Data Processing Addendum

1. Definitions and Roles

"Data Protection Laws" means the privacy laws of the United States and Canada applicable to the Processing under this DPA, including the California Consumer Privacy Act as amended by the CPRA ("CCPA") and the other U.S. state privacy laws, Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA") and the provincial private-sector laws including Alberta's and British Columbia's PIPA and Quebec's Act respecting the protection of personal information in the private sector, as amended by Law 25.

In this DPA: "Personal Data" means information about an identifiable individual, including "personal information" as the CCPA, PIPEDA and Law 25 each define it; "Processing" means any operation performed on Personal Data; "Controller" means the party that determines the purposes and means of Processing (the "business" under the CCPA, and the organization accountable for the information under PIPEDA); "Processor" means a party that Processes Personal Data on the Controller's behalf (a "service provider" under the CCPA); "Data Subject" means the individual the Personal Data is about (a "consumer" under the CCPA); and "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data (a "confidentiality incident" under Law 25). "Customer Personal Data" means Personal Data contained in Customer Data that Isles Mechanical Processes on Customer's behalf. "Subprocessor" means a third party engaged by Isles Mechanical to Process Customer Personal Data.

Customer is the Controller (or, where Customer acts on behalf of its own client, a Processor with that client as Controller, in which case Customer warrants that it has authority to engage Isles Mechanical as a sub-processor on these terms) and Isles Mechanical is the Processor of Customer Personal Data. Each party complies with the Data Protection Laws that apply to it in that role.

2. Details of Processing

3. Processor Obligations and Instructions

Isles Mechanical will:

• Process Customer Personal Data only on Customer's documented instructions, which consist of the Terms of Service, this DPA, Customer's use and configuration of the Service, and any further written instructions agreed by the parties, unless required to do otherwise by law, in which case Isles Mechanical will inform Customer of that requirement before Processing unless the law prohibits it;
• Immediately inform Customer if, in its opinion, an instruction infringes Data Protection Laws, without obligation to conduct a legal review;
• Not sell Customer Personal Data, share it for cross-context behavioral advertising, retain, use or disclose it outside the direct business relationship with Customer or for any purpose other than the business purpose of providing the Service, or combine it with Personal Data received from other sources except as the CCPA permits for service providers;
• Ensure that persons authorized to Process Customer Personal Data are bound by confidentiality obligations and receive appropriate training;
• Implement the technical and organizational measures in Section 4;
• Comply with the Subprocessor conditions in Section 5;
• Assist Customer as described in Sections 6 to 8;
• Delete or return Customer Personal Data as described in Section 10;
• Make available the information necessary to demonstrate compliance and allow for audits as described in Section 9; and
• Notify Customer if it determines that it can no longer meet its obligations under Data Protection Laws, in which case Customer may take reasonable steps to stop and remediate unauthorized Processing.

4. Security Measures

Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of Processing and the risks to Data Subjects, Isles Mechanical implements and maintains the following measures, which it may update provided the overall level of protection is not reduced:

5. Subprocessors

Customer gives Isles Mechanical general written authorization to engage the Subprocessors listed on the Subprocessors page, which forms part of this DPA, and to engage additional or replacement Subprocessors subject to this Section.

• Notice. Isles Mechanical will update the Subprocessors page and notify Customer (by email to the Organization Owner and billing contacts, or by in-app notice) at least 30 days before a new Subprocessor begins Processing Customer Personal Data. Customers may subscribe to change notifications by emailing privacy@servicerunner.app.
• Objection. Customer may object on reasonable, data-protection-related grounds within that notice period by emailing privacy@servicerunner.app. The parties will discuss in good faith; if Isles Mechanical cannot reasonably accommodate the objection (for example by not using the Subprocessor for Customer's data), Customer may terminate the affected subscription on written notice and receive a pro-rata refund of prepaid Fees for the remainder of the term, as its sole remedy.
• Flow-down. Isles Mechanical will impose on each Subprocessor data protection obligations that are no less protective than those in this DPA, by written contract, and remains fully liable to Customer for the performance of each Subprocessor's obligations.
• Emergency replacement. Where a Subprocessor must be replaced urgently for security or continuity reasons, Isles Mechanical may do so with notice as soon as practicable, and Customer's objection right applies from that notice.

6. Data Subject Requests

The Service provides self-service tools that let Customer access, correct, export and delete Customer Personal Data. To the extent Customer cannot address a Data Subject request using those tools, Isles Mechanical will provide reasonable assistance on request, taking into account the nature of the Processing. If Isles Mechanical receives a request directly from a Data Subject relating to Customer Personal Data, it will (unless legally prohibited) inform the Data Subject that the request should be addressed to Customer, forward the request to Customer within 5 business days, and not respond substantively except on Customer's instruction or as required by law.

7. Personal Data Breach

Isles Mechanical will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. The notice will describe, to the extent known, the nature of the breach, the categories and approximate number of Data Subjects and records affected, the likely consequences, the measures taken or proposed, and a contact point; information may be provided in phases as it becomes available. Isles Mechanical will take reasonable steps to contain, investigate and remediate the breach and will cooperate with Customer's own notifications to regulators and affected individuals. Notification is not an acknowledgement of fault or liability.

