Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the Products Access & Services Agreement or other written agreement (the “Agreement”) between Rose Tech HQ LLC (“Provider”) and the customer company that has accepted it (“Customer”). It applies whenever Provider processes Customer Personal Data in providing LossFolio. It takes effect when Customer accepts the Agreement, with no separate signature needed. If this DPA conflicts with the Agreement on the processing of Customer Personal Data, this DPA controls.

• “Customer Personal Data” means personal information within Customer Data (as defined in the Agreement) that Provider processes on Customer's behalf — for example information about Customer's customers, their properties and claims.
• “Data Protection Laws” means U.S. federal and state privacy and data-security laws that apply to the processing, including the California Consumer Privacy Act as amended (CCPA) and other state comprehensive privacy laws.
• “Security Incident” means a confirmed breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data.
• “Subprocessor” means a third party Provider engages to process Customer Personal Data.
• “Controller”, “processor”, “business”, “service provider”, “consumer”, “sell” and “share” have the meanings given in Data Protection Laws.

Customer is the controller (or business) of Customer Personal Data, and Provider is its processor (or service provider). Provider will process Customer Personal Data only on Customer's documented instructions — the Agreement, this DPA, and Customer's use and configuration of LossFolio — unless the law requires otherwise, in which case Provider will tell Customer first unless the law prohibits it. Provider will tell Customer if it believes an instruction violates Data Protection Laws. Customer is responsible for the lawfulness of its instructions and for having any notices and consents needed to provide Customer Personal Data to Provider.

• Purpose and nature: producing reports, measurements, quotes and estimates; storing and delivering them; billing; support; and security — the services described in the Agreement.
• Duration: the term of the Agreement plus the period until deletion under section 12.
• Categories of individuals: Customer's customers (homeowners and property owners), insureds and claim contacts, and Customer's personnel named in jobs.
• Types of personal information: names, contact details, property addresses, claim and policy numbers, dates of loss, property photos, and information in documents Customer uploads.
• Sensitive information: none is required. Customer should not upload government ID numbers, financial account numbers or health information.

Provider will not:

• sell or share Customer Personal Data, or use it for targeted or cross-context behavioral advertising;
• retain, use or disclose it for any purpose other than the business purposes in the Agreement, or outside the direct business relationship with Customer;
• combine it with personal information Provider receives from others, except as Data Protection Laws allow; or
• contact or market to Customer's customers.

Provider will comply with Data Protection Laws that apply to it as a service provider, give the same level of privacy protection they require, and notify Customer if it can no longer meet these obligations. Customer may take reasonable steps to stop and remediate unauthorized use. Provider may create aggregated, de-identified information that cannot reasonably be linked to any individual, Customer or Customer's customers, and will not attempt to re-identify it.

Provider will limit access to Customer Personal Data to personnel who need it to provide, support or secure the service and who are bound by confidentiality obligations. Support access to a Customer account is time-limited, requires a recorded reason, and is visible to Customer's administrators in the account's access log.

Provider maintains administrative, technical and physical safeguards appropriate to the risk, including:

• encryption of data in transit (TLS) and at rest by Provider's hosting and database providers;
• separation of each customer's data enforced in the database (row-level security), not only in application code;
• role-based access with least privilege; immediate loss of database access when a user is deactivated;
• an append-only audit log of administrative actions and support access that no one can edit or delete;
• card data handled only by a PCI DSS–compliant payment processor, never stored by Provider;
• managed backups by Provider's database provider; security headers and a coordinated vulnerability disclosure program.

The current measures are described on the Trust Center. Provider may update them provided the overall level of protection is not reduced.

Customer authorizes Provider to use the Subprocessors listed on the Subprocessors page. Provider will impose data-protection terms on each Subprocessor that are at least as protective as this DPA, and remains responsible for their performance. Provider will give Customer's administrators at least 30 days' notice (by email and by updating that page) before a new Subprocessor processes Customer Personal Data. Customer may object on reasonable data-protection grounds within that period; the parties will work in good faith to resolve the objection, and if they cannot, Customer may stop using the affected feature or end the Agreement without penalty.

Taking into account the nature of the processing, Provider will help Customer respond to requests from individuals to exercise their rights (such as access, correction and deletion), and with data-protection assessments where required. If Provider receives a request directly from one of Customer's customers, it will forward it to Customer and will not respond except to say it has been forwarded.

Provider will notify Customer without undue delay, and in any event within 72 hours, after becoming aware of a Security Incident affecting Customer Personal Data. The notice will describe, to the extent known, what happened, the data and individuals affected, the likely consequences, and the steps taken to contain it, and Provider will update Customer as it learns more. Provider will take reasonable steps to contain and remediate the incident and will help Customer meet its own notification obligations. Notifying Customer is not an admission of fault.

On written request no more than once a year (or after a Security Incident, or when required by a regulator), Provider will make available information reasonably needed to demonstrate compliance with this DPA — such as completed security questionnaires, descriptions of controls, and any third-party audit reports or certifications Provider then holds. Where that information is not enough to meet a requirement of Data Protection Laws, the parties will agree on a reasonable, confidential, remote assessment at Customer's cost, on reasonable notice and without access to other customers' data.

During the Agreement, Customer can download its reports. When the Agreement ends, Customer may request an export of its Customer Personal Data within 30 days. Provider will then delete Customer Personal Data within 90 days after Customer's written request, except copies Provider must keep by law (for example billing and tax records) and copies in backups, which are deleted on their normal schedule. Retained copies remain protected by this DPA.

Provider and its Subprocessors process Customer Personal Data in the United States. Provider will notify Customer before moving processing outside the United States.

This DPA lasts as long as Provider processes Customer Personal Data. The limitations of liability in the Agreement apply to this DPA. Provider may update this DPA to reflect changes in law or its services, with notice to Customer, provided the update does not reduce the protection of Customer Personal Data. Customers that need a countersigned copy can request one at service@rosetechhq.com.