Data Processing Addendum

1. Definitions

• "Customer Personal Data" means personal information in Customer Data that we process on the Organization's behalf.
• "Process" means any operation on data, such as collecting, storing, using, sending, or deleting it.
• "Subprocessor" means a service provider we engage that processes Customer Personal Data.
• "Security Incident" means a confirmed breach of security that leads to the accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of, or access to, Customer Personal Data.
• "Privacy Laws" means the U.S. federal and state privacy, biometric privacy, and data security laws that apply to the processing.

Other capitalized words mean what they mean in the Terms of Service.

2. Roles

The Organization decides why and how Customer Personal Data is processed, and is its controller (or "business" or the equivalent under Privacy Laws). We process it only on the Organization's behalf, as its processor (or "service provider," "contractor," or the equivalent).

The Organization is responsible for having a lawful basis, and for giving every notice and obtaining every consent Privacy Laws require, for the Customer Personal Data it puts in the Service and the features it turns on, including face clock-in, Community Alerts, Recruiting, and Incident Reporting.

3. Processing on the Organization's Instructions

We process Customer Personal Data only to provide the Service, and only on the Organization's documented instructions. The Agreement, this DPA, and the Organization's configuration and use of the Service, including the modules, integrations, Workflows, and NERIS connection it enables, are its instructions. We will tell the Organization if we believe an instruction violates Privacy Laws.

We will not:

• Sell or share Customer Personal Data, or use it for targeted or cross-context behavioral advertising
• Retain, use, or disclose it for any purpose other than providing the Service, or outside our direct business relationship with the Organization, except as Privacy Laws permit
• Combine it with personal information we receive from others, except as Privacy Laws permit for providing the Service
• Use it to train AI models of our own

We may create information that is de-identified so that it cannot reasonably be linked to a person or an Organization, such as performance measurements, and use it to maintain and improve the Service. We will not try to re-identify it.

4. Our Personnel

We limit access to Customer Personal Data to personnel who need it to provide, support, and secure the Service. They are bound by confidentiality obligations. Their access to an Organization's account is recorded in our audit logs, as described in the Terms of Service.

5. Security

We maintain technical and organizational measures designed to protect Customer Personal Data, appropriate to its nature and the risks, including:

• Encryption in transit (HTTPS) for the Service
• One-way hashing of passwords and kiosk PINs
• Encryption at rest of face templates (AES-256-GCM), authenticator secrets, text messaging credentials, and stored outside-service logins
• Logical separation of each Organization's data, and role-based permissions the Organization controls
• Two-factor sign-in available to every Organization
• Audit logs of significant actions, sign-ins, and our staff's access
• Hosting with providers that maintain recognized security programs
• Limits on our staff's access, including keeping Payroll's personal pay information from our staff unless the Organization allows it

We may update these measures as long as the update does not materially lower the overall protection of Customer Personal Data.

6. Subprocessors

The Organization authorizes us to engage the Subprocessors listed on our Subprocessors page. We require each Subprocessor, by contract or by its terms of service, to protect Customer Personal Data and to use it only to provide its service to us, and we are responsible for our Subprocessors' compliance with this DPA.

We will update the Subprocessors page before a new Subprocessor begins processing Customer Personal Data. If an Organization has a reasonable objection related to data protection, it may tell us within 15 days. We will work with it in good faith to address the objection, and if we cannot, it may end the affected part of the Service and receive a refund of any prepaid fees for the remaining term.

Services an Organization connects with its own account, such as Active911, PSTrax, WhenToWork, Google Sheets, a weather service, or a Twilio account, and NERIS, receive data at the Organization's direction. They are not our Subprocessors, and the Organization's own arrangements with them apply.

7. Security Incidents

If we confirm a Security Incident, we will notify the affected Organization without undue delay, and no later than 72 hours after we confirm it. We will tell the Organization what we know, including the nature of the incident, the kinds of data and people affected, and what we are doing about it, and we will update it as we learn more.

We will take reasonable steps to contain and fix the incident and will help the Organization meet its own notification obligations. Unless the law requires us to, we will not notify the Organization's members or residents directly without consulting the Organization first.

8. Requests and Assistance

• Individuals' requests. If we receive a request from a person to access, correct, or delete their Customer Personal Data, we will pass it to the Organization and not answer it ourselves, unless the law requires. The Service lets Organizations find, correct, export, and delete most personal information themselves, and we will provide reasonable help where it does not.
• Public records requests. We will refer public records requests for Customer Data to the Organization and give reasonable help exporting records it needs to respond.
• Legal demands. If a government or court demands Customer Personal Data from us, we will refer it to the Organization where possible, and tell the Organization before we respond unless the law prohibits it.
• Assessments. We will provide information reasonably needed for the Organization to complete privacy or security assessments that Privacy Laws require of it.

9. Information and Audits

Once a year, or after a Security Incident, an Organization may ask us to answer a reasonable written security questionnaire or provide documentation that shows our compliance with this DPA. If Privacy Laws require more, such as an on-site audit, we will agree in good faith on a reasonable scope, timing, and confidentiality, at the Organization's expense.

10. Return and Deletion

While its account is active, an Organization can export its records using the exports in each module, and we will provide reasonable help exporting records it needs.

After the Organization's account ends, we delete Customer Personal Data from our production systems, generally within 30 days, unless the Organization's agreement or the law requires us to keep it. Copies in backups are deleted as backups are overwritten in the normal cycle, and remain protected under this DPA until then. Face templates are destroyed on the schedule in our Biometric Information Policy. On request, we will confirm deletion in writing.

11. Specific Kinds of Data

• Biometric information. Our Biometric Information Policy applies to face templates and is part of this DPA.
• Health information. We are not a business associate under HIPAA unless we sign a business associate agreement with the Organization. Without one, the Organization must not enter protected health information beyond what the Incident Reporting fields ask for.
• Criminal justice information. The Service is not designed for criminal justice information that requires CJIS compliance, and the Organization must not send it to the Service.
• Children's information. The Organization is responsible for any parent or guardian consent required for minors' information, including for face clock-in.

12. Where Data Is Processed

We store Customer Personal Data in the United States, and we will not move where it is stored outside the United States without telling the Organization first.

13. General

This DPA lasts as long as we process Customer Personal Data for the Organization. If this DPA conflicts with the Terms of Service about personal information, this DPA controls; if a signed agreement or signed DPA between us and the Organization conflicts with this DPA, the signed document controls. Limits on liability in the Agreement apply to this DPA to the extent the law allows. We may update this DPA to reflect changes in law or in the Service, without reducing its protections for Customer Personal Data already collected.