,” “processor,” “business,” and “service provider” have the meanings assigned by applicable law. “Subprocessor” means a third party engaged by AssociationOps360 to process Customer Personal Data for the service.

The customer is the controller or business for Customer Personal Data, and AssociationOps360 is its processor or service provider, except where AssociationOps360 independently determines processing for account administration, security, billing, legal compliance, or other purposes described in the Privacy Policy.

AssociationOps360 will process Customer Personal Data only to provide, secure, support, and improve the subscribed service; comply with the Agreement, Order Record, configured features, authorized user activity, and other documented customer instructions; or comply with law. AssociationOps360 will inform the customer if an instruction appears to violate applicable law, unless prohibited from doing so.

The customer is responsible for lawful collection and use of Customer Personal Data; notices, consents, and other legal bases; the accuracy and scope of its instructions; user authorization; configuration choices; and ensuring that sensitive information is submitted only through an expressly supported workflow. The customer will not direct AssociationOps360 to process data in violation of law or the Agreement.

The Agreement's Protection against reverse engineering and competitive use provisions, repeated in section 4 of the Acceptable Use Policy, are incorporated into this DPA. Access to data, audit information, systems, or other Service Materials under this DPA does not authorize prohibited competitive development, training, or improvement. This incorporation does not alter ownership of Customer Data, AssociationOps360's processing obligations, mandatory data-protection rights, or an audit, disclosure, export, or interoperability right that applicable law prohibits the parties from restricting.

AssociationOps360 will limit access to Customer Personal Data to personnel and contractors who need it for the service and who are bound by confidentiality obligations. AssociationOps360 will provide appropriate privacy and security guidance to personnel with access and will remain responsible for their compliance with this DPA.

AssociationOps360 will maintain reasonable administrative, technical, and organizational safeguards appropriate to the nature of Customer Personal Data and the risks of processing. The applicable safeguards are described in Schedule 2 and will reflect the service as actually hosted and configured.

No security program eliminates all risk. The customer remains responsible for its users, devices, credentials, role assignments, exported copies, and promptly reporting suspected unauthorized access.

AssociationOps360 will notify the customer without undue delay after confirming unauthorized access to, acquisition of, or disclosure of Customer Personal Data in AssociationOps360’s custody or control. Notice will include information reasonably available about the nature of the incident, affected data, likely consequences, containment, and remediation. Notice is not an admission of fault or liability.

AssociationOps360 will take reasonable steps to contain, investigate, and remediate a confirmed incident and will reasonably cooperate with the customer’s legally required notices. The customer is responsible for determining whether notice to individuals or authorities is required, except where law assigns that duty directly to AssociationOps360.

The customer authorizes AssociationOps360 to engage Subprocessors needed to provide the service, provided that each Subprocessor is bound by written data-protection obligations appropriate to its services. AssociationOps360 remains responsible for a Subprocessor’s performance of those obligations to the extent required by law.

AssociationOps360 will maintain a current Subprocessor List identifying the provider, service purpose, processing location when known, and applicable safeguards. Before production launch, that list will identify the actual hosting, authentication, storage, communications, billing, support, and security providers. Customers may raise a reasonable, documented data-protection objection to a new Subprocessor within 15 days after notice. The parties will work in good faith on a commercially reasonable resolution; if none is available, either party may terminate the affected service without penalty for the unused prepaid period.

Taking into account the nature of processing, AssociationOps360 will provide reasonable assistance for verified requests to access, correct, delete, restrict, or export Customer Personal Data when the customer cannot fulfill the request through service controls. AssociationOps360 may direct an individual to the relevant customer when that customer controls the record.

AssociationOps360 will provide reasonable information needed for the customer’s data-protection impact assessments, consultations, and legally required regulatory responses, considering the information available to AssociationOps360. Additional work beyond standard service capabilities may be subject to agreed fees unless caused by AssociationOps360’s breach.

Unless prohibited by law, AssociationOps360 will notify the customer of a legally binding request for Customer Personal Data and will provide reasonable information so the customer may seek protection. AssociationOps360 will disclose only the information it reasonably determines is legally required.