8. Assistance with Impact Assessments and Consultations

Taking into account the nature of the Processing and the information available to it, Isles Mechanical will provide reasonable assistance to Customer in carrying out data privacy impact assessments and consultations with regulators that relate to the Service (including privacy impact assessments required by Quebec Law 25 for cross-border communication), and in fulfilling Customer's obligation to maintain the security of Customer Personal Data. This DPA, the Privacy Policy, the Security section and the Subprocessors page are intended to supply the information most assessments need; assistance beyond that may be charged at Isles Mechanical's then-current professional services rates.

9. Audits

Isles Mechanical will make available to Customer, on written request no more than once per 12 months (or additionally after a Personal Data Breach affecting Customer or where required by a regulator), the information reasonably necessary to demonstrate compliance with this DPA. This will normally consist of: this DPA; the current security documentation; completed security questionnaires; and, where Isles Mechanical holds third-party audit reports or certifications (such as SOC 2 Type II or ISO 27001), a copy or summary of those reports under confidentiality. Reports for hosting Subprocessors are provided by reference to those Subprocessors' published reports.

If the information provided is not reasonably sufficient to demonstrate compliance, Customer (or an independent auditor bound by confidentiality and approved by Isles Mechanical, not a competitor) may conduct an audit, limited to the matters in dispute, during business hours, on at least 30 days' written notice, no more than once in any 12-month period, at Customer's expense, in a manner that does not disrupt Isles Mechanical's business or compromise other customers' data. Audits are conducted remotely by document review and interviews unless an on-site visit is required by Data Protection Laws or a regulator. Isles Mechanical will remediate material findings within a reasonable time.

10. Return and Deletion

During the term, Customer may export Customer Personal Data at any time. After termination or expiry of the Service, Customer may export Customer Personal Data during the 30-day Export Window described in the Terms. Thereafter Isles Mechanical will delete Customer Personal Data from active systems within 90 days of termination and from backups within 6 months as backup media rotate, and will certify deletion in writing on request, unless retention is required by applicable law, in which case Isles Mechanical will continue to protect the retained data under this DPA and Process it only for the purpose of that legal requirement. Deletion of data on user devices (offline caches, queued photos and location points) is Customer's responsibility and is achieved by signing out or removing the app.

Customer invoice, card-payment, agreement-consent and QuickBooks sync evidence follows this account deletion process unless a separate legal retention requirement applies. We do not promise a seven-year archive of all Customer financial evidence. Disconnecting a provider does not delete data already held by that provider or immediately erase local reconciliation history; QuickBooks credential revocation can require retries or action in QuickBooks.

11. Transfers and Canadian Accountability

The Service is offered in the United States and Canada only (Terms Section 1.3). Customer authorizes Isles Mechanical and its Subprocessors to Process Customer Personal Data in the United States and in the other locations listed on the Subprocessors page, subject to the following:

• Accountability on transfer. PIPEDA and the provincial private-sector laws permit a transfer for processing where the transferring organization remains accountable and uses contractual or other means to provide a comparable level of protection while the information is in the Processor's hands. Isles Mechanical provides that protection by written contract with each Subprocessor, imposing obligations no less protective than this DPA, and remains liable to Customer for each Subprocessor's performance (Section 5).
• Notice. Customer is responsible for telling its own staff and clients that their personal information may be processed outside Canada and may be accessible to the courts, law enforcement and national security authorities of the country where it is processed. This DPA, the Privacy Policy and the Subprocessors page contain the information Customer needs to give that notice.
• Quebec. Isles Mechanical will assist Customer with the privacy impact assessment Law 25 requires before personal information is communicated outside Quebec, by supplying the information about the transfer, the recipients and the protective measures that the assessment needs.
• Government access. Isles Mechanical will notify Customer of a binding request from a public authority for Customer Personal Data unless legally prohibited, will challenge a request that appears overbroad or unlawful, and will disclose only the minimum the request compels.
• No other regions. Isles Mechanical makes no commitment in this DPA about transfers governed by the law of any country other than the United States and Canada, and Customer must not use the Service to process personal data that is subject to such a law.

12. CCPA Service-Provider Terms

To the extent the CCPA applies, Customer discloses Customer Personal Data to Isles Mechanical only for the limited and specified business purpose of providing the Service, and Isles Mechanical certifies that it understands and will comply with the restrictions in Section 3, will comply with the CCPA and provide the same level of privacy protection the CCPA requires of businesses, will notify Customer if it can no longer meet its obligations, and grants Customer the right to take reasonable and appropriate steps to ensure that Isles Mechanical uses Customer Personal Data consistently with Customer's obligations and to stop and remediate unauthorized use. Isles Mechanical will cooperate with Customer in responding to verifiable consumer requests. The parties acknowledge that the disclosure of Customer Personal Data to Isles Mechanical is not a sale or sharing, and that no monetary or other valuable consideration is exchanged for it.

13. Liability and General

Each party's liability arising out of or relating to this DPA is subject to the exclusions and limitations of liability in the Terms of Service, and the aggregate liability of Isles Mechanical under the Terms and this DPA together will not exceed the cap stated in the Terms. Nothing in this Section limits a party's liability that cannot be limited by Data Protection Laws, or the rights those laws give Data Subjects directly. Where Isles Mechanical and Customer are jointly liable to a Data Subject, each is responsible for the part of the damage attributable to it.

This DPA prevails over the Terms of Service to the extent of any conflict regarding the Processing of Customer Personal Data. It is governed by the law and dispute-resolution provisions of the Terms. It terminates automatically when Isles Mechanical has deleted or returned all Customer Personal Data. Customers who require a signed copy, or a version tailored to a specific U.S. or Canadian regulatory regime, may request one from privacy@servicerunner.app.