During service, the customer may use authorized export features available under its plan. After paid-service termination, eligible Customer Data may be retrieved for 30 days under the Agreement. Trial access becomes read-only after 30 days, and trial data is retained for up to 90 days after the trial ends before becoming eligible for deletion.

After the applicable retrieval period, AssociationOps360 will delete or render inaccessible Customer Personal Data within a commercially reasonable period, subject to legal holds, disputes, required records, backup cycles, security records, and technical limitations. Data retained for those limited purposes remains protected and is not used for ordinary service delivery.

On reasonable written request and subject to confidentiality, AssociationOps360 will provide then-current information reasonably sufficient to demonstrate compliance, such as relevant policies, summaries, certifications, or independent assessments when available. If that information is insufficient and law requires more, the parties will agree on a scoped review that minimizes disruption, protects other customers, and avoids access to systems or data unrelated to the customer. The customer bears reasonable costs unless the review identifies a material breach by AssociationOps360.

Customer Personal Data may be processed in the United States and in other locations used by approved Subprocessors. When Applicable Data Protection Law requires a transfer mechanism, the parties will use the applicable standard contractual clauses, addendum, certification, or other lawful mechanism. Any required transfer annex will be completed using the processing details in Schedule 1 and the actual Subprocessor List.

Where AssociationOps360 acts as a service provider or processor under U.S. state privacy law, it will not sell or share Customer Personal Data for cross-context behavioral advertising; retain, use, or disclose it outside the business purposes in the Agreement and customer instructions except as permitted by law; or combine it with personal information received from another source except as allowed by law. AssociationOps360 will notify the customer if it determines it can no longer meet these obligations and will allow reasonable steps to stop and remediate unauthorized use.

The liability limitations and exclusions in the Customer Subscription Agreement apply to this DPA to the fullest extent permitted by law. If this DPA conflicts with the Agreement on processing Customer Personal Data, this DPA controls. This DPA remains in effect while AssociationOps360 processes Customer Personal Data for the customer.

Subject matter and duration: operation, security, support, and administration of the subscribed property-operations service for the subscription term and applicable retention periods.

Nature and purpose: receiving, organizing, storing, displaying, transmitting, securing, searching, reporting, exporting, backing up, and deleting data as needed to provide the service and follow customer instructions.

Data subjects: customer personnel, authorized users, requesters, residents, board members, vendors, contractors, service providers, business contacts, and other individuals represented in customer-controlled operational records.

Data categories: identity and contact information; account, role, authorization, and authentication information; property and location information; work orders, requests, assets, maintenance, inspections, projects, inventory, vendor, bid, document, photograph, comment, approval, signature, cost, and reporting information; device, log, diagnostic, upload, and export events.

Sensitive data: not intended unless an expressly supported workflow and lawful customer instruction permit it. Customers must not submit Social Security numbers, full payment-card data, medical records, biometric identifiers, government identification numbers, or similarly sensitive information through ordinary workflows.

Access and identity: unique accounts; role-based access; Manager and Admin approval authority; authentication and account-recovery controls appropriate to the hosted service; least-privilege administrative access; and prompt revocation when access is no longer authorized.

Separation and authorization: organization, property, and role boundaries enforced in application and data access; authorization checks on records, attachments, reports, and exports; and controlled administrative support access.

Data protection: encrypted transport for hosted service traffic; encryption-at-rest capabilities supplied by approved infrastructure where configured; secure secret handling; attachment access controls; optimized image storage; and controlled export generation.

Operations and resilience: logging of relevant authentication, administrative, upload, and export activity; monitored background work; backups and restoration procedures appropriate to the configured infrastructure; change control; dependency and vulnerability management; and incident response.

Development and assurance: source control, peer or controlled review, automated checks, tenant-boundary tests, release gates, environment separation, and verification of affected user workflows before production deployment.

Provider management and deletion: review of Subprocessors appropriate to risk; contractual data-protection terms; documented retention and deletion behavior; and controlled handling of media, backups, exports, and customer transitions.

Hosted-environment qualification: the final production control description, Subprocessor List, backup and recovery evidence, email and billing configurations, authentication recovery, rate limits, monitoring, and security settings must match the deployed environment. No unverified control is represented as active merely because it appears in this schedule.